"Python" Look for Webshell.

Wrote a py script to find the Webshell that the server was left behind.

Before the recursive enumeration file, now with the walk function, faster.

The biggest change is the regular, looks a lot more presentable.

(' [_]{,1}[pp][aa][ss][ss][\w]{,20}= {, 3}[\ ' \ ']{1,4}. {,]{,1}[pp][ww][\w} ', ' [_]]{,20}= {, 3}[\ ' \ ']{1,4}. {, mm][mm} ', ' [{] {, 20}= {, 3}[\ ' \ ']{1,4}. {, mm][ii][mm][aa} ', ' [{] {, 20}= {, 3}[\ ' \ ']{1,4}. {, <[pp][aa][ss][ss} ', '. {, 33}</[pp][aa][ss][ss] ')

Address, pass by must star OH:

https://github.com/donghouhe/find_horse_finished/blob/master/horse.py

#!/usr/bin/env python# encoding:utf-8# 2015-2-5 ' ___ ___ ___/\ \       /\  \         /\__\         /\  \        /::\  \       /::\  \       /::|  |      /::\  \      /:/\:\  \     /:/\:\  \     /:|:|  |  /:/\:\  \    /:/  \:\__\   /:/  \:\  \   /:/|:| |__   /:/  \:\  \  /:/__/ \:|__| /:/__/ \:\__\ /:/ |:| /\__\ /:/__/_\:\__ \:\  \ /:/  / \:\  \ /:/  / \/__|:|  /:/  / \:\  /\ \/__/  \:\  /:/  /   \:\  /:/  /      |:/:/   /   \:\ \:\__\     \:\/:/  /     \:\/:/  /       |::/  /     \:\/:/  /      \::/__/       \::/  /        /:/  /       \::/ /~ ~ \/__/\/__/\/__/' import osimport sysimport reimport timerulelist = (' [_]{ , 1}[pp][aa][ss][ss][\w]{,20}= {, 3}[\ ' \ "]{1,4}. {,]{,1}[pp][ww][\w} ', ' [_]]{,20}= {, 3}[\ ' \ ']{1,4}. {, mm][mm} ', ' [{] {, 20}= {, 3}[\ ' \ ']{1,4}. {, mm][ii][mm][aa} ', ' [{] {, 20}= {, 3}[\ ' \ ']{1,4}. {, <[pp][aa][ss][ss} ', '. {, 33}</[pp][aa][ss][ss] ') def scan (path): For Root,dirs,fIles in Os.walk (path): for filespath in files:realfile = Os.path.join (Root,filespath) if Os.path.getsize (Realfile) < 1024x768 * 1024x768 and all (map (lambda X:not realfile.endswith (x), ('. Java ', '. jar ', '. css ', '. class ', '. bin ', '. exe ', '. jpg ', ' . png ', '. pdf ', '. Doc ', '. JPG ', ' gif ')): Filen = open (realfile) filestr = Filen.read () filen.close () for rule in rulelist[:]:result = re.compile (rule ). Search (FILESTR) if Result:print ' File: ', Os.path.join (Root,filespath), Result.group (0) print (' modifed time: ', Time.strftime ('%y-%m-%d%h:%m:%s ', Time.localtime (Os.path.getmtime (Realfile)))) Breakif __name__== ' __main__ ': If Len (SYS.ARGV)!=2:print "Usage:", sys.argv[0], '/dir ' sys.exit (1) if not os.path.lexists (sys.argv[1]):p rint "Wrong path" Sys.exit (1) print "Going" scan (sys.argv[1])

"Python" Look for Webshell.