【python】找呀找呀找webshell，pythonwebshell

【python】找呀找呀找webshell，pythonwebshell

寫了一個py指令碼，用來找伺服器被人留下的webshell。

之前是遞迴列舉檔案，現在用walk函數，快了些。

改動最大的就是正則了，看上去像樣不少。

('[_ ]{,1}[pP][aA][sS][sS][\w ]{,20}= {,3}[\'\"]{1,4}.{,33}','[_ ]{,1}[pP][Ww][\w ]{,20}= {,3}[\'\"]{1,4}.{,33}','[mM][mM] {,20}= {,3}[\'\"]{1,4}.{,33}','[mM][iI][mM][aA] {,20}= {,3}[\'\"]{1,4}.{,33}','<[pP][aA][sS][sS].{,33}</[pP][aA][sS][sS]')

地址，路過的一定要star哦：

https://github.com/donghouhe/find_horse_finished/blob/master/horse.py

#!/usr/bin/env python# encoding: utf-8# 2015-2-5'''      ___           ___           ___           ___          /\  \         /\  \         /\__\         /\  \        /::\  \       /::\  \       /::|  |       /::\  \      /:/\:\  \     /:/\:\  \     /:|:|  |      /:/\:\  \    /:/  \:\__\   /:/  \:\  \   /:/|:|  |__   /:/  \:\  \  /:/__/ \:|__| /:/__/ \:\__\ /:/ |:| /\__\ /:/__/_\:\__\ \:\  \ /:/  / \:\  \ /:/  / \/__|:|/:/  / \:\  /\ \/__/  \:\  /:/  /   \:\  /:/  /      |:/:/  /   \:\ \:\__\     \:\/:/  /     \:\/:/  /       |::/  /     \:\/:/  /      \::/__/       \::/  /        /:/  /       \::/  /        ~~            \/__/         \/__/         \/__/    '''import osimport sysimport reimport timerulelist = ('[_ ]{,1}[pP][aA][sS][sS][\w ]{,20}= {,3}[\'\"]{1,4}.{,33}','[_ ]{,1}[pP][Ww][\w ]{,20}= {,3}[\'\"]{1,4}.{,33}','[mM][mM] {,20}= {,3}[\'\"]{1,4}.{,33}','[mM][iI][mM][aA] {,20}= {,3}[\'\"]{1,4}.{,33}','<[pP][aA][sS][sS].{,33}</[pP][aA][sS][sS]')def scan(path):for root,dirs,files in os.walk(path):for filespath in files:realfile = os.path.join(root,filespath)if os.path.getsize(realfile) < 1024 * 1024 and all(map(lambda x: not realfile.endswith(x),  ('.java', '.jar', '.css', '.class', '.bin', '.exe', '.jpg', '.png', '.pdf', '.doc', '.JPG', 'gif'))):filen = open(realfile)filestr = filen.read()filen.close()for rule in rulelist[:]:result = re.compile(rule).search(filestr)if result:print 'File: ', os.path.join(root,filespath ), result.group(0)print ('Modifed time: ', time.strftime('%Y-%m-%d %H:%M:%S',time.localtime(os.path.getmtime(realfile))))breakif __name__=='__main__':if len(sys.argv)!=2:print "Usage:", sys.argv[0], '/dir'sys.exit(1)if not os.path.lexists(sys.argv[1]):print "wrong path"sys.exit(1)print "going"scan(sys.argv[1])