Find the WebShell backdoor of intruders on Centos Linux Server

If the server is infected with Trojans or hacked, you should know that the first goal of a hacker's intrusion into the web server is to upload a webshell to the server. With webshell, hackers can do more. After a website is infected with Trojans, many people will be helpless and cannot find it. It is not complicated. Here I will take the php environment as an example to explain a few tips and hope to help you.
 
 
First, let's talk about the idea. If webshell is uploaded on the server, we will certainly be able to find clues, such as the time of the PHP file. If we can find all PHP files after the last website code update, the method is as follows.
Suppose that the last update is 10 days ago, we can find the PHP files generated within 10 days:
 
Find/var/webroot-name "*. php"-mtime-10
 
Command description:
/Var/webroot is the website root directory
-Name "*. php" is used to find all php files.
-Time-10: as of now 10 days www.2cto.com
 
If the file update time is not determined, we can find the keyword to determine. To check the accuracy, You need to familiarize yourself with the frequently-used Keywords of webshell. I will list some frequently-used keywords here. Others can collect some webshells from the Internet and summarize their own keywords, the following are some of the keywords (eval, shell_exec, passthru, popen, and system) I have summarized in parentheses:
 
Find/var/webroot-name "*. php" | xargs grep "eval" | more
Find/var/webroot-name "*. php" | xargs grep "shell_exec" | more
Find/var/webroot-name "*. php" | xargs grep "passthru" | more
 
Of course, you can also export it to a file and download it for analysis:
 
Find/home-name "*. php" | xargs grep "fsockopen" | more> test. log
 
I will not list them all here. If you have keywords you have summarized, you can simply replace them. Of course, not all files found are webshells that need to be judged by themselves. The method of judgment is also simple. You can directly access this file from a browser or compare it with some webshells you have found, after reading this, you can determine whether it is a webshell file at a glance.