python指令碼實現尋找webshell的方法

本文講述了一個python尋找 webshell指令碼的代碼，除了尋找webshell功能之外還具有白名單功能，以及發現惡意代碼發送郵件警示等功能，感興趣的朋友可以自己測試一下看看效果。

具體的功能代碼如下：

#!/usr/bin/env python#-*- coding: utf-8 -*-import osimport sysimport reimport smtplib#設定郵件fromaddr = "smtp.qq.com"toaddrs = ["voilet@qq.com"]username = "voilet"password = "xxxxxx"#設定白名單pass_file = ["api_ucenter.php"]#定義發送郵件函數def sendmail(toaddrs,sub,content):  '發送郵件模組'  # Add the From: and To: headers at the start!  msg = ("From: %s\r\nTo: %s\r\nSubject: %s\r\n\r\n"      % (fromaddr, ", ".join(toaddrs), sub))  msg += content  server = smtplib.SMTP('mail.funshion.com', 25,)  server.login(username, password)  server.sendmail(fromaddr, toaddrs, msg)  server.quit()#設定搜尋特徵碼rulelist = [  '(\$_(GET|POST|REQUEST)\[.{0,15}\]\(\$_(GET|POST|REQUEST)\[.{0,15}\]\))',  '(base64_decode\([\'"][\w\+/=]{200,}[\'"]\))',  'eval\(base64_decode\(',  '(eval\(\$_(POST|GET|REQUEST)\[.{0,15}\]\))',  '(assert\(\$_(POST|GET|REQUEST)\[.{0,15}\]\))',  '(\$[\w_]{0,15}\(\$_(POST|GET|REQUEST)\[.{0,15}\]\))',  '(wscript\.shell)',  '(gethostbyname\()',  '(cmd\.exe)',  '(shell\.application)',  '(documents\s+and\s+settings)',  '(system32)',  '(serv-u)',  '(提權)',  '(phpspy)',  '(後門)',  '(webshell)',  '(Program\s+Files)',  'www.phpdp.com',  'phpdp',  'PHP神盾',  'decryption',  'Ca3tie1',  'GIF89a',  'IKFBILUvM0VCJD\/APDolOjtW0tgeKAwA',  '\'e\'\.\'v\'\.\'a\'\.\'l\'',]def Scan(path):  for root,dirs,files in os.walk(path):    for filespath in files:      isover = False      if '.' in filespath:        ext = filespath[(filespath.rindex('.')+1):]        if ext=='php' and filespath not in pass_file:          file= open(os.path.join(root,filespath))          filestr = file.read()          file.close()          for rule in rulelist:            result = re.compile(rule).findall(filestr)            if result:              print '檔案：'+os.path.join(root,filespath)              print '惡意代碼：'+str(result[0])              print '\n\n'              sendmail(toaddrs,"增值發現惡意代碼",'檔案：'+os.path.join(root,filespath)+"\n" + '惡意代碼：'+str(result[0]))              breaktry:  if os.path.lexists("/home/web_root/"):    print('\n\n開始掃描：'+ "/home/web_root/")    print('        可疑檔案         ')    print('########################################')    Scan("/home/web_root/")    print('提示：掃描完成--~')  else:    print '提示：指定的掃描目錄不存在--- 'except IndexError:  print "請指定掃描檔案目錄" 

