在线扫描探测检查asp站点木马后门的程序
程序员文章站
2023-11-20 21:10:22
复制代码 代码如下:<%@language="vbscript" codepage="936"%> <% '设置登陆密码，使用前务必修改此密码...
复制代码 代码如下:
<%@language="vbscript" codepage="936"%>
<%
'设置登陆密码，使用前务必修改此密码
password = "www.pifoo.com"
'其他扫描设置
dimfileext = "asp,cer,asa,cdx" '文件类型扩展名列表，不在此列表的将不被扫描
maxfilesize= 51200 '500k，超过此文件大小的文件(一般不是木马)，将不被扫描
timeout=600 '如果扫描超过600秒，脚本将终止
'jspadmin@asp.web.csdn=阿笨狗=飞云 修改于2006.07.07
'获取最新修改版本，请关注http://www.pifoo.com
'qq:33323489 email:subaoliang@etang.com guestbook:http://www.pifoo.com/lyb
dim report
if request.querystring("act")="login" then
if request.form("pifoo") = password then session("pifoo")="#)\'www.pifoo.com"
end if
%>
<!doctype html public "-//w3c//dtd html 4.01 transitional//en" "http://www.w3.org/tr/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=gb2312">
<title>asp木马、后门探测器</title>
</head>
<body>
<%if session("pifoo") <>"#)\'www.pifoo.com" then%>
<form name="form1" method="post" action="?act=login">
<div align="center">password:
<input name="pifoo" type="password" size="15">
<input type="submit" name="submit" value="提交">
</div>
</form>
<%
else
if request.querystring("act")<>"scan" then
%>
<form action="?act=scan" method="post">
<b>填入你要检查的路径：</b>
<input name="path" type="text" style="border:1px solid #999" value="." size="30" />
<br>
* 网站根目录的相对路径，填"\"即检查整个网站；"."为程序所在目录
<br>
<br>
<input type="submit" value=" 开始扫描 " style="background:#fff;border:1px solid #999;padding:2px 2px 0px 2px;margin:4px;border-width:1px 3px 1px 3px" />
</form>
<%
else
server.scripttimeout = timeout
sun = 0
sumfiles = 0
sumfolders = 1
if request.form("path")="" then
response.write("没有发现被入侵的迹象.")
response.end()
end if
timer1 = timer
if request.form("path")="\" then
tmppath = server.mappath("\")
elseif request.form("path")="." then
tmppath = server.mappath(".")
else
tmppath = server.mappath("\")&"\"&request.form("path")
end if
call showallfile(tmppath)
%>
<table width="100%" border="0" cellpadding="0" cellspacing="0" class="ccontent">
<tr>
<th>asp木马、后门、漏洞扫描探测
</tr>
<tr>
<td class="cpanel" style="padding:5px;line-height:170%;clear:both;font-size:12px">
<div id="updateinfo" style="background:ffffe1;border:1px solid #89441f;padding:4px;display:none"></div>
扫描完毕！一共检查文件夹<font color="#ff0000"><%=sumfolders%></font>个，文件<font color="#ff0000"><%=sumfiles%></font>个，发现可疑点<font color="#ff0000"><%=sun%></font>个
<table width="100%" border="0" cellpadding="0" cellspacing="0">
<tr>
<td valign="top">
<table width="100%" border="1" cellpadding="0" cellspacing="0" style="padding:5px;line-height:170%;clear:both;font-size:12px">
<tr>
<td width="20%">文件相对路径</td>
<td width="20%">特征码</td>
<td width="40%">描述</td>
<td width="20%">创建/修改时间</td>
</tr>
<p>
<%=report%>
<br/></p>
</table></td>
</tr>
</table>
</td></tr></table>
<%
timer2 = timer
thetime=cstr(int(((timer2-timer1)*10000 )+0.5)/10)
response.write "<br><font size=""2"">本页执行共用了"&thetime&"毫秒</font>"
end if
end if
%>
<hr>
<div align="center"><br>
modified by <a href="http://www.pifoo.com" target=_blank>jspadmin</a> at 2006.07.07
</div>
</body>
</html>
<%
'遍历处理path及其子目录所有文件
sub showallfile(path)
set fso = createobject("scripting.filesystemobject")
if not fso.folderexists(path) then exit sub
set f = fso.getfolder(path)
set fc2 = f.files
for each myfile in fc2
if checkext(fso.getextensionname(path&"\"&myfile.name)) and (myfile.size<=maxfilesize) then
call scanfile(path&temp&"\"&myfile.name, "")
sumfiles = sumfiles + 1
end if
next
set fc = f.subfolders
for each f1 in fc
showallfile path&"\"&f1.name
sumfolders = sumfolders + 1
next
set fso = nothing
end sub
'检测文件
sub scanfile(filepath, infile)
if infile <> "" then
infiles = "该文件被<a href=""http://"&request.servervariables("server_name")&"\"&infile&""" target=_blank>"& infile & "</a>文件包含执行"
end if
set fsos = createobject("scripting.filesystemobject")
on error resume next
set ofile = fsos.opentextfile(filepath)
filetxt = lcase(ofile.readall())
if err then exit sub end if
if len(filetxt)>0 then
'特征码检查
temp = "<a href=""http://"&request.servervariables("server_name")&"\"&replace(filepath,server.mappath("\")&"\","",1,1,1)&""" target=_blank>"&replace(filepath,server.mappath("\")&"\","",1,1,1)&"</a>"
'check "wscr"&domybest&"ipt.shell"
if instr( filetxt, lcase("wscr"&domybest&"ipt.shell") ) or instr( filetxt, lcase("clsid:72c24dd5-d70a"&domybest&"-438b-8a42-98424b88afb8") ) then
report = report&"<tr><td>"&temp&"</td><td>wscr"&domybest&"ipt.shell 或者 clsid:72c24dd5-d70a"&domybest&"-438b-8a42-98424b88afb8</td><td>危险组件，一般被asp木马利用。"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
end if
'check "she"&domybest&"ll.application"
if instr( filetxt, lcase("she"&domybest&"ll.application") ) or instr( filetxt, lcase("clsid:13709620-c27"&domybest&"9-11ce-a49e-444553540000") ) then
report = report&"<tr><td>"&temp&"</td><td>she"&domybest&"ll.application 或者 clsid:13709620-c27"&domybest&"9-11ce-a49e-444553540000</td><td>危险组件，一般被asp木马利用。"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
end if
'check .encode
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "@\s*language\s*=\s*[""]?\s*(vbscript|jscript|javascript).encode\b"
if regex.test(filetxt) then
report = report&"<tr><td>"&temp&"</td><td>(vbscript|jscript|javascript).encode</td><td>似乎脚本被加密了，一般asp文件是不会加密的。"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
end if
'check my asp backdoor :(
regex.pattern = "\bev"&"al\b"
if regex.test(filetxt) then
report = report&"<tr><td>"&temp&"</td><td>ev"&"al</td><td>e"&"val()函数可以执行任意asp代码，被一些后门利用。其形式一般是：ev"&"al(x)<br>但是javascript代码中也可以使用，有可能是误报。"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
end if
'check exe&cute backdoor
regex.pattern = "[^.]\bexe"&"cute\b"
if regex.test(filetxt) then
report = report&"<tr><td>"&temp&"</td><td>exec"&"ute</td><td>e"&"xecute()函数可以执行任意asp代码，被一些后门利用。其形式一般是：ex"&"ecute(x)。<br>"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
end if
set regex = nothing
'检查包含文件
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "<!--\s*#include\s*file\s*=\s*"".*"""
set matches = regex.execute(filetxt)
for each match in matches
tfile = replace(mid(match.value, instr(match.value, """") + 1, len(match.value) - instr(match.value, """") - 1),"/","\")
if not checkext(fsos.getextensionname(tfile)) then
call scanfile( mid(filepath,1,instrrev(filepath,"\"))&tfile, replace(filepath,server.mappath("\")&"\","",1,1,1) )
sumfiles = sumfiles + 1
end if
next
set matches = nothing
set regex = nothing
'检查虚拟目录
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "<!--\s*#include\s*virtual\s*=\s*"".*"""
set matches = regex.execute(filetxt)
for each match in matches
tfile = replace(mid(match.value, instr(match.value, """") + 1, len(match.value) - instr(match.value, """") - 1),"/","\")
if not checkext(fsos.getextensionname(tfile)) then
call scanfile( server.mappath("\")&"\"&tfile, replace(filepath,server.mappath("\")&"\","",1,1,1) )
sumfiles = sumfiles + 1
end if
next
set matches = nothing
set regex = nothing
'检查特殊命令：server&.execute|transfer
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "server.(exec"&"ute|transfer)([ \t]*|\()"".*"""
set matches = regex.execute(filetxt)
for each match in matches
tfile = replace(mid(match.value, instr(match.value, """") + 1, len(match.value) - instr(match.value, """") - 1),"/","\")
if not checkext(fsos.getextensionname(tfile)) then
call scanfile( mid(filepath,1,instrrev(filepath,"\"))&tfile, replace(filepath,server.mappath("\")&"\","",1,1,1) )
sumfiles = sumfiles + 1
end if
next
set matches = nothing
set regex = nothing
'check server&.execute|transfer
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "server.(exec"&"ute|transfer)([ \t]*|\()[^""]\)"
if regex.test(filetxt) then
report = report&"<tr><td>"&temp&"</td><td>server.exec"&"ute</td><td>不能跟踪检查server.e"&"xecute()函数执行的文件。请管理员自行检查。<br>"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
end if
set matches = nothing
set regex = nothing
'检查createobject命令 crea"&"teobject
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "createo"&"bject[ |\t]*\(.*\)"
set matches = regex.execute(filetxt)
for each match in matches
if instr(match.value, "&") or instr(match.value, "+") or instr(match.value, """") = 0 or instr(match.value, "(") <> instrrev(match.value, "(") then
report = report&"<tr><td>"&temp&"</td><td>creat"&"eobject</td><td>crea"&"teobject函数使用了变形技术，仔细复查。"&infiles&"</td><td>"&getdatecreate(filepath)&"<br>"&getdatemodify(filepath)&"</td></tr>"
sun = sun + 1
exit sub
end if
next
set matches = nothing
set regex = nothing
end if
set ofile = nothing
set fsos = nothing
end sub
'检查文件后缀，如果与预定的匹配即返回true
function checkext(fileext)
if dimfileext = "*" then checkext = true
ext = split(dimfileext,",")
for i = 0 to ubound(ext)
if lcase(fileext) = ext(i) then
checkext = true
exit function
end if
next
end function
function getdatemodify(filepath)
set fso = createobject("scripting.filesystemobject")
set f = fso.getfile(filepath)
s = f.datelastmodified
set f = nothing
set fso = nothing
getdatemodify = s
end function
function getdatecreate(filepath)
set fso = createobject("scripting.filesystemobject")
set f = fso.getfile(filepath)
s = f.datecreated
set f = nothing
set fso = nothing
getdatecreate = s
end function
%>
【asp木马探测器】-在线扫描探测检查asp站点木马后门的程序
可以在线扫描检查探测站点内的所有asp程序代码，检测代码中是否含有危险代码
目前检测的特征码有：createobject、execute、shell.application、wscript.shell、eval、include......等。
对程序的改进是：增加扩展名后缀列表自定义、扫描文件大小限制、扫描超时限制、session验证改复杂了一点点......
具体请自己打开原始代码查看。
使用后，要么及时删除，要么将登陆密码改掉，尽量改复杂点。（虽然这个程序不会直接提供在线打开文件的功能，但仍然有可能被hacker利用）
准备下一个修改版本加入检查iframe特征码的功能，目前太多站点都是被人挂了iframe，当然，那只是表现，具体漏洞根源还是在程序或其他方面。
[注意：解压密码和默认登陆密码都是]
原作者：雷客图
jspadmin=阿笨狗=飞云 修改于2006.07.07
'获取最新修改版本，请关注
'qq:33323489 email:subaoliang@etang.com guestbook:http://www.pifoo.com/lyb
推荐阅读