....................................../////.===Shadow-Here===./////................................................ > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < > < ------------------------------------------------------------------------------------------------------------------- /////////////////////////////////////////////////////////////////////////////////////////////////////////////////// RIFF¤ WEBPVP8 ˜ ðÑ *ôô>‘HŸK¥¤"§£±¨àð enü¹%½_F‘åè¿2ºQú³íªú`N¿­3ÿƒügµJžaÿ¯ÿ°~¼ÎùnúîÞÖô•òíôÁÉß®Sm¥Ü/ ‡ó˜f£Ùà<˜„xëJ¢Ù€SO3x<ªÔ©4¿+ç¶A`q@Ì“Úñè™ÍÿJÌ´ª-˜ÆtÊÛL]Ïq*‘Ý”ì#ŸÌÏãY]@ê`¿ /ªfkØB4·®£ó z—Üw¥Pxù–ÞLШKÇN¾AkÙTf½è'‰g gÆv›Øuh~ a˜Z— ïj*á¥t d£“uÒ ¨`K˜¹ßþ]b>˜]_ÏÔ6W—è2r4x•íÖ…"ƒÖNîä!¦å Ú}ýxGøÌ —@ ;ÆÚŠ=ɾ1ý8lªË¥ô ^yf®Œ¢u&2©nÙÇ›ñÂñŒ³ aPo['½»øFùà­+4ê“$!lövlüÞ=;N®3ð‚õ›DÉKòÞ>ÄÍ ¥ˆuߤ#ˆ$6ù™¥îŠ‡y’ÍB¼ çxÛ;X"WL£R÷͝*ó-¶Zu}º.s¸sšXqù–DþÿvªhüïwyŸ ¯é³lÀ:KCûÄ£Ëá\…­ ~—ýóî ¼ûûÜTÓüÇy…ŽÆvc»¾×U ñ¸žþоP÷¦ó:Ò¨¨5;Ð#&#ÖúñläÿÁœ GxÉ­/ñ‡áQðìYÉtÒwŽ¼GÔ´zàÒò ð*ëzƒ•4~H]Ø‹f ñÓÈñ`NåWçs'ÆÏW^ø¹!XžµmQ5ÃËoLœÎ: ÞËÍ¥J ù…î èo£ßPÎñ¶ž8.Œ]ʵ~5›ÙË-ù*8ÙÖß±~ ©¹rÓê‚j¶d¸{^Q'˜±Crß ÚH—#¥¥QlÀ×ëã‡DÜ«èî þ&Çæžî;ŽÏºò6ÒLÃXy&ZŒ'j‚¢Ù€IßÚù+–MGi‰*jE€‘JcÜ ÓÌ EÏÚj]o˜ Þr <¾U ûŪæÍ/šÝH¥˜b”¼ ÁñßX GP›ï2›4WŠÏà×£…íÓk†¦H·ÅíMh–*nó÷à]ÁjCº€b7<ب‹¨5車bp2:Á[UªM„QŒçiNMa#<5›áËó¸HýÊ"…×Éw¹¦ì2º–x<›»a±¸3Weü®FÝ⑱ö–î–³|LPÈ~çð~Çå‡|º kD¢µÏàÆAI %1À% ¹Ò – ”ϝS¦‰4&¶£°à Öý”û_Ò Áw°A«Å€?mÇÛgHÉ/8)á¾ÛìáöŽP í¨PŸNÙµº¦‡§Ùš"ÿ«>+ªÕ`Ê÷‡‚ß Õû˜þãÇ-PÍ.¾XV‘€ dÜ"þ4¹ ±Oú‘©t¥¦FªÄÃÄ•b‚znýu½—#cDs˜ÃiÑOˆñ×QO=*IAÊ,¶ŽZƒ;‡wøXè%EÐk:F±Ú” .Ѽ+Áu&Ç`."pÈÉw o&¿dE6‘’EqTuK@Ì¥ã™À(Êk(h‰,H}RÀIXÛš3µ1©_OqÚÒJAñ$ÊÙÜ;D3çŒ[þùœh¬Ã³™ö6ç†NY".Ú‰ï[ªŸŒ '²Ð öø_¨ÂÉ9u鶳ÒŠõTàîMØ#û¯gN‡bÙ놚X„ö …ÉeüÌ^J ‹€.œ$Æ)βÄeæW#óüßĺŸ€ ÀzwV 9oä»f4V*uB «Ë†¹ì¯žR霓æHXa=&“I4K;¯ç‹h×·"UŠ~<•â•ªVêª&ÍSÃÆÅ?ÔqÎ*mTM ˜›µwêd#[C¡©§‘D<©àb†–ÁœøvH/,í:¯( ²£|4-„Æövv„Yͼ™^Á$ˆ„¢Û[6yB.åH*V¨æ?$=˜Ñ€•î¦ñ·­(VlŸ‘ nÀt8W÷´Bûba?q9ú¶Xƒl«ÿ\ù¶’þòUÐj/õ¢Ìµ³g$ƒÎR!¸»|Oߍë’BhîÚÑ¢ñåŒJ„®„£2Ð3•ô02Nt…!£Í]Ïc½Qÿ?ˆ<&ÃA¾Ú,JˆijÌ#5yz„‰Î|ÊŽ5QÏ:‹ÐaóVÔxW—CpeÏzÐïíçôÿÅ_[hãsÐ_/ŽTÝ?BîˆííV$<¿i>²F¬_Eß¿ †bÊŒº­ÿ®Z H“C}”¬,Mp ý/Bá£w>˜YV°aƒúh+cŠ- r/[%|üUMHäQ°X»|û/@|°¥Ð !BÔ Ç¢Ä©š+Õì D«7ìN¶ŽðÔ " ƶ’ÖçtA‰Û×}{tþz­¾GÍ›k¹OEJR$ Â׃ «ëÁ"oÉôž$oUK(Ä)Ãz³Ê-‹êN[Ò3Œñbï8P 4ƒ×q¢bo|?<ÛX¬òÄÍ°L–±›(™ûG?ýË©ÚÄ–ÂDØÐ_Ç¡ô ¾–ÄÏø ×e8Ë©$ÄF¹Å‹ì[©óìl:F¾f´‹‹Xì²ï®\¬ôùƒ ÿat¥óèÒùHß0äe‚;ü×h:ÆWðHž=Ã8骣"kœ'Y?³}Tûè€>?0l›e1Lòñ„aæKÆw…hÖŠùW…ÈÆÄ0ši·›[pcwËþñiêíY/~-Á5˜!¿†A›™Mÿþ(±“t@â“ö2­´TG5yé]çå僳 .·ÍïçÝ7UÚ±Ð/Nè»,_Ï ùdj7\ï Wì4›„»c¸àešg#ÒÊ⥭áØo5‘?ÌdÝô¯ ¹kzsƒ=´#ëÉK›Ø´±-¥eW?‡çßtòTã…$Ý+qÿ±ƒ÷_3Ô¥í÷:æ–ž<·Ö‡‰Å¢ š‡%Ô—utÌÈìðžgÖÀz²À—ï÷Óîäõ{K'´È÷³yaÏÁjƒô}ž§®æÊydÕÈë5¯èˆõvÕ©ã*çD„ “z„Ó‡^^xÂ3M§A´JG‚öï 3W'ˆ.OvXè¡ÊÕª?5º7†˜(˜Ç¶#çê’¶!ÌdZK§æ 0fãaN]òY³RV ™î$®K2R¨`W!1Ôó\;Ý ýB%qæK•&ÓÈe9È0êI±žeŸß -ú@žQr¦ ö4»M¼Áè¹µmw 9 EÆE_°2ó„ŸXKWÁ×Hóì^´²GѝF©óäR†¦‰ç"V»eØ<3ùd3ÿÚ¤Žú“Gi" —‘_ÙËÎ~Üö¯¥½Î»üŸEÚŽåmÞþí ;ÞólËΦMzA"Âf(´òá;Éï(/7½ûñÌ­cïÕçлþÝz¾-ÍvÑ“pH­–ðÓj$¸Äû¤‚‘ãUBË-n“2åPkS5&‹Â|+g^œ®Ì͆d!OïäîU«c;{Û!ÅŽ«ëZ9Ókóˆ]¯ƒ›né `ÇÒ+tÆš (ØKá¾—=3œ®•vuMñg²\ï Ec€ 05±d™‡×iÇ×›UúvÌ¢£Èþ¡ÕØô¶ßÎA"ß±#Ö²ˆÊŸ¦*Ä~ij|àø.-¼'»Ú¥£h ofº¦‡VsR=N½„Î v˜Z*SÌ{=jÑB‹tê…;’HžH¯8–îDù8ñ¢|Q•bÛçš–‹m³“ê¨ åÏ^m¬Žãþ©ïêO‡½6] µÆ„Ooòü ²x}N¦Ë3ïé¿»€›HA˜m%çÞ/¿í7Fø“‹léUk)É°Œµ8Q8›:ÀŠeT*šõ~ôڝG6 ¢}`ùH­–”¡k ‰P1>š†®9z11!X wKfmÁ¦xÑ,N1Q”–æB¶M…ÒÃv6SMˆhU¬ÊPŽï‘öj=·CŒ¯u¹ƒVIЃsx4’ömÛýc塶7ßŠß 57^\wÒÐÆ k§h,Œý î«q^R½3]J¸ÇðN ‚çU¬ôº^Áì} ³f©Õœ§ˆã:FÄÈ‚é(€™?àýÓüè1Gô£¼éj‚OÅñ  #>×—ßtà 0G¥Åa뀐kßhc™À_ÉñÞ#±)GD" YîäË-ÿÙ̪ ¹™a¯´¢E\ÝÒö‚;™„ë]_ p8‰o¡ñ+^÷ 3‘'dT4œŽ ðVë½° :¬víÑ«£tßÚS-3¶“þ2 †üüʨòrš¹M{É_¤`Û¨0ìjœøJ‡:÷ÃáZ˜†@GP&œÑDGÏs¡þ¦þDGú‘1Yá9Ôþ¼ ûø…§÷8&–ÜÑnÄ_m®^üÆ`;ÉVÁJ£?â€-ßê}suÍ2sõA NÌúA磸‘îÿÚ»ƒìö·á¿±tÑÐ"Tÿü˜[@/äj¬€uüªìù¥Ý˜á8Ý´sõj 8@rˆð äþZÇD®ÿUÏ2ùôõrBzÆÏÞž>Ì™xœ“ wiÎ×7_… ¸ \#€MɁV¶¥üÕÿPÔ9Z‡ø§É8#H:ƒ5ÀÝå9ÍIŒ5åKÙŠ÷qÄ>1AÈøžj"µÂд/ªnÀ qªã}"iŸBå˜ÓÛŽ¦…&ݧ;G@—³b¯“•"´4í¨ôM¨åñC‹ïùÉó¯ÓsSH2Ý@ßáM‡ˆKÀªÛUeø/4\gnm¥‹ŸŒ qÄ b9ÞwÒNÏ_4Ég³ú=܆‚´ •â¥õeíþkjz>éÚyU«Íӝ݃6"8/ø{=Ô¢»G¥ äUw°W«,ô—¿ãㆅү¢³xŠUû™yŒ (øSópÐ 9\åTâ»—*oG$/×ÍT†Y¿1¤Þ¢_‡ ¼ „±ÍçèSaÓ 3ÛMÁBkxs‰’R/¡¤ˆÙçª(*õ„üXÌ´ƒ E§´¬EF"Ù”R/ÐNyÆÂ^°?™6¡œïJ·±$§?º>ÖüœcNÌù¯G ‹ñ2ŠBB„^·úìaz¨k:#¨Æ¨8LÎõލ£^§S&cŒÐU€ü(‡F±Š¼&P>8ÙÁ ‰ p5?0ÊƃZl¸aô š¼¡}gÿ¶zÆC²¹¬ÎÖG*HB¡O<º2#ñŒAƒ–¡B˜´É$¥›É:FÀÔx¾u?XÜÏÓvN©RS{2ʈãk9rmP¼Qq̳ è¼ÐFׄ^¡Öì fE“F4A…!ì/…¦Lƒ… … $%´¾yã@CI¬ á—3PþBÏNÿ<ý°4Ü ËÃ#ØÍ~âW«rEñw‹eùMMHß²`¬Öó½íf³:‹k˜¯÷}Z!ã¿<¥,\#öµÀ¯aÒNÆIé,Ћ–lŽ#Àæ9ÀÒS·I’½-Ïp Äz¤Š Â* ­íÄ9­< h>׍3ZkËU¹§˜ŒŠ±f­’¤º³Q ÏB?‹#µíÃ¥®@(Gs«†vI¥Mµ‹Á©e~2ú³ÁP4ìÕi‚²Ê^ö@-DþÓàlÜOÍ]n"µã:žpsŽ¢:! Aõ.ç~ÓBûH÷JCÌ]õVƒd «ú´QÙEA–¯¯Œ!.ˆˆëQ±ù œ·Ì!Õâ )ùL„ÅÀlÚè5@B…o´Æ¸XÓ&Û…O«˜”_#‡ƒ„ûÈt!¤ÁÏ›ÎÝŠ?c9 â\>lÓÁVÄÑ™£eØY]:fÝ–—ù+p{™ðè û³”g±OƒÚSù£áÁÊ„ä,ï7š²G ÕÌBk)~ÑiCµ|h#u¤¶îK¨² #²vݯGãeÖ϶ú…¾múÀ¶þÔñ‚Š9'^($¤§ò “š½{éúp÷J›ušS¹áªCÂubÃH9™D™/ZöØÁ‡¦ÝÙŸ·kð*_”.C‹{áXó€‡c¡c€§/šò/&éš÷,àéJþ‰X›fµ“C¨œ®r¬"kL‰Â_q…Z–.ÉL~O µ›zn‚¹À¦Öª7\àHµšÖ %»ÇníV[¥*Õ;ƒ#½¾HK-ÖIÊdÏEÚ#=o÷Óò³´Š: Ç?{¾+9›–‘OEáU·S€˜j"ÄaÜ ŒÛWt› á–c#a»pÔZÞdŽtWê=9éöÊ¢µ~ ë ;Öe‡Œ®:bî3±ýê¢wà¼îpêñ¹¾4 zc¾ðÖÿzdêŒÑÒŝÀ‰s6¤í³ÎÙB¿OZ”+F¤á‡3@Ñëäg©·Ž ˆèª<ù@É{&S„œÕúÀA)‰h:YÀ5^ÂÓŒ°õäU\ ùËÍû#²?Xe¬tu‰^zÒÔãë¼ÛWtEtû …‚g¶Úüâî*moGè¨7%u!]PhÏd™Ý%Îx: VÒ¦ôÊD3ÀŽKÛËãvÆî…N¯ä>Eró–ð`5 Œ%u5XkñÌ*NU%¶áœÊ:Qÿú»“úzyÏ6å-၇¾ ´ ÒÊ]y žO‘w2Äøæ…H’²f±ÎÇ.ª|¥'gîV•Ü .̘¯€šòü¤U~Ù†*¢!?ò wý,}´°ÔÞnïoKq5µb!áÓ3"vAßH¡³¡·G(ÐÎ0Îò¼MG!/ài®@—¬04*`…«é8ªøøló“ˆÊ”èù¤…ßÊoÿé'ËuÌÖ5×È¡§ˆˆfŽë9}hìâ_!!¯  B&Ëö¶‰ÀAÙNVŸ Wh›¸®XÑJì¨ú“¿÷3uj²˜¨ÍÎìë±aúŠÝå¯ð*Ó¨ôJ“yºØ)m°WýOè68†ŸÏ2—‰Ïüꪫٚ¥‹l1 ø ÏÄFjêµvÌbü¦èÝx:X±¢H=MÐß—,ˆÉÇ´(9ú¾^ÅÚ4¿m‡$âX‘å%(AlZo@½¨UOÌÕ”1ø¸jÎÀÃÃ_ µ‘Ü.œº¦Ut: Æï’!=¯uwû#,“pþÇúŒø(é@?³ü¥‘Mo §—s@Œ#)§ŒùkL}NOÆêA›¸~r½¼ÙA—HJ«eˆÖ´*¡ÓpÌŸö.m<-"³ûÈ$¬_6­åf£ïÚâj1y§ÕJ½@dÞÁr&Í\Z%D£Íñ·AZ Û³øüd/ªAi†/Й~  ‡âĮҮÏh§°b—›Û«mJžòG'[ÈYýŒ¦9psl ýÁ ®±f¦x,‰½tN ‚Xª9 ÙÖH.«Lo0×?͹m¡å†Ѽ+›2ƒF ±Ê8 7Hցϓ²Æ–m9…òŸï]Â1äN†VLâCˆU .ÿ‰Ts +ÅÎx(%¦u]6AF Š ØF鈄‘ |¢¶c±soŒ/t[a¾–û:s·`i햍ê›ËchÈ…8ßÀUÜewŒðNOƒõD%q#éû\9¤x¹&UE×G¥ Í—™$ð E6-‡¼!ýpãÔM˜ Âsìe¯ñµK¢Ç¡ùôléœ4Ö£”À Š®Ðc ^¨À}ÙËŸ§›ºê{ÊuÉC ×Sr€¤’fÉ*j!úÓ’Gsùìoîßîn%ò· àc Wp÷$¨˜)û»H ×8ŽÒ€Zj¤3ÀÙºY'Ql¦py{-6íÔCeiØp‘‡XÊîÆUߢ܂ž£Xé¼Y8þ©ëgñß}é.ÎógÒ„ÃØËø¯»™§Xýy M%@NŠ À(~áÐvu7&•,Ù˜ó€uP‡^^®=_E„jt’ 403WebShell
403Webshell
Server IP : 205.196.210.190  /  Your IP : 216.73.216.35
Web Server : Apache
System : Linux pdx1-shared-a2-06 6.6.116-grsec-jammy-dirty #1 SMP Sat Nov 8 00:02:42 UTC 2025 x86_64
User : dh_2vi232 ( 5939701)
PHP Version : 8.2.29
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : ON  |  Pkexec : ON
Directory :  /home/dh_2vi232/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ Back ]     

Current File : /home/dh_2vi232/webshell.php
<?php
/**
 * Webshell 检测工具（优化版）
 * 添加了超时控制、进度显示、并发扫描限制等功能
 */

class WebshellDetector {
    
    // 常见的Webshell特征关键词
    private $dangerous_functions = [
        'eval(', 'assert(', 'system(', 'exec(', 'shell_exec(',
        'passthru(', 'proc_open(', 'popen(', 'pcntl_exec(',
        'file_put_contents(', 'fwrite(', 'fopen(',
        'base64_decode(', 'gzuncompress(', 'gzdecode(',
        'include_once(', 'require_once(',
        'create_function(', 'preg_replace_callback('
    ];
    
    // 可疑的文件名特征
    private $suspicious_filenames = [
        'shell', 'backdoor', 'cmd', 'c99', 'r57',
        'wso', 'b374k', 'c100', 'webshell',
        'phpinfo', 'config', 'test', 'admin',
        'upload', 'filemanager', 'manager'
    ];
    
    // 可疑的代码模式
    private $suspicious_patterns = [
        '/eval\s*\(\s*base64_decode\s*\(/i',
        '/eval\s*\(\s*\$\_(GET|POST|REQUEST|COOKIE)/i',
        '/assert\s*\(\s*base64_decode\s*\(/i',
        '/system\s*\(\s*\$\_(GET|POST|REQUEST|COOKIE)/i',
        '/include\s*\(\s*\$\_(GET|POST|REQUEST|COOKIE)/i',
        '/require\s*\(\s*\$\_(GET|POST|REQUEST|COOKIE)/i',
        '/\$\w+\s*\(\s*\$\_(GET|POST|REQUEST|COOKIE)/i',
        '/@\$\w+\s*\(\s*\$\_(GET|POST|REQUEST|COOKIE)/i',
        '/preg_replace\s*\(\s*["\']\/\.\*\/e["\']/i',
        '/preg_replace\s*@.*\/e@i',
        '/create_function\s*\(/i',
        '/`.*`/', // 反引号执行命令
    ];
    
    // 配置选项
    private $config = [
        'max_file_size' => 5242880, // 最大文件大小 5MB
        'max_scan_time' => 300,     // 最大扫描时间 5分钟
        'max_depth' => 20,          // 最大递归深度
        'timeout' => 30,            // 每个文件的最大处理时间
        'scan_extensions' => ['php', 'php3', 'php4', 'php5', 'php7', 'phtml', 'inc'],
        'exclude_dirs' => ['.git', '.svn', 'vendor', 'node_modules', 'cache', 'logs'],
        'log_file' => 'webshell_scan.log',
    ];
    
    // 扫描统计
    private $stats = [
        'total_files' => 0,
        'scanned_files' => 0,
        'suspicious_files' => 0,
        'start_time' => 0,
        'end_time' => 0,
    ];
    
    // 扫描结果
    private $results = [];
    
    /**
     * 构造函数
     * @param array $config 配置选项
     */
    public function __construct($config = []) {
        $this->config = array_merge($this->config, $config);
    }
    
    /**
     * 扫描指定目录
     * @param string $directory 要扫描的目录
     * @param bool $recursive 是否递归扫描子目录
     * @param int $depth 当前递归深度
     * @return array 检测结果
     */
    public function scanDirectory($directory, $recursive = true, $depth = 0) {
        // 检查扫描时间
        if ($this->checkTimeout()) {
            throw new Exception("扫描超时，已运行 " . (time() - $this->stats['start_time']) . " 秒");
        }
        
        // 检查递归深度
        if ($depth > $this->config['max_depth']) {
            $this->log("达到最大递归深度: {$directory}");
            return $this->results;
        }
        
        if (!is_dir($directory) || !is_readable($directory)) {
            $this->log("目录不存在或不可读: {$directory}");
            return $this->results;
        }
        
        try {
            $iterator = new RecursiveDirectoryIterator(
                $directory, 
                RecursiveDirectoryIterator::SKIP_DOTS
            );
            
            foreach ($iterator as $file) {
                // 检查扫描时间
                if ($this->checkTimeout()) {
                    throw new Exception("扫描超时，已运行 " . (time() - $this->stats['start_time']) . " 秒");
                }
                
                $filepath = $file->getPathname();
                $filename = $file->getFilename();
                
                // 跳过排除的目录
                if (in_array($filename, $this->config['exclude_dirs'])) {
                    continue;
                }
                
                // 如果是目录且需要递归扫描
                if ($file->isDir() && $recursive) {
                    $this->scanDirectory($filepath, $recursive, $depth + 1);
                }
                
                // 检查文件
                if ($file->isFile()) {
                    $this->stats['total_files']++;
                    
                    if ($this->isPhpFile($filepath)) {
                        $result = $this->scanFile($filepath);
                        
                        if (!empty($result['suspicious'])) {
                            $this->results[$filepath] = $result;
                        }
                        
                        $this->stats['scanned_files']++;
                        
                        // 每扫描100个文件输出一次进度
                        if ($this->stats['scanned_files'] % 100 === 0) {
                            $this->log("已扫描 {$this->stats['scanned_files']} 个文件...");
                        }
                    }
                }
            }
        } catch (Exception $e) {
            $this->log("扫描目录时出错: " . $e->getMessage());
        }
        
        return $this->results;
    }
    
    /**
     * 扫描单个文件
     * @param string $filepath 文件路径
     * @return array 检测结果
     */
    public function scanFile($filepath) {
        $result = [
            'filepath' => $filepath,
            'filename' => basename($filepath),
            'size' => filesize($filepath),
            'mtime' => filemtime($filepath),
            'filename_suspicious' => false,
            'dangerous_functions' => [],
            'suspicious_patterns' => [],
            'suspicious' => false,
            'risk_level' => 0, // 风险等级 0-10
        ];
        
        // 检查文件大小
        if ($result['size'] > $this->config['max_file_size']) {
            $result['warning'] = "文件过大，跳过详细扫描";
            return $result;
        }
        
        // 检查文件名是否可疑
        $result['filename_suspicious'] = $this->checkSuspiciousFilename($result['filename']);
        if ($result['filename_suspicious']) {
            $result['risk_level'] += 3;
        }
        
        // 读取文件内容
        $content = @file_get_contents($filepath);
        if ($content === false) {
            $result['error'] = "无法读取文件";
            return $result;
        }
        
        // 检查危险函数
        $dangerous_functions = $this->checkDangerousFunctions($content);
        $result['dangerous_functions'] = $dangerous_functions;
        if (!empty($dangerous_functions)) {
            $result['risk_level'] += count($dangerous_functions) * 2;
        }
        
        // 检查可疑代码模式
        $suspicious_patterns = $this->checkSuspiciousPatterns($content);
        $result['suspicious_patterns'] = $suspicious_patterns;
        if (!empty($suspicious_patterns)) {
            $result['risk_level'] += count($suspicious_patterns) * 3;
        }
        
        // 检查文件编码（Base64编码等）
        if ($this->checkEncodedContent($content)) {
            $result['encoded_content'] = true;
            $result['risk_level'] += 4;
        }
        
        // 检查是否为Webshell上传器
        if (strpos($content, 'move_uploaded_file') !== false && 
            strpos($content, '$_FILES') !== false) {
            $result['uploader_detected'] = true;
            $result['risk_level'] += 5;
        }
        
        // 判断是否可疑
        if ($result['risk_level'] >= 3) {
            $result['suspicious'] = true;
            $this->stats['suspicious_files']++;
        }
        
        return $result;
    }
    
    /**
     * 开始扫描
     * @param string $directory 要扫描的目录
     * @param bool $recursive 是否递归扫描
     * @return array 扫描结果
     */
    public function startScan($directory, $recursive = true) {
        $this->stats['start_time'] = time();
        $this->stats['total_files'] = 0;
        $this->stats['scanned_files'] = 0;
        $this->stats['suspicious_files'] = 0;
        $this->results = [];
        
        $this->log("开始扫描目录: {$directory}");
        $this->log("开始时间: " . date('Y-m-d H:i:s', $this->stats['start_time']));
        
        try {
            set_time_limit($this->config['max_scan_time'] + 10);
            $this->results = $this->scanDirectory($directory, $recursive);
        } catch (Exception $e) {
            $this->log("扫描过程中出错: " . $e->getMessage());
        }
        
        $this->stats['end_time'] = time();
        $duration = $this->stats['end_time'] - $this->stats['start_time'];
        
        $this->log("扫描完成!");
        $this->log("扫描耗时: {$duration} 秒");
        $this->log("发现可疑文件: {$this->stats['suspicious_files']} 个");
        $this->log("总扫描文件数: {$this->stats['scanned_files']} 个");
        
        return [
            'results' => $this->results,
            'stats' => $this->stats,
        ];
    }
    
    /**
     * 检查超时
     * @return bool
     */
    private function checkTimeout() {
        $current_time = time();
        $elapsed_time = $current_time - $this->stats['start_time'];
        
        return $elapsed_time > $this->config['max_scan_time'];
    }
    
    /**
     * 检查文件名是否可疑
     */
    private function checkSuspiciousFilename($filename) {
        $filename_lower = strtolower($filename);
        
        foreach ($this->suspicious_filenames as $suspicious) {
            if (strpos($filename_lower, $suspicious) !== false) {
                return true;
            }
        }
        
        return false;
    }
    
    /**
     * 检查文件内容中的危险函数
     */
    private function checkDangerousFunctions($content) {
        $found = [];
        
        foreach ($this->dangerous_functions as $function) {
            $func_name = rtrim($function, '(');
            $pattern = '/\b' . preg_quote($func_name, '/') . '\s*\(/i';
            
            if (preg_match($pattern, $content)) {
                $found[] = $function;
            }
        }
        
        return $found;
    }
    
    /**
     * 检查可疑代码模式
     */
    private function checkSuspiciousPatterns($content) {
        $found = [];
        
        foreach ($this->suspicious_patterns as $pattern) {
            if (preg_match($pattern, $content, $matches)) {
                $found[] = [
                    'pattern' => $pattern,
                    'match' => substr($matches[0] ?? '', 0, 200)
                ];
            }
        }
        
        return $found;
    }
    
    /**
     * 检查编码内容
     */
    private function checkEncodedContent($content) {
        // 检查Base64编码
        if (preg_match('/[A-Za-z0-9+\/=]{50,}/', $content)) {
            return true;
        }
        
        // 检查Gzip编码
        if (preg_match('/\x1f\x8b\x08/', $content)) {
            return true;
        }
        
        return false;
    }
    
    /**
     * 判断是否为PHP文件
     */
    private function isPhpFile($filepath) {
        $extension = strtolower(pathinfo($filepath, PATHINFO_EXTENSION));
        return in_array($extension, $this->config['scan_extensions']);
    }
    
    /**
     * 记录日志
     */
    private function log($message) {
        $timestamp = date('Y-m-d H:i:s');
        $log_message = "[{$timestamp}] {$message}" . PHP_EOL;
        
        // 输出到控制台
        if (php_sapi_name() === 'cli') {
            echo $log_message;
        }
        
        // 写入日志文件
        if (!empty($this->config['log_file'])) {
            @file_put_contents($this->config['log_file'], $log_message, FILE_APPEND);
        }
    }
    
    /**
     * 生成报告
     */
    public function generateReport($format = 'text') {
        $report = "";
        
        if ($format === 'html') {
            $report .= "<!DOCTYPE html>
            <html>
            <head>
                <title>Webshell 扫描报告</title>
                <style>
                    body { font-family: Arial, sans-serif; margin: 20px; }
                    .container { max-width: 1200px; margin: 0 auto; }
                    .summary { background: #f5f5f5; padding: 20px; border-radius: 5px; margin-bottom: 20px; }
                    .suspicious-file { border: 1px solid #ddd; padding: 15px; margin-bottom: 10px; border-radius: 5px; }
                    .risk-high { border-left: 5px solid #d9534f; }
                    .risk-medium { border-left: 5px solid #f0ad4e; }
                    .risk-low { border-left: 5px solid #5bc0de; }
                    .risk-level { font-weight: bold; padding: 3px 8px; border-radius: 3px; }
                    .risk-high .risk-level { background: #d9534f; color: white; }
                    .risk-medium .risk-level { background: #f0ad4e; color: white; }
                    .risk-low .risk-level { background: #5bc0de; color: white; }
                    pre { background: #f8f8f8; padding: 10px; overflow: auto; }
                </style>
            </head>
            <body>
                <div class='container'>
                    <h1>Webshell 扫描报告</h1>
                    <div class='summary'>
                        <h3>扫描统计</h3>
                        <p>扫描时间: " . date('Y-m-d H:i:s', $this->stats['start_time']) . " - " . 
                          date('Y-m-d H:i:s', $this->stats['end_time']) . "</p>
                        <p>耗时: " . ($this->stats['end_time'] - $this->stats['start_time']) . " 秒</p>
                        <p>总文件数: {$this->stats['total_files']}</p>
                        <p>扫描文件数: {$this->stats['scanned_files']}</p>
                        <p>可疑文件数: {$this->stats['suspicious_files']}</p>
                    </div>";
            
            if (!empty($this->results)) {
                $report .= "<h3>可疑文件详情</h3>";
                
                foreach ($this->results as $result) {
                    $risk_class = 'risk-low';
                    if ($result['risk_level'] >= 8) {
                        $risk_class = 'risk-high';
                    } elseif ($result['risk_level'] >= 4) {
                        $risk_class = 'risk-medium';
                    }
                    
                    $report .= "<div class='suspicious-file {$risk_class}'>
                        <h4>{$result['filepath']} 
                            <span class='risk-level'>风险等级: {$result['risk_level']}</span>
                        </h4>
                        <p>文件大小: " . $this->formatSize($result['size']) . " | 
                           修改时间: " . date('Y-m-d H:i:s', $result['mtime']) . "</p>";
                    
                    if ($result['filename_suspicious']) {
                        $report .= "<p style='color: #d9534f;'>⚠️ 文件名可疑</p>";
                    }
                    
                    if (!empty($result['dangerous_functions'])) {
                        $report .= "<p>发现危险函数: " . implode(', ', $result['dangerous_functions']) . "</p>";
                    }
                    
                    if (!empty($result['suspicious_patterns'])) {
                        $report .= "<p>可疑代码模式:</p><ul>";
                        foreach ($result['suspicious_patterns'] as $pattern) {
                            $match = htmlspecialchars($pattern['match']);
                            $report .= "<li>匹配: {$match}</li>";
                        }
                        $report .= "</ul>";
                    }
                    
                    if (!empty($result['encoded_content'])) {
                        $report .= "<p style='color: #d9534f;'>⚠️ 发现编码内容</p>";
                    }
                    
                    if (!empty($result['uploader_detected'])) {
                        $report .= "<p style='color: #d9534f;'>⚠️ 疑似文件上传器</p>";
                    }
                    
                    $report .= "</div>";
                }
            } else {
                $report .= "<p>未发现可疑文件。</p>";
            }
            
            $report .= "</div></body></html>";
        } else {
            // 文本格式报告
            $report .= "Webshell 扫描报告\n";
            $report .= "=" . str_repeat("=", 50) . "\n";
            $report .= "扫描时间: " . date('Y-m-d H:i:s', $this->stats['start_time']) . " - " . 
                      date('Y-m-d H:i:s', $this->stats['end_time']) . "\n";
            $report .= "耗时: " . ($this->stats['end_time'] - $this->stats['start_time']) . " 秒\n";
            $report .= "总文件数: {$this->stats['total_files']}\n";
            $report .= "扫描文件数: {$this->stats['scanned_files']}\n";
            $report .= "可疑文件数: {$this->stats['suspicious_files']}\n\n";
            
            if (!empty($this->results)) {
                $report .= "可疑文件列表:\n";
                $report .= str_repeat("-", 80) . "\n";
                
                foreach ($this->results as $result) {
                    $risk_level = $result['risk_level'];
                    $risk_text = "低风险";
                    if ($risk_level >= 8) {
                        $risk_text = "高风险";
                    } elseif ($risk_level >= 4) {
                        $risk_text = "中风险";
                    }
                    
                    $report .= "文件: {$result['filepath']}\n";
                    $report .= "风险等级: {$risk_level} ({$risk_text})\n";
                    $report .= "大小: " . $this->formatSize($result['size']) . " | 修改时间: " . 
                              date('Y-m-d H:i:s', $result['mtime']) . "\n";
                    
                    if ($result['filename_suspicious']) {
                        $report .= "⚠️ 文件名可疑\n";
                    }
                    
                    if (!empty($result['dangerous_functions'])) {
                        $report .= "危险函数: " . implode(', ', $result['dangerous_functions']) . "\n";
                    }
                    
                    if (!empty($result['suspicious_patterns'])) {
                        $report .= "可疑代码:\n";
                        foreach ($result['suspicious_patterns'] as $pattern) {
                            $report .= "  - " . substr($pattern['match'], 0, 100) . 
                                      (strlen($pattern['match']) > 100 ? '...' : '') . "\n";
                        }
                    }
                    
                    if (!empty($result['encoded_content'])) {
                        $report .= "⚠️ 发现编码内容\n";
                    }
                    
                    if (!empty($result['uploader_detected'])) {
                        $report .= "⚠️ 疑似文件上传器\n";
                    }
                    
                    $report .= str_repeat("-", 80) . "\n";
                }
            } else {
                $report .= "未发现可疑文件。\n";
            }
        }
        
        return $report;
    }
    
    /**
     * 格式化文件大小
     */
    private function formatSize($bytes) {
        if ($bytes >= 1073741824) {
            return number_format($bytes / 1073741824, 2) . ' GB';
        } elseif ($bytes >= 1048576) {
            return number_format($bytes / 1048576, 2) . ' MB';
        } elseif ($bytes >= 1024) {
            return number_format($bytes / 1024, 2) . ' KB';
        } else {
            return $bytes . ' Bytes';
        }
    }
}

/**
 * 命令行接口
 */
if (php_sapi_name() === 'cli') {
    // 解析命令行参数
    $options = getopt("d:o:l:t:", ['dir:', 'output:', 'log:', 'timeout:', 'help']);
    
    if (isset($options['help']) || empty($options)) {
        echo "Webshell 检测工具（命令行版）\n";
        echo "用法: php " . basename(__FILE__) . " [选项]\n\n";
        echo "选项:\n";
        echo "  -d, --dir=目录      要扫描的目录（默认：当前目录）\n";
        echo "  -o, --output=文件   输出报告文件\n";
        echo "  -l, --log=文件      日志文件\n";
        echo "  -t, --timeout=秒    最大扫描时间（默认：300秒）\n";
        echo "  --help             显示此帮助信息\n";
        exit(0);
    }
    
    $directory = $options['d'] ?? $options['dir'] ?? '.';
    $output_file = $options['o'] ?? $options['output'] ?? '';
    $log_file = $options['l'] ?? $options['log'] ?? 'webshell_scan.log';
    $timeout = $options['t'] ?? $options['timeout'] ?? 300;
    
    $config = [
        'max_scan_time' => (int)$timeout,
        'log_file' => $log_file,
    ];
    
    $detector = new WebshellDetector($config);
    
    try {
        echo "开始扫描目录: {$directory}\n";
        echo "超时时间: {$timeout} 秒\n";
        echo "日志文件: {$log_file}\n";
        echo str_repeat("=", 60) . "\n";
        
        $result = $detector->startScan($directory, true);
        
        // 生成报告
        $report = $detector->generateReport('text');
        
        // 输出到控制台
        echo $report;
        
        // 输出到文件
        if (!empty($output_file)) {
            $format = (pathinfo($output_file, PATHINFO_EXTENSION) === 'html') ? 'html' : 'text';
            $file_report = $detector->generateReport($format);
            file_put_contents($output_file, $file_report);
            echo "\n报告已保存到: {$output_file}\n";
        }
        
        // 如果发现可疑文件，设置非零退出码
        if ($result['stats']['suspicious_files'] > 0) {
            exit(1);
        }
        
    } catch (Exception $e) {
        echo "错误: " . $e->getMessage() . "\n";
        exit(2);
    }
}
?>

Youez - 2016 - github.com/yon3zu
LinuXploit