python脚本实现查找webshell的方法

本文讲述了一个python查找 webshell脚本的代码，除了查找webshell功能之外还具有白名单功能，以及发现恶意代码发送邮件报警等功能，感兴趣的朋友可以自己测试一下看看效果。

具体的功能代码如下：

    #!/usr/bin/env python
    #-*- coding: utf-8 -*-

    import os
    import sys
    import re
    import smtplib

    #设定邮件
    fromaddr = "smtp.qq.com"
    toaddrs = ["voilet@qq.com"]
    username = "voilet"
    password = "xxxxxx"


    #设置白名单
    pass_file = ["api_ucenter.php"]

    #定义发送邮件函数
    def sendmail(toaddrs,sub,content):
      '发送邮件模块'
      # Add the From: and To: headers at the start!
      msg = ("From: %s\r\nTo: %s\r\nSubject: %s\r\n\r\n"
          % (fromaddr, ", ".join(toaddrs), sub))
      msg += content
      server = smtplib.SMTP('mail.funshion.com', 25,)
      server.login(username, password)
      server.sendmail(fromaddr, toaddrs, msg)
      server.quit()

    #设置搜索特征码
    rulelist = [
      '(\$_(GET|POST|REQUEST)\[.{0,15}\]\(\$_(GET|POST|REQUEST)\[.{0,15}\]\))',
      '(base64_decode\([\'"][\w\+/=]{200,}[\'"]\))',
      'eval\(base64_decode\(',
      '(eval\(\$_(POST|GET|REQUEST)\[.{0,15}\]\))',
      '(assert\(\$_(POST|GET|REQUEST)\[.{0,15}\]\))',
      '(\$[\w_]{0,15}\(\$_(POST|GET|REQUEST)\[.{0,15}\]\))',
      '(wscript\.shell)',
      '(gethostbyname\()',
      '(cmd\.exe)',
      '(shell\.application)',
      '(documents\s+and\s+settings)',
      '(system32)',
      '(serv-u)',
      '(提权)',
      '(phpspy)',
      '(后门)',
      '(webshell)',
      '(Program\s+Files)',
      'www.phpdp.com',
      'phpdp',
      'PHP神盾',
      'decryption',
      'Ca3tie1',
      'GIF89a',
      'IKFBILUvM0VCJD\/APDolOjtW0tgeKAwA',
      '\'e\'\.\'v\'\.\'a\'\.\'l\'',
    ]

    def Scan(path):
      for root,dirs,files in os.walk(path):
        for filespath in files:
          isover = False
          if '.' in filespath:
            ext = filespath[(filespath.rindex('.')+1):]
            if ext=='php' and filespath not in pass_file:
              file= open(os.path.join(root,filespath))
              filestr = file.read()
              file.close()
              for rule in rulelist:
                result = re.compile(rule).findall(filestr)
                if result:
                  print '文件：'+os.path.join(root,filespath)
                  print '恶意代码：'+str(result[0])
                  print '\n\n'
                  sendmail(toaddrs,"增值发现恶意代码",'文件：'+os.path.join(root,filespath)+"\n" + '恶意代码：'+str(result[0]))
                  break

    try:
      if os.path.lexists("/home/web_root/"):
        print('\n\n开始扫描：'+ "/home/web_root/")
        print('        可疑文件         ')
        print('########################################')
        Scan("/home/web_root/")
        print('提示：扫描完成--~')
      else:
        print '提示：指定的扫描目录不存在--- '
    except IndexError:
      print "请指定扫描文件目录"