一个PHP webshell检查shell脚本

2009-11-3 14:28 587 0

摘要: #!/bin/sh #************************************************************ #webshell&nb...

关键词： nbsp LogFile echo HOSTIP grep exec File gzuncompress Shell fckeditor

#!/bin/sh #************************************************************ #webshell Check Shell for php #By:Neeao #2008/7/17 v1.0 beta #************************************************************ HOSTIP=`ifconfig eth0 |grep 'inet addr'|awk '{print $2;}'|cut -d: -f2` #STR=`expr index $HOSTIP "192.168"` #if [ ${STR} -eq 1 ] # then # HOSTIP=`ifconfig eth1 |grep 'inet addr'|awk '{print $2;}'|cut -d: -f2` #fi echo $HOSTIP LogFile=/tmp/$HOSTIP.log rm -rf $LogFile date +%Y-%m-%d/%H:%M >> $LogFile echo -e "\n" >> $LogFile echo " ---------------------------------------------------------------------------------------------------" >> $LogFile echo "|Executive Order function:exec(\|system(\|passthru(\|shell_exec(\|popen(\|proc_open(\|pcntl_exec( |" >> $LogFile echo " ---------------------------------------------------------------------------------------------------" >> $LogFile echo -e "\n" >> $LogFile grep -in 'exec(\|system(\|passthru(\|shell_exec(\|popen(\|proc_open(\|pcntl_exec(' -R * | grep -iv '_exec' >> $LogFile echo -e "\n" >> $LogFile echo " -------------------------------------------------------------------------------------------" >> $LogFile echo "|Deformation of the back door coding:eval(\|base64_decode(\|gzinflate(\|gzuncompress(\|chr( |" >> $LogFile echo " --------------------------------------------------------------------------------------------" >> $LogFile echo -e "\n" >> $LogFile grep -in "eval(\|base64_decode(\|gzinflate(\|gzuncompress(\|chr(" -R * >> $LogFile echo -e "\n" >> $LogFile echo " -----------------------------------------------------------------------------------------------------------------" >> $LogFile echo "|File operations function:dl(\|fopen(\|readfile(\|file(\|file_get_contents(\|opendir(\|chdir(\|fwrite(\|unlink(\|glob(|" >> $LogFile echo " -----------------------------------------------------------------------------------------------------------------" >> $LogFile echo -e "\n" >> $LogFile grep -in "dl(\|fopen(\|readfile(\|file(\|file_get_contents(\|opendir(\|chdir(\|fwrite(\|unlink(\|glob(" -R * >> $LogFile echo -e "\n" >> $LogFile echo "----------------------------------" >> $LogFile echo "|Files inculde bug:include|require|" >> $LogFile echo "----------------------------------" >> $LogFile echo -e "\n" >> $LogFile grep -in "include.*\$.\|require.*\$." -R * >> $LogFile echo -e "\n" >> $LogFile echo "---------------------------------------------------------" >> $LogFile echo "|Risk code Keyword:SQLyog\|phpAdsNew\|huansuan\|fckeditor|" >> $LogFile echo "--------------------------------------------------------" >> $LogFile echo -e "\n" >> $LogFile grep -in "SQLyog\|phpAdsNew\|huansuan\|fckeditor" -R * >> $LogFile cd /tmp tar -zcvf $HOSTIP.tar.gz $HOSTIP.log

声明：文章版权归原作者所有部分文章转自互联网如有侵权请联系 [邮箱地址] 删除