python腳本實(shí)現(xiàn)查找webshell的方法

更新時(shí)間：2014年07月31日 17:04:35 投稿：shichen2014

這篇文章主要介紹了python腳本實(shí)現(xiàn)查找webshell的方法,是很實(shí)用的一個(gè)功能,需要的朋友可以參考下

本文講述了一個(gè)python查找 webshell腳本的代碼，除了查找webshell功能之外還具有白名單功能，以及發(fā)現(xiàn)惡意代碼發(fā)送郵件報(bào)警等功能，感興趣的朋友可以自己測(cè)試一下看看效果。

具體的功能代碼如下：

#!/usr/bin/env python
#-*- coding: utf-8 -*-

import os
import sys
import re
import smtplib

#設(shè)定郵件
fromaddr = "smtp.qq.com"
toaddrs = ["voilet@qq.com"]
username = "voilet"
password = "xxxxxx"


#設(shè)置白名單
pass_file = ["api_ucenter.php"]

#定義發(fā)送郵件函數(shù)
def sendmail(toaddrs,sub,content):
  '發(fā)送郵件模塊'
  # Add the From: and To: headers at the start!
  msg = ("From: %s\r\nTo: %s\r\nSubject: %s\r\n\r\n"
      % (fromaddr, ", ".join(toaddrs), sub))
  msg += content
  server = smtplib.SMTP('mail.funshion.com', 25,)
  server.login(username, password)
  server.sendmail(fromaddr, toaddrs, msg)
  server.quit()

#設(shè)置搜索特征碼
rulelist = [
  '(\$_(GET|POST|REQUEST)\[.{0,15}\]\(\$_(GET|POST|REQUEST)\[.{0,15}\]\))',
  '(base64_decode\([\'"][\w\+/=]{200,}[\'"]\))',
  'eval\(base64_decode\(',
  '(eval\(\$_(POST|GET|REQUEST)\[.{0,15}\]\))',
  '(assert\(\$_(POST|GET|REQUEST)\[.{0,15}\]\))',
  '(\$[\w_]{0,15}\(\$_(POST|GET|REQUEST)\[.{0,15}\]\))',
  '(wscript\.shell)',
  '(gethostbyname\()',
  '(cmd\.exe)',
  '(shell\.application)',
  '(documents\s+and\s+settings)',
  '(system32)',
  '(serv-u)',
  '(提權(quán))',
  '(phpspy)',
  '(后門)',
  '(webshell)',
  '(Program\s+Files)',
  'www.phpdp.com',
  'phpdp',
  'PHP神盾',
  'decryption',
  'Ca3tie1',
  'GIF89a',
  'IKFBILUvM0VCJD\/APDolOjtW0tgeKAwA',
  '\'e\'\.\'v\'\.\'a\'\.\'l\'',
]

def Scan(path):
  for root,dirs,files in os.walk(path):
    for filespath in files:
      isover = False
      if '.' in filespath:
        ext = filespath[(filespath.rindex('.')+1):]
        if ext=='php' and filespath not in pass_file:
          file= open(os.path.join(root,filespath))
          filestr = file.read()
          file.close()
          for rule in rulelist:
            result = re.compile(rule).findall(filestr)
            if result:
              print '文件：'+os.path.join(root,filespath)
              print '惡意代碼：'+str(result[0])
              print '\n\n'
              sendmail(toaddrs,"增值發(fā)現(xiàn)惡意代碼",'文件：'+os.path.join(root,filespath)+"\n" + '惡意代碼：'+str(result[0]))
              break

try:
  if os.path.lexists("/home/web_root/"):
    print('\n\n開始掃描：'+ "/home/web_root/")
    print('        可疑文件         ')
    print('########################################')
    Scan("/home/web_root/")
    print('提示：掃描完成--~')
  else:
    print '提示：指定的掃描目錄不存在--- '
except IndexError:
  print "請(qǐng)指定掃描文件目錄"

您可能感興趣的文章: