Linux server poisoning using Find to locate virus examples

Example

The code is as follows	Copy Code
Find wwwroot/*-type f-name "*.php |xargs grep" eval ("> Wwwroot/eval.txt Find wwwroot/*-type f-name "*.php" |xargs grep "UDP:" > Wwwroot/udp.txt Find wwwroot/*-type f-name "*.php" |xargs grep "tcp:" > Wwwroot/tcp.txt

Let's add

The popular signature on the Internet is: (PS: But there must be a legacy)

Backdoor features->cha88.cn
Backdoor features->c99shell
Backdoor features->phpspy
Backdoor features->scanners
Backdoor features->cmd.php
Backdoor features->str_rot13
Backdoor features->webshell
Backdoor features->egy_spider
Backdoor features->tools88.com
Backdoor features->secforce
Backdoor features->eval ("?>

Suspicious code feature->system (
Suspicious code feature->passthru (
Suspicious code feature->shell_exec (
Suspicious code feature->exec (
Suspicious code feature->popen (
Suspicious code Characteristics->proc_open
Suspicious code feature->eval ($
Suspicious code feature->assert ($
Dangerous MySQL code->returns string soname
Dangerous MySQL Code->into outfile
Dangerous MySQL Code->load_file
Cryptographic backdoor feature->eval (Gzinflate (
Cryptographic backdoor feature->eval (Base64_decode (
Cryptographic backdoor feature->eval (Gzuncompress (
Cryptographic backdoor feature->gzuncompress (Base64_decode (
Cryptographic backdoor feature->base64_decode (Gzuncompress (
A word back door features->eval ($_
A word back door features->assert ($_
A word back door features->require ($_
A word back door features->require_once ($_
A word back door features->include ($_
A word back door features->include_once ($_
A word back door feature->call_user_func ("Assert"
A word back door features->call_user_func ($_
A word back door feature->$_post/get/request/cookie[?] ($_post/get/request/cookie[?]
A word back door features->echo (file_get_contents ($_post/get/request/cookie
Uploading Backdoor features->file_put_contents ($_post/get/request/cookie,$_post/get/request/cookie
Upload Backdoor features->fputs (fopen ("?", "W"), $_post/get/request/cookie[
. htaccess features->sethandler application/x-httpd-php
. htaccess features->php_value Auto_prepend_file
. htaccess features->php_value Auto_append_file