python脚本实现查找webshell的方法


            本文讲述了一个python查找 webshell脚本的代码，除了查找webshell功能之外还具有白名单功能，以及发现恶意代码发送邮件报警等功能，感兴趣的朋友可以自己测试一下看看效果。

具体的功能代码如下：





#!/usr/bin/env python

#-*- coding: utf-8 -*-



import os

import sys

import re

import smtplib



#设定邮件

fromaddr = "smtp.qq.com"

toaddrs = ["voilet@qq.com"]

username = "voilet"

password = "xxxxxx"





#设置白名单

pass_file = ["api_ucenter.php"]



#定义发送邮件函数

def sendmail(toaddrs,sub,content):

  '发送邮件模块'

  # Add the From: and To: headers at the start!

  msg = ("From: %s\r\nTo: %s\r\nSubject: %s\r\n\r\n"

      % (fromaddr, ", ".join(toaddrs), sub))

  msg += content

  server = smtplib.SMTP('mail.funshion.com', 25,)

  server.login(username, password)

  server.sendmail(fromaddr, toaddrs, msg)

  server.quit()



#设置搜索特征码

rulelist = [

  '(\$_(GET|POST|REQUEST)\[.{0,15}\]\(\$_(GET|POST|REQUEST)\[.{0,15}\]\))',

  '(base64_decode\([\'"][\w\+/=]{200,}[\'"]\))',

  'eval\(base64_decode\(',

  '(eval\(\$_(POST|GET|REQUEST)\[.{0,15}\]\))',

  '(assert\(\$_(POST|GET|REQUEST)\[.{0,15}\]\))',

  '(\$[\w_]{0,15}\(\$_(POST|GET|REQUEST)\[.{0,15}\]\))',

  '(wscript\.shell)',

  '(gethostbyname\()',

  '(cmd\.exe)',

  '(shell\.application)',

  '(documents\s+and\s+settings)',

  '(system32)',

  '(serv-u)',

  '(提权)',

  '(phpspy)',

  '(后门)',

  '(webshell)',

  '(Program\s+Files)',

  'www.phpdp.com',

  'phpdp',

  'PHP神盾',

  'decryption',

  'Ca3tie1',

  'GIF89a',

  'IKFBILUvM0VCJD\/APDolOjtW0tgeKAwA',

  '\'e\'\.\'v\'\.\'a\'\.\'l\'',

]



def Scan(path):

  for root,dirs,files in os.walk(path):

    for filespath in files:

      isover = False

      if '.' in filespath:

        ext = filespath[(filespath.rindex('.')+1):]

        if ext=='php' and filespath not in pass_file:

          file= open(os.path.join(root,filespath))

          filestr = file.read()

          file.close()

          for rule in rulelist:

            result = re.compile(rule).findall(filestr)

            if result:

              print '文件：'+os.path.join(root,filespath)

              print '恶意代码：'+str(result[0])

              print '\n\n'

              sendmail(toaddrs,"增值发现恶意代码",'文件：'+os.path.join(root,filespath)+"\n" + '恶意代码：'+str(result[0]))

              break



try:

  if os.path.lexists("/home/web_root/"):

    print('\n\n开始扫描：'+ "/home/web_root/")

    print('        可疑文件         ')

    print('########################################')

    Scan("/home/web_root/")

    print('提示：扫描完成--~')

  else:

    print '提示：指定的扫描目录不存在--- '

except IndexError:

  print "请指定扫描文件目录"