服务器恶意脚本检测

├── README.md ├── index.php └── reservoir.php /README.md: -------------------------------------------------------------------------------- 1 | Webshell_finder 2 | =============== 3 | 4 | 网站木马检测 5 | 本例中的程序会一一扫描指定目录中的文件，采用了正则匹配的方式来查找恶意脚本。与前人产品不同的是，本作品没有使用单一的判别标准。本作品事先定义好在服务器中常见的带有风险的操作和期危险度的权值，在扫描牟文静的过程中，为该文件中出现的所有敏感操作会被全部扫描出，所有敏感操作的危险度的权值会被相加，得到该文件的危险指数。根据设定的危险指数阀值，危险指数大于危险阀值的文件会被报告为“危险”，危险指数大于可疑阀值但小于危险阀值的文件会被报告为“可疑”。 6 | 7 | 本例与传统的以正则匹配的方式来查找恶意脚本的方式相比，能在漏报率不增加的情况下，大幅度降低误报率。 8 | -------------------------------------------------------------------------------- /index.php: -------------------------------------------------------------------------------- 1 | index.php 2 | 17 | 18 | 22 | 23 | 服务器恶意脚本检测 24 | 25 | 26 | 服务器恶意脚本检测
27 | 首页 | 扫描 |关于

28 | 29 | 41 | 51 | "; 57 | echo "电子信息学院信息安全
"; 58 | echo "指导老师方勇

"; 59 | echo "刘梓溪 1142053001
"; 60 | echo "李亚威 1142053025
"; 61 | echo "张仁栋 1142053007
"; 62 | echo "张航 1142053005
"; 63 | } 64 | elseif($action=="download" && isset($_GET['file']) && trim($_GET['file'])!="") 65 | { 66 | $file = $_GET['file']; 67 | ob_clean(); 68 | if (@file_exists($file)) { 69 | header("Content-type: application/octet-stream"); 70 | header("Content-Disposition: filename=\"".basename($file)."\""); 71 | echo file_get_contents($file); 72 | } 73 | exit(); 74 | } 75 | 76 | elseif($action=="home"){ 77 | echo "

"; 78 | echo "四川大学大学生创新训练计划作品
"; 79 | } 80 | 81 | if($_POST[btnScan]){ 82 | $Ssetting = array(); 83 | $Ssetting['user']=isset($_POST['checkuser'])?$_POST['checkuser']:"php | php? | phtml"; 84 | $Ssetting['all']=isset($_POST['checkall'])&&$_POST['checkall']=="on"?1:0; 85 | $Ssetting['hta']=isset($_POST['checkhta'])&&$_POST['checkhta']=="on"?1:0; 86 | setcookie("t00ls_s", base64_encode(serialize($Ssetting)), time()+60*60*24*365,"/"); 87 | // 88 | $start=time(); 89 | $is_user = array(); 90 | $is_ext = ""; 91 | $list = ""; 92 | 93 | if(trim($setting['user'])!="") 94 | { 95 | $is_user = explode("|",$setting['user']); 96 | if(count($is_user)>0) 97 | { 98 | foreach($is_user as $key=>$value) 99 | $is_user[$key]=trim(str_replace("?","(.)",$value)); 100 | $is_ext = "(\.".implode("($|\.))|(\.",$is_user)."($|\.))"; 101 | } 102 | } 103 | if($setting['hta']==1) 104 | { 105 | $is_hta=1; 106 | $is_ext = strlen($is_ext)>0?$is_ext."|":$is_ext; 107 | $is_ext.="(^\.htaccess$)"; 108 | } 109 | if($setting['all']==1 || (strlen($is_ext)==0 && $setting['hta']==0)) 110 | { 111 | $is_ext="(.+)"; 112 | } 113 | 114 | $php_code = getCode(); 115 | if(!is_readable($dir)) 116 | $dir = MYPATH; 117 | $count=$scanned=0; 118 | scan($dir,$is_ext); 119 | $end=time(); 120 | $spent = ($end - $start); 121 | ?> 122 | 123 |

扫描: 文件 | 发现: 处可疑代码 | 耗时: 秒

124 | 125 | 126 | 127 | 128 | 129 | 130 | 131 | 132 | 133 | 134 | 135 |

文件

更新时间

结论

危险指数

细节

动作

136 | $value) 167 | { 168 | //global $weight; 169 | //echo $value; 170 | //echo " "; 171 | //echo "$weight"; 172 | //echo "
"; 173 | if(preg_match("/$value/i",$content)) 174 | { 175 | 176 | $count++; 177 | $j = $count % 2 + 1; 178 | $filetime = date('Y-m-d H:i:s',filemtime($current)); 179 | $reason = explode("->",$key); 180 | $weight=$weight+$reason[2];//权重相加（可以替换为其他算法） 181 | //$sum_reason=$sum_reason." ".$reason[0]."
"; 182 | $detail=$detail.$reason[0]."——".$reason[1]."——".$reason[2]."
"; 183 | 184 | } 185 | } 186 | //特征库匹配完毕 187 | //判断是否为恶意脚本↓ 188 | if($weight>100){ 189 | //echo "weight is ".$weight; 190 | //echo "
"; 191 | $url = str_replace(REALPATH,HOST,$current); 192 | preg_match("/$value/i",$content,$arr); 193 | $list_clour="IndianRed"; 194 | if ($weight<250) 195 | $list_clour="Orange"; 196 | $result="危险"; 197 | if ($weight<250) 198 | $result="可疑"; 199 | $list.=" 200 | 201 | 202 | $current 203 | $filetime 204 | $result 205 | $weight 206 | 点击查看 207 | 下载 208 | "; 209 | 210 | 211 | } 212 | 213 | } 214 | } 215 | } 216 | } 217 | closedir( $dh ); 218 | } 219 | function getSetting() 220 | { 221 | $Ssetting = array(); 222 | if(isset($_COOKIE['3s'])) 223 | { 224 | $Ssetting = unserialize(base64_decode($_COOKIE['3s'])); 225 | $Ssetting['user']=isset($Ssetting['user'])?$Ssetting['user']:"php | php? | phtml | shtml"; 226 | $Ssetting['all']=isset($Ssetting['all'])?intval($Ssetting['all']):0; 227 | $Ssetting['hta']=isset($Ssetting['hta'])?intval($Ssetting['hta']):1; 228 | } 229 | else 230 | { 231 | $Ssetting['user']="php | php? | phtml | shtml"; 232 | $Ssetting['all']=0; 233 | $Ssetting['hta']=1; 234 | setcookie("3s", base64_encode(serialize($Ssetting)), time()+60*60*24*365,"/"); 235 | } 236 | return $Ssetting; 237 | } 238 | 239 | ?> 240 | 241 | -------------------------------------------------------------------------------- /reservoir.php: -------------------------------------------------------------------------------- 1 | cha88.cn->1010'=>'cha88\.cn', 6 | '后门特征->c99shell->1010'=>'c99shell', 7 | '后门特征->phpspy->1010'=>'phpspy', 8 | '后门特征->Scanners->60'=>'Scanners', 9 | '后门特征->cmd.php->70'=>'cmd\.php', 10 | '可疑的编码方式->str_rot13->101'=>'str_rot13', 11 | '后门特征->webshell->10'=>'webshell', 12 | '后门特征->EgY_SpIdEr->101'=>'EgY_SpIdEr', 13 | '后门特征->tools88.com->1010'=>'tools88\.com', 14 | '后门特征->SECFORCE->101'=>'SECFORCE', 15 | '后门特征->eval_r(->70'=>'eval\((\'|")\?', 16 | '后门特征->eval($_->1000'=>'eval\(\$_', 17 | '可疑代码特征->system(->30'=>'system\(', 18 | '可疑代码特征->scandir(->20'=>'scandir\(', 19 | '可疑代码特征->getmygid(->10'=>'getmygid\(', 20 | '可疑代码特征->get_current_user(->10'=>'get_current_user\(', 21 | '可疑代码特征->posix_getpwuid(->25'=>'posix_getpwuid\(', 22 | '可疑代码特征->passthru(->30'=>'passthru\(', 23 | '可疑代码特征->shell_exec(->70'=>'shell_exec\(', 24 | '可疑代码特征->exec(->70'=>'exec\(', 25 | '可疑代码特征->chmod(->35'=>'chmod\(', 26 | '可疑代码特征->unlink(->35'=>'unlind\(', 27 | '可疑代码特征->rmdir(->35'=>'rmdir\(', 28 | '可疑代码特征->popen(->20'=>'popen\(', 29 | '可疑代码特征->is_writable(->15'=>'is_writable\(', 30 | '可疑代码特征->gethostbyname->15'=>'gethostbyname\(', 31 | '可疑代码特征->filemtime(->10'=>'filemtime\(', 32 | '可疑代码特征->disk_free_space(->40'=>'disk_free_space\(', 33 | '可疑代码特征->disk_total_space(->40'=>'disk_total_space\(', 34 | '可疑代码特征->proc_open->30'=>'proc_open', 35 | '可疑代码特征->eval_r($->70'=>'eval\((\'|"|\s*)\\$', 36 | '可疑代码特征->assert($->101'=>'assert\((\'|"|\s*)\\$', 37 | '危险MYSQL代码->returns string soname->101'=>'returnsstringsoname', 38 | '危险MYSQL代码->into outfile->101'=>'intooutfile', 39 | '危险MYSQL代码->load_file->101'=>'select(\s+)(.*)load_file', 40 | '加密后门特征->eval_r(gzinflate(->999'=>'eval\(gzinflate\(', 41 | '加密后门特征->eval_r(base64_decode(->999'=>'eval\(base64_decode\(', 42 | '加密后门特征->eval_r(gzuncompress(->999'=>'eval\(gzuncompress\(', 43 | '加密后门特征->eval_r(gzdecode(->999'=>'eval\(gzdecode\(', 44 | '加密后门特征->eval_r(str_rot13(->999'=>'eval\(str_rot13\(', 45 | '可疑的字符串解码->gzuncompress(base64_decode(->101'=>'gzuncompress\(base64_decode\(', 46 | '可以的字符串解码->base64_decode(gzuncompress(->101'=>'base64_decode\(gzuncompress\(', 47 | '一句话后门特征->eval_r($_->260'=>'eval\((\'|"|\s*)\\$_(POST|GET|REQUEST|COOKIE)', 48 | '一句话后门特征->assert($_->260'=>'assert\((\'|"|\s*)\\$_(POST|GET|REQUEST|COOKIE)', 49 | '一句话后门特征->require($_->269'=>'require\((\'|"|\s*)\\$_(POST|GET|REQUEST|COOKIE)', 50 | '一句话后门特征->require_once($_->260'=>'require_once\((\'|"|\s*)\\$_(POST|GET|REQUEST|COOKIE)', 51 | '一句话后门特征->include($_->260'=>'include\((\'|"|\s*)\\$_(POST|GET|REQUEST|COOKIE)', 52 | '一句话后门特征->include_once($_->260'=>'include_once$(\'|"|\s*)\\$_(POST|GET|REQUEST|COOKIE)', 53 | '一句话后门特征->call_user_func("assert"->260'=>'call_user_func\(("|\')assert("|\')', 54 | '一句话后门特征->call_user_func($_->260'=>'call_user_func\((\'|"|\s*)\\$_(POST|GET|REQUEST|COOKIE)', 55 | '一句话后门特征->$_POST/GET/REQUEST/COOKIE[?]($_POST/GET/REQUEST/COOKIE[?]->260'=>'\$_(POST|GET|REQUEST|COOKIE)\[([^\]]+)\]\((\'|"|\s*)\\$_(POST|GET|REQUEST|COOKIE)\[', 56 | '一句话后门特征->echo(file_get_contents($_POST/GET/REQUEST/COOKIE->101'=>'echo\(file_get_contents\((\'|"|\s*)\\$_(POST|GET|REQUEST|COOKIE)', 57 | '上传后门特征->file_put_contents($_POST/GET/REQUEST/COOKIE,$_POST/GET/REQUEST/COOKIE->200'=>'file_put_contents\((\'|"|\s*)\\$_(POST|GET|REQUEST|COOKIE)\[([^\]]+)\],(\'|"|\s*)\\$_(POST|GET|REQUEST|COOKIE)', 58 | '上传后门特征->fputs(fopen("?","w"),$_POST/GET/REQUEST/COOKIE[->200'=>'fputs\(fopen\((.+),(\'|")w(\'|")$,(\'|"|\s*)\\$_(POST|GET|REQUEST|COOKIE)\[', 59 | '.htaccess插马特征->SetHandler application/x-httpd-php->260'=>'SetHandlerapplication\/x-httpd-php', 60 | '.htaccess插马特征->php_value auto_prepend_file->260'=>'php_valueauto_prepend_file', 61 | '.htaccess插马特征->php_value auto_append_file->260'=>'php_valueauto_append_file' 62 | ); 63 | } 64 | ?> 65 | --------------------------------------------------------------------------------