python脚本实现查找webshell的方法

本文讲述了一个python查找 webshell脚本的代码，除了查找webshell功能之外还具有白名单功能，以及发现恶意代码发送邮件报警等功能，感兴趣的朋友可以自己测试一下看看效果。

具体的功能代码如下：

#!/usr/bin/env python
#-*- coding: utf-8 -*-

import os
import sys
import re
import smtplib

#设定邮件
fromaddr = "smtp.qq.com"
toaddrs = ["voilet@qq.com"]
username = "voilet"
password = "xxxxxx"


#设置白名单
pass_file = ["api_ucenter.php"]

#定义发送邮件函数
def sendmail(toaddrs,sub,content):
  '发送邮件模块'
  # Add the From: and To: headers at the start!
  msg = ("From: %srnTo: %srnSubject: %srnrn"
      % (fromaddr,",".join(toaddrs),sub))
  msg += content
  server = smtplib.SMTP('mail.funshion.com',25,)
  server.login(username,password)
  server.sendmail(fromaddr,toaddrs,msg)
  server.quit()

#设置搜索特征码
rulelist = [
  '($_(GET|POST|REQUEST)[.{0,15}]($_(GET|POST|REQUEST)[.{0,15}]))','(base64_decode(['"][w+/=]{200,}['"]))','eval(base64_decode(','(eval($_(POST|GET|REQUEST)[.{0,'(assert($_(POST|GET|REQUEST)[.{0,'($[w_]{0,15}($_(POST|GET|REQUEST)[.{0,'(wscript.shell)','(gethostbyname()','(cmd.exe)','(shell.application)','(documentss+ands+settings)','(system32)','(serv-u)','(提权)','(phpspy)','(后门)','(webshell)','(Programs+Files)','www.phpdp.com','phpdp','PHP神盾','decryption','Ca3tie1','GIF89a','IKFBILUvM0VCJD/APDolOjtW0tgeKAwA',''e'.'v'.'a'.'l'',]

def Scan(path):
  for root,dirs,files in os.walk(path):
    for filespath in files:
      isover = False
      if '.' in filespath:
        ext = filespath[(filespath.rindex('.')+1):]
        if ext=='php' and filespath not in pass_file:
          file= open(os.path.join(root,filespath))
          filestr = file.read()
          file.close()
          for rule in rulelist:
            result = re.compile(rule).findall(filestr)
            if result:
              print '文件：'+os.path.join(root,filespath)
              print '恶意代码：'+str(result[0])
              print 'nn'
              sendmail(toaddrs,"增值发现恶意代码",'文件：'+os.path.join(root,filespath)+"n" + '恶意代码：'+str(result[0]))
              break

try:
  if os.path.lexists("/home/web_root/"):
    print('nn开始扫描：'+ "/home/web_root/")
    print('        可疑文件         ')
    print('########################################')
    Scan("/home/web_root/")
    print('提示：扫描完成--~')
  else:
    print '提示：指定的扫描目录不存在--- '
except IndexError:
  print "请指定扫描文件目录" 

（编辑：安卓应用网）

【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容!