查找系统网站后门的perl代码

2009-10-18 10:47 693 0

摘要: #!/usr/bin/perl -w#usage: ./shellkill.pl <sensitivity 1-50> <directory to scan>use stric...

关键词： backdoor score File tempscore exec Find passthru stuffsmy request system

#!/usr/bin/perl -w#usage: ./shellkill.pl <sensitivity 1-50> <directory to scan>use strict;use File::Find;my $sens = shift || 10;my $folder = shift || './';find(\&backdoor, "$folder");sub backdoor {if ((/\.(php|txt)/)){open (my $IN,"<$_") || die "can not open datei $File::Find::name: $!";my @file = <$IN>;#maybe evil stuffsmy $score = grep (/function_exists\(|phpinfo\(|safe_? mode|shell_exec\(|popen\(|passthru\(|system\(|myshellexec\(|exec\(|getpwuid\(|getgrgid\(|fileperms\(/i,@file);#probably evil stuffsmy $tempscore = grep(/\`\$\_(post|request|get).{0,20}\`|(include|require|eval|system|passthru|shell_exec).{0,10} \$\_(post|request|get)|eval.{0,10}base64_decode|back_c onnect|backdoor|r57|c99|x2300/i, @file);$score += 50 * $tempscore;print "$score - Possible backdoor (score): $File::Find::name\n" if ($score > $sens-1 );close $IN;}elsif((/\.(jpg|jpeg|gif|png|tar|zip|gz|rar|pdf)/)){open (my $IN,"<$_") || (print "can not open datei $File::Find::name: $!" && next);print "5000 - Possible backdoor (php in non-php file): $File::Find::name\n" if grep /(\<\?php|include(\ |\())/i, <$IN>;close $IN;}}

声明：文章版权归原作者所有部分文章转自互联网如有侵权请联系 [邮箱地址] 删除