1. How to use: find.py directory Name
2. The main use of Python regular expressions to match, you can add their own defined in the keywords, the format:
["Eval\ (\$\_post)," found PHP a word trojan! "] #前面为正则, followed by a description of the regular, will be displayed in the log.
3. Modify the file suffix and keyword of the regular expression can be other languages Webshell Check tool, ^_^.
4. The development environment is Windows Xp+activepython 2.6.2.2, the home computer does not have the Linux environment, does not bother to install the virtual machine, tomorrow to the company Linux virtual machine test.
5. At present, it is only a framework, then gradually perfected.
Copy CodeThe code is as follows:
#coding: GBK
Import Os,sys
Import re
findtype=['. php ', '. Inc ' #要检查的文件后缀类型
#要检查的关键字正则表达式和日志中的描述, is a two-dimensional array.
keywords=[["Eval\ (\$\_post"), "found PHP a word trojan!" "],\
["(System|shell_exec|exec|popen)", "Discovery PHP command execution Function!"] \
]
Writelog = open (' Log.txt ', ' w+ ')
def checkfile (filename):
Fp=open (filename)
Content = Fp.read ()
For keyword in keywords:
If Re.search (keyword[0],content,re. I):
log= "%s:%s"% (Filename,keyword[1])
#print Log
Print >>writelog,log
Fp.close ()
def checkdir (dirname):
Try
Ls=os.listdir (dirname)
Except
print ' Access Deny '
Else
For L in LS:
Temp=os.path.join (dirname,l)
if (Os.path.isdir (temp)):
Checkdir (temp)
Else
ext = Temp[temp.rindex ('. '):]
If ext in Findtype:
Checkfile (temp)
If __name__== "__main__":
Print "PHP Webshell check for python! "
Print "By:neeao"
Print "Http://Neeao.com"
If Len (SYS.ARGV) < 2:
Print "%s c:\\"% sys.argv[0]
Else
Print "Check start!"
Dirs=sys.argv[1:]
#print Dirs[0]
If Os.path.exists (Dirs[0]):
Checkdir (Dirs[0])
Else
Print "Dir: '%s ' not exists!"% dirs[0]
Print "Check finsh!"
Writelog.close ()
