PHP Web 木马扫描器代码

scanner.php：

<?php /**************PHP Web木马扫描器************************/ /* [+] 功能: web版php木马扫描工具*/ /* [+] 注意: 扫描出来的文件并不一定就是后门, */ /* 请自行判断、审核、对比原文件。*/ /* 如果你不确定扫出来的文件是否为后门，*/ /* 欢迎你把该文件发给我进行分析。*/ /*******************************************************/ ob_start(); set_time_limit(0); $username = "t00ls"; //设置用户名 $password = "t00ls"; //设置密码 $md5 = md5(md5($username).md5($password)); $version = "PHP Web木马扫描器v1.0"; $realpath = realpath('./'); $selfpath = $_SERVER['PHP_SELF']; $selfpath = substr($selfpath, 0, strrpos($selfpath,'/')); define('REALPATH', str_replace('//','/',str_replace('\\','/',substr($realpath, 0, strlen($realpath) - strlen($selfpath))))); define('MYFILE', basename(__FILE__)); define('MYPATH', str_replace('\\', '/', dirname(__FILE__)).'/'); define('MYFULLPATH', str_replace('\\', '/', (__FILE__))); define('HOST', "http://".$_SERVER['HTTP_HOST']); ?>

*添加微信xzpq17385152191咨询了解渗透课程-免费领取渗透学习资料以及学习工具

<?php *添加微信xzpq17385152191咨询了解渗透课程-免费领取渗透学习资料以及学习工具

if(!(isset($_COOKIE[‘t00ls’]) && $_COOKIE[‘t00ls’] == KaTeX parse error: Expected 'EOF', got '&' at position 6: md5) &̲& !(isset(_POST[‘username’]) && isset(KaTeX parse error: Expected 'EOF', got '&' at position 20: …T['password']) &̲& (md5(md5(_POST[‘username’]).md5(${}_{P}OST{[}^{\prime }passwor{d}^{\prime }]))==$md5)))
{
echo '用户名: 密码: ';
}
elseif(isset(KaTeX parse error: Expected 'EOF', got '&' at position 20: …T['username']) &̲& isset(_POST[‘password’]) && (md5(md5(${}_{P}OST{[}^{\prime }usernam{e}^{\prime }]).md5($_POST[‘password’]))$md5))
{
setcookie(“t00ls”, $md5, time()+606024365,"/");
echo “登陆 www.webshell.cc 成功！”;
header( ‘refresh: 1; url=’.MYFILE.’?action=scan’ );
exit();
}
else
{
setcookie(“t00ls”, $md5, time()+606024365,"/");
$setting = getSetting();
$action=isset($_GET[‘action’])?${}_{G}ET{[}^{\prime }actio{n}^{\prime }]:"";if($action"logout")
{
setcookie (“t00ls”, “”, time() - 3600);
Header(“Location: “.MYFILE);
exit();
}
*添加微信xzpq17385152191咨询了解渗透课程-免费领取渗透学习资料以及学习工具
if(KaTeX parse error: Expected 'EOF', got '&' at position 20: …on=="download" &̲& isset(_GET[‘file’]) && trim($_GET[‘file’])!=””)
{
$file = ${}_{G}ET{[}^{\prime }fil{e}^{\prime }];o{b}_{c}lean();if(@fil{e}_{e}xists($file)) {
header(“Content-type: application/octet-stream”);
header(“Content-Disposition: filename=”".basename(KaTeX parse error: Can't use function '\"' in math mode at position 8: file)."\̲"̲"); echo file_g…file);
}
exit();
}
?>

<?php echo $_SERVER['SERVER_ADDR']?><?php echo "$version"?>

<?=date("Y-m-d H:i:s",mktime())?> 扫描 | 设定 | 登出

<?php if($action=="setting") { if(isset($_POST['btnsetting'])) { $Ssetting = array(); $Ssetting['user']=isset($_POST['checkuser'])?$_POST['checkuser']:"php | php? | phtml"; $Ssetting['all']=isset($_POST['checkall'])&&$_POST['checkall']=="on"?1:0; $Ssetting['hta']=isset($_POST['checkhta'])&&$_POST['checkhta']=="on"?1:0; setcookie("t00ls_s", base64_encode(serialize($Ssetting)), time()+60*60*24*365,"/"); echo "设置完成！"; header( 'refresh: 1; url='.MYFILE.'?action=setting' ); exit(); } ?> *添加微信xzpq17385152191咨询了解渗透课程-免费领取渗透学习资料以及学习工具 扫描设定

文件后缀:
所有文件

$dir=isset($_POST[‘path’])?$_POST[‘path’]:MYPATH;
$dir=substr($dir,-1)!="/"?$dir."/":$dir;
?>

扫描路径:

<?php if(isset($_POST['btnScan'])) { $start=mktime(); $is_user = array(); $is_ext = ""; $list = ""; if(trim($setting['user'])!="") { $is_user = explode("|",$setting['user']); if(count($is_user)>0) { foreach($is_user as $key=>$value) $is_user[$key]=trim(str_replace("?","(.)",$value));

一个在php环境下扫描php木马的工具，目前可扫出以下特征码
特征码：
后门特征->cha88.cn
后门特征->c99shell
后门特征->phpspy
后门特征->Scanners
后门特征->cmd.php
后门特征->str_rot13
后门特征->webshell
后门特征->EgY_SpIdEr
后门特征->tools88.com
后门特征->SECFORCE
后门特征->eval("?>
可疑代码特征->system(
可疑代码特征->passthru(
可疑代码特征->shell_exec(
可疑代码特征->exec(
可疑代码特征->popen(
可疑代码特征->proc_open
可疑代码特征->eval($
可疑代码特征->assert($
危险MYSQL代码->returns string soname
危险MYSQL代码->into outfile
危险MYSQL代码->load_file
加密后门特征->eval(gzinflate(
加密后门特征->eval(base64_decode(
加密后门特征->eval(gzuncompress(
加密后门特征->gzuncompress(base64_decode(
加密后门特征->base64_decode(gzuncompress(
一句话后门特征->eval(${}_{一}句话后门特征->assert($_
一句话后门特征->require(${}_{一}句话后门特征->requir{e}_{o}nce($_
一句话后门特征->include(${}_{一}句话后门特征->includ{e}_{o}nce($_
一句话后门特征->call_user_func(“assert”
一句话后门特征->call_user_func(${}_{\ast }添加微信xzpq17385152191咨询了解渗透课程-免费领取渗透学习资一句话后门特征->$_POST/GET/REQUEST/COOKIE[?](${}_{P}OST/GET/REQUEST/COOKIE[?]一句话后门特征->echo(fil{e}_{g}e{t}_{c}ontents($_POST/GET/REQUEST/COOKIE
上传后门特征->file_put_contents(${}_{P}OST/GET/REQUEST/COOKIE,$_POST/GET/REQUEST/COOKIE
上传后门特征->fputs(fopen("?",“w”),$_POST/GET/REQUEST/COOKIE[
.htaccess插马特征->SetHandler application/x-httpd-php
.htaccess插马特征->php_value auto_prepend_file
.htaccess插马特征->php_value auto_append_file
懒惰设计，直接套用phpspy样式
注意: 扫描出来的文件并不一定就是后门, 请自行判断、审核、对比原文件。