Search for php webshell gadgets

The idea is to match the script file and the configuration file hash to find out the script or configuration file whose hash is changed. The script has three parameters: 1.-save reads the web directory and configuration file, calculate the hash match and save file 2.-find matches the saved hash with the current web directory script file and configuration file hash to find the file with the hash change. 3.-listen first runs save. Then, execute find cyclically. If a hash exception is found, notify the Administrator by email. Sleep for a period of time after each find is completed. The default value is half an hour, which is equivalent to half an hour. Import hashlib import sys import OS import re import time import smtplib from email. mime. text import MIMEText def send_mail (content ): to_list = ["xxx@qq.com"] mail_host = "smtp.163.com" mail_user = "xxxx" mail_pass = "xxxr" mail_postfix = "163.com" me = mail_user +" <"+ mail_user +" @ "+ mail_postfix + ">" msg = MIMEText (content) msg ['subobject'] = 'warning' msg ['from'] = me msg ['to'] = ";". join (to_list) try: s = smtplib. SMTP () s. connect (mail_host) s. login (mail_user, mail_pass) s. sendmail (me, to_list, msg. as_string () s. close () return True distinct T Exception, e: print str (e) return False def md5Checksum (filePath): fh = open (filePath, 'rb') m = hashlib. md5 () while True: data = fh. read (8192) if not data: break m. update (data) fh. close () return m. hexdigest () def load_hash (filepath): pass def load_filelist (f): f1 = open (f, 'R') f_list = [] while 1: line = f1.readline () if not line: break f_list.append (line) dic ={} for str1 in f_list: item1, item2 = str1.split (':') dic [item1] = item2 f1.close () return dic def save_config (configpath, webdir): f1 = open ('config', 'w ') f1.writelines ('configpath: '+ configpath +' \ r \ n') f1.writelines ('webdir: '+ webdir +' \ r \ n') f1.close () def find (): lists = [] lists = findchange () for str1 in lists: print str 1 def findchange (): relist = [] dic1 = {} dic1 = load_filelist ('Save _ hash') dic2 = {} dic2 = load_filelist ('config ') weblist = [] weblist = load_all_path (dic2 ['webdir']. replace ('\ r \ n', '') weblist. append (str (dic2 ['configpath']. replace ('\ r \ n', '') for webpage in weblist: if str (dic1.get (webpage) = 'none': relist. append (webpage + 'is new file \ r \ n') elif str (dic1.get (webpage )). replace ('\ r \ n ','')! = Md5Checksum (webpage): relist. append (webpage + 'has been changed \ r \ n') return relist def load_all_path (rootDir): str1 = [] list_dirs = OS. walk (rootDir) for root, dirs, files in list_dirs: for f in files: if str (OS. path. splitext (f) [1]) = '. php 'or str (OS. path. splitext (f) [0]) = '. htaccess': str1.append (str (OS. path. join (root, f) return str1 def save (config, webpath): save_config (config, webpath) confighash = Md5Checksum (config) weblist = [] weblist = load_all_path (webpath) print weblist f1 = open ('Save _ hash', 'w') f1.writelines (config + ': '+ confighash + "\ r \ n") for str1 in weblist: print str1 f1.writelines (str1 +': '+ md5Checksum (str1) + "\ r \ n ") f1.close () def listen (config, webpath): save (config, webpath) while 1: lists = [] lists = findchange () if (len (lists )! = 0): str2 = ''for str1 in lists: str2 = str2 + str1.replace ('\ r \ n','') +' \ n' send_mail (str2) time. sleep (3600) if _ name _ = '_ main _': banner = ''' usage: find. py-save config webpath find. py-find nohup python find. py-listen config webpath $ Example: python find. py-save/etc/apache2/apache2.conf/var/www python find. py-find nohup python find. py-listen/etc/apache2/apache2.conf/var/www & ''' if (len (sys. argv) <2): print banner elif (len (sys. argv) = 4 and sys. argv [1] = '-save'): save (sys. argv [2], sys. argv [3]) elif (len (sys. argv) = 2 and sys. argv [1] = '-find'): find () elif (sys. argv [1] = '-Listen'): listen (sys. argv [2], sys. argv [3]) else: print banner