This article summed up the PHP site after the Trojan repair method. Share to everyone for your reference. The specific methods are as follows:
In Linux we can use the command to search the Trojan file, to the code installation directory to execute the following command
Search out close to 100 results, the result list is very important, Trojans are inside, to a file open to verify whether it is a trojan, if it is, immediately delete
Finally found 10 trojan files, stored in a variety of directories, are PHP Webshell, full-featured, with base64 code
If you look up directories in Windows and use Windows File Search directly, you can search for eval or recently modified files, and then if it is dedecms we want to check the latest dedecms vulnerabilities and fix them.
<?php
/**************php Web Trojan scanner ************************/
/* [+] Author: Alibaba * *
/* [+] msn:weeming21@hotmail.com * *
/* [+] Start: t00ls.net, reprint please specify T00LS * *
/* [+] Version: v1.0 * *
/* [+] Features: Web version of the PHP trojan scanning Tool * *
/* [+] Note: The scanned file is not necessarily the back door, * *
* Please judge, Audit, compare the original document. */
* * If you are not sure whether the scanned file is a back door, * *
* * You are welcome to send this document to me for analysis. */
/*******************************************************/
Ob_start ();
Set_time_limit (0);
$username = "T00ls"; Set User name
$password = "T00ls"; Set Password
$MD 5 = MD5 (MD5 ($USERNAME). MD5 ($password));
$version = "PHP Web Trojan Scanner v1.0";
PHP Web Trojan Scanner
$realpath = Realpath ('./');
$selfpath = $_server[' php_self '];
$selfpath = substr ($selfpath, 0, Strrpos ($selfpath, '/'));
Define (' Realpath ', str_replace ('//', '/', str_replace (' \ ', '/', substr ($realpath, 0, strlen ($realpath)-strlen ($ Selfpath)));
Define (' MYFILE ', basename (__file__));
Define (' MYPATH ', str_replace (' \ ', '/', dirname (__file__)). ' /');
Define (' Myfullpath ', str_replace (' \ ', '/', (__file__));
Define (' HOST ', "http://". $_server[' Http_host ');
?>
<title><?php Echo $version?></title>
<meta http-equiv= "Content-type" content= "text/html; charset=gb2312 "/>
<style>
body{margin:0px;}
BODY,TD{FONT:12PX arial,tahoma;line-height:16px;}
A {color: #00f; text-decoration:underline;}
A:hover{color: #f00; text-decoration:none;}
. ALT1 td{border-top:1px solid #fff; border-bottom:1px solid #ddd background: #f1f1f1;p adding:5px 10px 5px 5px;
. ALT2 td{border-top:1px solid #fff; border-bottom:1px solid #ddd background: #f9f9f9;p adding:5px 10px 5px 5px;
. Focus TD{BORDER-TOP:1PX Solid #fff border-bottom:1px solid #ddd background: #ffffaa;p adding:5px 10px 5px 5px;
. Head td{border-top:1px Solid #fff border-bottom:1px solid #ddd background: #e9e9e9;p adding:5px 10px 5px 5px; Font-weight:bold;}
. head TD Span{font-weight:normal;
</style>
<body>
<?php
if (!) ( Isset ($_cookie[' t00ls ']) && $_cookie[' t00ls '] = = $MD 5) &&! (Isset ($_post[' username ']) && isset ($_post[' password ']) && MD5 (MD5 ($_post[' username ')). MD5 ($_post [' Password ']) = = $MD 5)))
{
Echo ' <form id= "Frmlogin" name= "Frmlogin" method= "POST" action= "" > User name: <input type= "text" name= "username" id= " Username "/> Password: <input type=" password "name=" password "id=" password "/> <input type=" Submit "Name=" Btnlogin "Id=" Btnlogin "value=" Landing "/></form>";
}
ElseIf (isset ($_post[' username ')) && isset ($_post[' password ']) && (MD5 MD5 ($_post[' username ')). MD5 ( $_post[' password]) = = = $MD 5))
{
Setcookie ("T00ls", $md 5, Time () +60*60*24*365, "/");
echo "landed successfully! ";
Header (' refresh:1; Url= '. MYFILE. '? Action=scan ');
Exit ();
}
Else
{
Setcookie ("T00ls", $md 5, Time () +60*60*24*365, "/");
$setting = GetSetting ();
$action = Isset ($_get[' action ')] $_get[' action ': "";
if ($action = = "Logout")
{
Setcookie ("T00ls", "" ", Time ()-3600);
Header ("Location:"). MYFILE);
Exit ();
}
if ($action = = "Download" && isset ($_get[' file ')) && trim ($_get[' file '])!= "")
{
$file = $_get[' file '];
Ob_clean ();
if (@file_exists ($file)) {
Header ("Content-type:application/octet-stream");
Header ("Content-disposition:filename=". BaseName ($file). "" ");
Echo file_get_contents ($file);
}
Exit ();
}
?>
<table border= "0" cellpadding= "0" cellspacing= "0" width= "100%" >
<tbody><tr class= "Head" >
<td><?php echo $_server[' server_addr ']?><span style= ' float:right; Font-weight:bold; " ><?php echo "<a href= ' http://www.t00ls.net/' > $version </a>"?></span></td>
</tr>
<tr class= "ALT1" >
<td><span style= "float:right;" ><?=date ("y-m-d h:i:s", Mktime ())?></span>
<a href= "? Action=scan" > Scan </a> |
<a href= "? action=setting" > Settings </a> |
<a href= "? action=logout" > Logout </a>
</td>
</tr>
</tbody></table>
<br>
<?php
if ($action = = "setting")
{
if (Isset ($_post[' btnsetting '))
{
$Ssetting = Array ();
$Ssetting [' User ']=isset ($_post[' checkuser '])? $_post[' checkuser ']: "PHP | php? | Phtml ";
$Ssetting [' All ']=isset ($_post[' Checkall ']) &&$_post[' Checkall ']== ' on '? 1:0;
$Ssetting [' HTA ']=isset ($_post[' Checkhta ']) &&$_post[' Checkhta ']== ' on '? 1:0;
Setcookie ("t00ls_s", Base64_encode (Serialize ($Ssetting)), Time () +60*60*24*365, "/");
echo "Setup Complete! ";
Header (' refresh:1; Url= '. MYFILE. '? Action=setting ');
Exit ();
}
?>
<form name= "frmsetting" method= "post" action= "action=setting" >
<fieldset style= "width:400px" >
<LEGEND> Scan Settings </LEGEND>
<table width= "100%" border= "0" cellspacing= "0" cellpadding= "0" >
<tr>
<TD width= > file suffix:</td>
<TD width= "><input type=" text "Name=" checkuser "id=" checkuser "style=" width:300px; "value=" <?php Echo $setting [' User ']?> ' ></td>
</tr>
<tr>
<td><label for= "Checkall" > All Files </label></td>
<td><input type= "checkbox" Name= "Checkall" id= "Checkall" <?php if ($setting [' All ']==1] echo "Checked"?> ></td>
</tr>
<tr>
<td><label for= "Checkhta" > Settings file </label></td>
<td><input type= "checkbox" Name= "Checkhta" id= "Checkhta" <?php if ($setting [' HTA ']==1) echo "Checked"?> ></td>
</tr>
<tr>
<td> </td>
<td>
<input type= "Submit" Name= "btnsetting" id= "btnsetting" value= "submitted" >
</td>
</tr>
</table>
</fieldset>
</form>
<?php
}
Else
{
$dir = isset ($_post[' path ')? $_post[' path ']:mypath;
$dir = substr ($dir, -1)!= "/"? $dir. " /": $dir;
?>
<form name= "Frmscan" method= "POST" action= "" >
<table width= "100%%" border= "0" cellspacing= "0" cellpadding= "0" >
<tr>
<TD width= "style=" vertical-align:middle; padding-left:5px; " > Scan Path:</td>
<TD width= "690" >
<input type= "text" name= "path" id= "path" style= "width:600px" value= "<?php echo $dir?>" >
<input type= "Submit" Name= "Btnscan" id= "Btnscan" value= "Start scanning" ></td>
</tr>
</table (www.jb51.net) >
</form>
<?php
if (Isset ($_post[' Btnscan '))
{
$start =mktime ();
$is _user = Array ();
$is _ext = "";
$list = "";
if (Trim ($setting [' user '])!= "")
{
$is _user = explode ("|"), $setting [' user ']);
if (count ($is _user) >0)
{
foreach ($is _user as $key => $value)
$is _user[$key]=trim (Str_replace ("?", "(.)", $value));
$is _ext = "(."). Implode ("($|.)) | (. ", $is _user)." ($|.))";
}
}
if ($setting [' HTA ']==1)
{
$is _hta=1;
$is _ext = strlen ($is _ext) >0 $is _ext. "|": $is _ext;
$is _ext.= "(^.htaccess$)";
}
if ($setting [' All ']==1 | | (Strlen ($is _ext) ==0 && $setting [' HTA ']==0)]
{
$is _ext= "(. +)";
}
$php _code = GetCode ();
if (!is_readable ($dir))
$dir = MYPATH;
$count = $scanned = 0;
Scan ($dir, $is _ext);
$end =mktime ();
$spent = ($end-$start);
?>
<div style= "padding:10px; Background-color: #ccc "> Scan: <?php echo $scanned?> File | Discovery: <?php echo $count?> suspicious File | Time consuming: <?php Echo $spent?> sec </div>
<table width= "100%" border= "0" cellspacing= "0" cellpadding= "0" >
<tr class= "Head" >
<TD width= "align=" center ">No.</td>
<TD width= "48%" > File </td>
<TD width= "12%" > Update time </td>
<TD width= "10%" > Reasons </td>
<TD width= "20%" > Features </td>
<td> Action </td>
</tr>
<?php Echo $list?>
</table>
<?php
}
}
}
Ob_flush ();
?>
</body>
<?php
function Scan ($path = '. ', $is _ext) {
Global $php _code, $count, $scanned, $list;
$ignore = Array ('. ', ' ... ');
$replace =array ("", "N", "R", "T");
$DH = @opendir ($path);
while (false!== ($file =readdir ($DH))) {
if (!in_array ($file, $ignore)) {
if (Is_dir ("$path $file")) {
Scan ("$path $file/", $is _ext);
} else {
$current = $path. $file;
if (myfullpath== $current) continue;
if (!preg_match ("/$is _ext/i", $file)) continue;
if (is_readable ($current))
{
$scanned + +;
$content =file_get_contents ($current);
$content = Str_replace ($replace, "", $content);
foreach ($php _code as $key => $value)
{
if (Preg_match ("/$value/I", $content))
{
$count + +;
$j = $count% 2 + 1;
$filetime = Date (' y-m-d h:i:s ', Filemtime ($current));
$reason = Explode ("->", $key);
$url = Str_replace (Realpath,host, $current);
Preg_match ("/$value/I", $content, $arr);
$list. = "
<tr class= ' alt$j ' onmouseover= ' this.classname= ' focus '; ' onmouseout= ' this.classname= ' alt$j '; ' >
<td> $count </td>
<td><a href= ' $url ' target= ' _blank ' > $current </a></td>
<td> $filetime </td>
<td><font color=red> $reason [0]</font></td>
<td><font color= #090 > $reason [1]</font></td>
<td><a href= '? action=download&file= $current ' target= ' _blank ' > Download </a></td>
</tr> ";
Echo $key. "-" . $path. $file. " (" . $arr [0]. ")" ." <br/> ";
Echo $path. $file. " <br/> ";
Break
}
}
}
}
}
}
Closedir ($DH);
}
function GetSetting ()
{
$Ssetting = Array ();
if (Isset ($_cookie[' t00ls_s '))
{
$Ssetting = Unserialize (Base64_decode ($_cookie[' t00ls_s '));
$Ssetting [' User ']=isset ($Ssetting [' user ']) $Ssetting [' User ']: "PHP | php? | phtml | sHTML ";
$Ssetting [' All ']=isset ($Ssetting [' All ']) intval ($Ssetting [' All ']): 0;
$Ssetting [' HTA ']=isset ($Ssetting [' HTA ']) intval ($Ssetting [' HTA ']): 1;
}
Else
{
$Ssetting [' user ']=] php | php? | phtml | sHTML ";
$Ssetting [' All ']=0;
$Ssetting [' HTA ']=1;
Setcookie ("t00ls_s", Base64_encode (Serialize ($Ssetting)), Time () +60*60*24*365, "/");
}
return $Ssetting;
}
function GetCode ()
{
Return Array (
' Backdoor features->cha88.cn ' => ' cha88.cn ',
' Backdoor features->c99shell ' => ' C99shell ',
' Backdoor features->phpspy ' => ' Phpspy ',
' Backdoor features->scanners ' => ' scanners ',
' Backdoor features->cmd.php ' => ' cmd.php ',
' Backdoor features->str_rot13 ' => ' str_rot13 ',
' Backdoor features->webshell ' => ' Webshell ',
' Backdoor features->egy_spider ' => ' Egy_spider ',
' Backdoor features->tools88.com ' => ' tools88.com ',
' Backdoor features->secforce ' => ' Secforce ',
' Backdoor feature->eval ('?> ' => ' eval (' | ')? > ',
' Suspicious code feature->system (' => ' System ('),
' Suspicious code feature->passthru (' => ' PassThru ('),
' Suspicious code feature->shell_exec (' => ' shell_exec ('),
' Suspicious code feature->exec ' (' => ' EXEC (',
' Suspicious code feature->popen (' => ' Popen ('),
' Suspicious code feature->proc_open ' => ' Proc_open ',
' Suspicious code feature->eval ($ ' => ' eval (' | ') | s*) \$ ',
' Suspicious code feature->assert ($ ' => ' assert (' | "| s*) \$ ',
' Dangerous MySQL code->returns string soname ' => ' returnsstringsoname ',
' Dangerous MySQL code->into outfile ' => ' intooutfile ',
' Dangerous MySQL code->load_file ' => ' Select (s+) (. *) Load_file ',
' Cryptographic Backdoor features->eval (gzinflate (' => ' eval (' gzinflate ',
' Cryptographic Backdoor features->eval (Base64_decode (' => ' eval (' Base64_decode ',
' Cryptographic Backdoor features->eval (gzuncompress (' => ' eval (' gzuncompress ',
' Cryptographic Backdoor features->eval (Gzdecode (' => ' eval (' Gzdecode ',
' Cryptographic Backdoor features->eval (str_rot13 (' => ' eval (' str_rot13 ',
' Cryptographic Backdoor features->gzuncompress (Base64_decode (' => ' gzuncompress ('),
' Cryptographic Backdoor features->base64_decode (gzuncompress (' => ' Base64_decode ('),
' A word back door features->eval ($_ ' => ' eval (' | "| s*) \$_ (post| Get| Request| Cookies) ',
' A word back door features->assert ($_ ' => ' Assert (' | "| s*) \$_ (post| Get| Request| Cookies) ',
' A word back door features->require ($_ ' => ' Require (' | "| s*) \$_ (post| Get| Request| Cookies) ',
' A word back door features->require_once ($_ ' => ' require_once (' | "| s*) \$_ (post| Get| Request| Cookies) ',
' A word back door feature->include ($_ ' => ' Include (' | ') s*) \$_ (post| Get| Request| Cookies) ',
' A word back door features->include_once ($_ ' => ' include_once (' | "| s*) \$_ (post| Get| Request| Cookies) ',
' A word back door feature->call_user_func ("Assert" ' => ' Call_user_func ("| ') Assert (' | ') ',
' A word back door features->call_user_func ($_ ' => ' Call_user_func (' | "| s*) \$_ (post| Get| Request| Cookies) ',
' A word back door feature->$_post/get/request/cookie[?] ($_post/get/request/cookie[?] ' => ' $_ (post| Get| Request| cookies) [([^]]+]] (' | "| s*) \$_ (post| Get| Request| Cookies) [',
' A word back door features->echo (file_get_contents ($_post/get/request/cookie ' => ' Echo (file_get_contents) (' | s*) \$_ (post| Get| Request| Cookies) ',
' Uploading back Door features->file_put_contents ($_post/get/request/cookie,$_post/get/request/cookie ' => ' file_put_contents (' | ' | s*) \$_ (post| Get| Request| cookies) [([^]]+)], (' | "| s*) \$_ (post| Get| Request| Cookies) ',
' Upload back door features->fputs (fopen ("?", "W"), $_post/get/request/cookie[' => ' fputs ((. +), (' | ') W (' | ')), (' | ') | s*) \$_ (post| Get| Request| Cookies) [',
'. htaccess features->sethandler application/x-httpd-php ' => ' sethandlerapplication/x-httpd-php ',
'. htaccess features->php_value auto_prepend_file ' => ' php_valueauto_prepend_file ',
'. htaccess features->php_value auto_append_file ' => ' php_valueauto_append_file '
);
}
?>
I hope this article on the Web site for everyone based on PHP security construction help.
