PHP Webshell Check tool python implementation code _python

1. How to use: find.py directory Name
2. The main use of Python regular expressions to match, you can add your own definition of keywords, format:
[Eval\ (\$\_post "," found PHP a word trojan!) "] #前面为正则, followed by a description of this regular, will be displayed in the log.
3. Modifying a regular expression of a file suffix and keyword can be used as a Webshell inspection tool in other languages, ^_^.
4. The development environment is the Windows Xp+activepython 2.6.2.2, the home computer does not have the Linux environment, is lazy to install the virtual machine, tomorrow to the company Linux virtual machine test.
5. The present is only a framework, which is then gradually refined.

Copy Code code as follows:

#coding: GBK
Import Os,sys
Import re

findtype=['. php ', '. Inc '] #要检查的文件后缀类型

#要检查的关键字正则表达式和日志中的描述, is a two-dimensional array.
keywords=[["Eval\ \$\_post", "found PHP a word trojan!" "],\
["(System|shell_exec|exec|popen)", "Discover PHP command execution function!"] \
]

Writelog = open (' Log.txt ', ' w+ ')

def checkfile (filename):
Fp=open (filename)
Content = Fp.read ()
For keyword in keywords:
If Re.search (keyword[0],content,re. I):
log= "%s:%s"% (Filename,keyword[1])
#print Log
Print >>writelog,log
Fp.close ()


def checkdir (dirname):
Try
Ls=os.listdir (dirname)
Except
print ' Access Deny '
Else
For L in LS:
Temp=os.path.join (dirname,l)
if (Os.path.isdir (temp)):
Checkdir (temp)
Else
ext = Temp[temp.rindex ('. '):]
If ext in Findtype:
Checkfile (temp)


If __name__== "__main__":
Print "PHP Webshell check for python! "
Print "By:neeao"
Print "Http://Neeao.com"
If Len (SYS.ARGV) < 2:
print '%s c:\\ '% sys.argv[0]
Else
Print "Check start!"
Dirs=sys.argv[1:]
#print Dirs[0]
If Os.path.exists (Dirs[0]):
Checkdir (Dirs[0])
Else
Print "Dir: '%s ' not exists! '% dirs[0]

Print "Check finsh!"

Writelog.close ()