Php implements troubleshooting and hardening of Linux Server Trojans

This article describes how to use php to troubleshoot and reinforce Linux Server Trojans. This article describes how to search for, search for recently modified files, and modify php Based on the pattern. ini, modify nginx. conf and other methods.

This article describes how to use php to troubleshoot and reinforce Linux Server Trojans. This article describes how to search for, search for recently modified files, and modify php Based on the pattern. ini, modify nginx. conf and other methods.

Websites are often infected with Trojans? After some improvements, we can basically solve this problem. Because discuz x and other programs have vulnerabilities, they are uploaded to websehll. Each time they are deleted for a while, they come out again and finally find all the Trojans.

Find and strengthen the following aspects (if you can not enable the member function, do not give any upload entry, protect the background password, and reinforce PHP, it is generally no problem ).

1. Search by signature:

Php Trojans generally contain

The Code is as follows:

<? Php eval ($ _ POST [cmd]);?>

Or

The Code is as follows:

<? Php assert ($ _ POST [cmd]);?>

Find/wwwroot/*-type f-name "*. php" | xargs grep "eval (">/wwwroot/scan.txt

The result shows that many obvious webshells are found to be hidden in directories such as attachment.

2. Use a php code on the Internet to search for recently modified files

Scandir. php
The content is as follows:

The Code is as follows:

<? Php
Set_time_limit (0); // prevent timeout
/**
*
* Enhanced version of php Directory scanning monitoring
*
* @ Author lssbing (lssbing # gmail.com)
* @ Date 2010-1-18
* @ License BSD
* @ Version 1.0
*
The following variables need to be manually set before use
*
**/
/* = ======= */
$ Pass = "12345"; // set the password
$ Jkdir = ". "; // set the monitoring scan directory. The current directory is '. ', the upper-level directory is '.. ', or you can set an absolute path without a slash. The default value is the current directory.
$ Logfilename = "./m. log"; // you can specify the path for storing logs.
$ Exclude = array ('data', 'images'); // exclude a directory
$ Danger = 'eval | cmd | passthru | gzuncompress '; // you can specify a function to identify a trojan file.
$ Suffix = 'php | inc'; // you can specify the suffix of the file to be scanned.
/* = ======= */

$ Filename = $ _ GET ['filename'];
$ Check = $ _ GET ['check'];
$ Jumpoff = false;
$ Url = $ _ SERVER ['php _ SELF '];
$ Thisfile = end (explode ('/', $ url ));
$ Jump = "{$ thisfile} |". implode ('|', $ exclude );
$ Jkdir_num = $ file_num = $ danger_num = 0;
Define ('m _ path', $ jkdir );
Define ('m _ log', $ logfilename );
If ($ check = 'check ')
{
$ Safearr = explode ("|", $ jump );
$ Start_time = microtime (true );
Safe_check ($ jkdir );
$ End_time = microtime (true );
$ Total = $ end_time-$ start_time;
$ File_num = $ file_num-$ jkdir_num;
$ Message = "number of files:". $ file_num;
$ Message. = "Number of folders:". $ jkdir_num;
$ Message. = "number of suspicious files:". $ danger_num;
$ Message. = "execution time:". $ total;
Echo $ message;
} Else {
If ($ _ GET ['M'] = "del") Delete (); // process File Deletion
// Read the file content
If (isset ($ _ GET ['readfile']) {
// View the password. The file content is output after the password is verified correctly.
If (emptyempty ($ _ POST ['passchack']) {
Echo ""
."";
Exit;
} Elseif (isset ($ _ POST ['passchack']) & $ _ POST ['passchack'] ==$ pass ){
$ Code = file_get_contents ($ _ GET ['readfile']);
Echo"{$ Code}";
Exit;
} Else {
Exit;
}

} Else {
Record_md5 (M_PATH );
If (file_exists (M_LOG )){
$ Log = unserialize (file_get_contents (M_LOG ));
} Else {
$ Log = array ();
}

If ($ _ GET ['savethis '] = 1 ){
// Save the md5 value of the current file to the log file
@ Unlink (M_LOG );
File_put_contents (M_LOG, serialize ($ file_list ));
Echo "saved! Click to return ";
Exit;
}
If (emptyempty ($ log )){
Echo "no log file has been created currently! Click [save current] to create a log file! ";
} Else {
If ($ file_list = $ log ){
Echo "this folder has not been changed! ";
} Else {
If (count ($ file_list)> 0 ){
Foreach ($ file_list as $ file => $ md5 ){
If (! Isset ($ log [$ file]) {
Echo "New File :". $ file. "". "created :". date ("Y-m-d H: I: s", filectime ($ file )). "modification time :". date ("Y-m-d H: I: s", filemtime ($ file )). "Source code Deletion
";
} Else {
If ($ log [$ file]! = $ Md5 ){
Echo "Modify file :". $ file. "". "created :". date ("Y-m-d H: I: s", filectime ($ file )). "modification time :". date ("Y-m-d H: I: s", filemtime ($ file )). "Source code
";

Unset ($ log [$ file]);
} Else {
Unset ($ log [$ file]);
}
}
}
}
If (count ($ log)> 0 ){
Foreach ($ log as $ file => $ md5 ){
Echo "delete file:". $ file ."
";
}
}
}
}
}
}

// Calculate md5
Function record_md5 ($ jkdir ){
Global $ file_list, $ exclude;
If (is_dir ($ jkdir )){
$ File = scandir ($ jkdir );
Foreach ($ file as $ f ){
If ($ f! = '.' & $ F! = '..'&&! In_array ($ f, $ exclude )){
$ Path = $ jkdir. '/'. $ f;
If (is_dir ($ path )){
Record_md5 ($ path );
} Else {
$ File_list [$ path] = md5_file ($ path );
}
}
}
}
}

Function Safe_Check ($ jkdir) // traverses a file
{
Global $ danger, $ suffix, $ jkdir_num, $ file_num, $ danger_num;

$ Hand = @ dir ($ jkdir) or die ('Folder does not exist ');
While ($ file = $ hand-> read ())
{
$ Filename = $ jkdir. '/'. $ file;
If (! $ Jumpoff ){
If (Jump ($ filename) continue;
}
If (@ is_dir ($ filename) & $ file! = '.' & $ File! = '..' & $ File! = './..')
{$ Jkdir_num ++;
Safe_Check ($ filename );
}
If (preg_match_all ("/\. ($ suffix)/I", $ filename, $ out ))
{

$ Str = '';
$ Fp = @ fopen ($ filename, 'R') or die ('no authorization ');
While (! Feof ($ fp ))
{
$ Str. = fgets ($ fp, 1024 );
}
Fclose ($ fp );
If (preg_match_all ("/($ danger) [\ r \ n \ t] {0,} ([\ [\ (])/I", $ str, $ out ))
{
Echo "Suspicious File: {$ filename }". "created :". date ("Y-m-d H: I: s", filectime ($ filename )). "modification time :". date ("Y-m-d H: I: s", filemtime ($ filename ))."View codeDelete
";
$ Danger_num ++;
}
}
$ File_num ++;
}
}
Function Edit () // view suspicious files
{
Global $ filename;
$ Filename = str_replace ("..", "", $ filename );
$ File = $ filename;
$ Content = "";
If (is_file ($ file ))
{
$ Fp = fopen ($ file, "r") or die ('no authorization ');
$ Content = fread ($ fp, filesize ($ file ));
Fclose ($ fp );
$ Content = htmlspecialchars ($ content );

}
Echo"$ Content\ R \ n ";
Exit ();
}
Function Delete () // Delete an object
{Global $ filename, $ pass;
If (emptyempty ($ _ POST ['passchack']) {
Echo ""
."";
Exit;
} Elseif (isset ($ _ POST ['passchack']) & $ _ POST ['passchack'] ==$ pass ){
(Is_file ($ filename ))? ($ Mes = unlink ($ filename )? 'Deleted successfully': 'failed to delete view authorization '):'';
Echo $ mes;
Exit ();
} Else {
Echo 'incorrect password! ';
Exit;
}
}
Function Jump ($ file) // skip the file
{
Global $ jump, $ safearr;
If ($ jump! = '')
{
Foreach ($ safearr as $ v)
{
If ($ v = '') continue;
If (eregi ($ v, $ file) return true;
}
}
Return false;
}
?>
[View File changes] | [Save the current file fingerprint] | [scan suspicious files]

After the execution, you can see the recently modified file, which is of great value.

3. Modify php. ini to restrict the following functions:

The Code is as follows: