157 lines
7.6 KiB
Python
157 lines
7.6 KiB
Python
|
#!/usr/bin/env python
|
||
|
|
# encoding: utf-8
|
||
|
|
|
||
|
|
import os,sys,hashlib,time,re,threading,chardet,json
|
||
|
|
import public
|
||
|
|
|
||
|
|
class safe:
|
||
|
|
danger = public.GetMsg("DANGER")
|
||
|
|
high_risk = public.GetMsg("HIGH_RISK")
|
||
|
|
one_word_th = public.GetMsg("ONE_WORD_TROJAN_HORSE")
|
||
|
|
get_post_ev=public.GetMsg("GET_POST_EXPLOITABLE_VULNERABILITIES")
|
||
|
|
get_post_cookie_ev = public.GetMsg("GET_POST_COOKIE_EXPLOITABLE_VULNERABILITIES")
|
||
|
|
webshell = public.GetMsg("WEBSHELL")
|
||
|
|
ev = public.GetMsg("EXPLOITABLE_VULNERABILITIES")
|
||
|
|
dc = public.GetMsg("DANGEROUS_CITATION")
|
||
|
|
rulelist = [
|
||
|
|
{'msg':get_post_ev,'level':danger,'code':r'(\$_(GET|POST|REQUEST)\[.{0,15}\]\s{0,10}\(\s{0,10}\$_(GET|POST|REQUEST)\[.{0,15}\]\))'},
|
||
|
|
{'msg':one_word_th,'level':high_risk,'code':'((eval|assert)(\\s|\n)*\\((\\s|\n)*\\$_(POST|GET|REQUEST)\\[.{0,15}\\]\\))'},
|
||
|
|
{'msg':one_word_th,'level':high_risk,'code':'(eval(\\s|\n)*\\(base64_decode(\\s|\n)*\\((.|\n){1,200})'},
|
||
|
|
{'msg':webshell,'level':danger,'code':'(function\\_exists\\s*\\(\\s*[\'|\"](shell\\_exec|system|popen|exec|proc\\_open|passthru)+[\'|\"]\\s*\\))'},
|
||
|
|
{'msg':webshell,'level':danger,'code':r'((exec|shell\_exec|passthru)+\s*\(\s*\$\_(\w+)\[(.*)\]\s*\))'},
|
||
|
|
{'msg':ev,'level':danger,'code':r'(\$(\w+)\s*\(\s.chr\(\d+\)\))'},
|
||
|
|
{'msg':webshell,'level':danger,'code':r'(\$(\w+)\s*\$\{(.*)\})'},
|
||
|
|
{'msg':get_post_cookie_ev,'level':danger,'code':r'(\$(\w+)\s*\(\s*\$\_(GET|POST|REQUEST|COOKIE|SERVER)+\[(.*)\]\s*\))'},
|
||
|
|
{'msg':get_post_cookie_ev,'level':danger,'code':r'(\$\_(GET|POST|REQUEST|COOKIE|SERVER)+\[(.*)\]\(\s*\$(.*)\))'},
|
||
|
|
{'msg':webshell,'level':danger,'code':r'(\$\_\=(.*)\$\_)'},
|
||
|
|
{'msg':webshell,'level':danger,'code':r'(\$(.*)\s*\((.*)\/e(.*)\,\s*\$\_(.*)\,(.*)\))'},
|
||
|
|
{'msg':webshell,'level':danger,'code':'(new com\\s*\\(\\s*[\'|\"]shell(.*)[\'|\"]\\s*\\))'},
|
||
|
|
{'msg':webshell,'level':danger,'code':r'(echo\s*curl\_exec\s*\(\s*\$(\w+)\s*\))'},
|
||
|
|
{'msg':public.GetMsg("HAZARDOUS_FILE_OPERATION_VULNERABILITIES"),'level':high_risk,'code':r'((fopen|fwrite|fputs|file\_put\_contents)+\s*\((.*)\$\_(GET|POST|REQUEST|COOKIE|SERVER)+\[(.*)\](.*)\))'},
|
||
|
|
{'msg':public.GetMsg("DANGEROUS_UPLOAD_VULNERABILITIES"),'level':danger,'code':r'(\(\s*\$\_FILES\[(.*)\]\[(.*)\]\s*\,\s*\$\_(GET|POST|REQUEST)+\[(.*)\]\[(.*)\]\s*\))'},
|
||
|
|
{'msg':dc,'level':high_risk,'code':r'(\$\_(\w+)(.*)(eval|assert|include|require|include\_once|require\_once)+\s*\(\s*\$(\w+)\s*\))'},
|
||
|
|
{'msg':dc,'level':high_risk,'code':'((include|require|include\\_once|require\\_once)+\\s*\\(\\s*[\'|\"](\\w+)\\.(jpg|gif|ico|bmp|png|txt|zip|rar|htm|css|js)+[\'|\"]\\s*\\))'},
|
||
|
|
{'msg':ev,'level':danger,'code':r'(eval\s*\(\s*\(\s*\$\$(\w+))'},
|
||
|
|
{'msg':one_word_th,'level':high_risk,'code':r'((eval|assert|include|require|include\_once|require\_once|array\_map|array\_walk)+\s*\(\s*\$\_(GET|POST|REQUEST|COOKIE|SERVER|SESSION)+\[(.*)\]\s*\))'},
|
||
|
|
{'msg':one_word_th,'level':danger,'code':r'(preg\_replace\s*\((.*)\(base64\_decode\(\$)'}
|
||
|
|
]
|
||
|
|
|
||
|
|
ruleFile = '/www/server/panel/data/ruleList.conf';
|
||
|
|
if not os.path.exists(ruleFile): public.writeFile(ruleFile,json.dumps(rulelist));
|
||
|
|
rulelist = json.loads(public.readFile(ruleFile));
|
||
|
|
|
||
|
|
result = {};
|
||
|
|
result['data'] = []
|
||
|
|
result['phpini'] = []
|
||
|
|
result['userini'] = result['sshd'] = result['scan'] = True;
|
||
|
|
result['outime'] = result['count'] = result['error'] = 0
|
||
|
|
|
||
|
|
def scan(self,path):
|
||
|
|
start = time.time();
|
||
|
|
ce = ['.jsp','.asp','.html','.htm','.php','.tpl','.xml']
|
||
|
|
for root,dirs,files in os.walk(path):
|
||
|
|
for filespath in files:
|
||
|
|
if not os.path.splitext(filespath)[1] in ce: continue;
|
||
|
|
if os.path.getsize(os.path.join(root,filespath)) < 262144:
|
||
|
|
filename = os.path.join(root,filespath);
|
||
|
|
self.threadto(filename);
|
||
|
|
end = time.time();
|
||
|
|
self.result['outime'] = int(end - start)
|
||
|
|
|
||
|
|
def threadto(self,filename):
|
||
|
|
print 'scanning ' + filename,
|
||
|
|
file= open(filename)
|
||
|
|
filestr = file.read()
|
||
|
|
char=chardet.detect(filestr)
|
||
|
|
try:
|
||
|
|
filestr = filestr.decode(char['encoding'])
|
||
|
|
except:
|
||
|
|
return;
|
||
|
|
file.close()
|
||
|
|
for rule in self.rulelist:
|
||
|
|
tmps = re.compile(rule['code']).findall(filestr)
|
||
|
|
if tmps:
|
||
|
|
tmp = {}
|
||
|
|
tmp['msg'] = rule['msg'];
|
||
|
|
tmp['level'] = rule['level'];
|
||
|
|
tmp['filename'] = filename;
|
||
|
|
tmp['code'] = str(tmps[0][0:200])
|
||
|
|
tmp['etime'] = time.strftime('%Y-%m-%d %H:%M:%S',time.localtime(os.path.getmtime(filename)))
|
||
|
|
self.result['data'].append(tmp);
|
||
|
|
self.result['error'] += 1
|
||
|
|
break
|
||
|
|
print ' done'
|
||
|
|
self.result['count'] += 1
|
||
|
|
public.writeFile(self.result['path'] + '/scan.pl',json.dumps(self.result));
|
||
|
|
del(filestr)
|
||
|
|
|
||
|
|
def md5sum(self,md5_file):
|
||
|
|
m = hashlib.md5()
|
||
|
|
fp = open(md5_file)
|
||
|
|
m.update(fp.read())
|
||
|
|
return m.hexdigest()
|
||
|
|
fp.close()
|
||
|
|
|
||
|
|
|
||
|
|
def checkUserINI(self,path):
|
||
|
|
self.result['userini'] = os.path.exists(path+'/.user.ini');
|
||
|
|
if not self.result['userini']: self.result['error'] += 1;
|
||
|
|
public.writeFile(self.result['path'] + '/scan.pl',json.dumps(self.result));
|
||
|
|
|
||
|
|
def checkPHPINI(self):
|
||
|
|
setupPath = '/www/server';
|
||
|
|
phps = public.get_php_versions()
|
||
|
|
rep = "disable_functions\\s*=\\s*(.+)\n"
|
||
|
|
defs = ['passthru','exec','system','chroot','chgrp','chown','shell_exec','popen','ini_alter','ini_restore','dl','openlog','syslog','readlink','symlink','popepassthru']
|
||
|
|
data = []
|
||
|
|
for phpv in phps:
|
||
|
|
phpini = setupPath + '/php/'+phpv+'/etc/php.ini';
|
||
|
|
if not os.path.exists(phpini): continue;
|
||
|
|
conf = public.readFile(phpini);
|
||
|
|
tmp = re.search(rep,conf).groups();
|
||
|
|
disables = tmp[0].split(',');
|
||
|
|
for defstr in defs:
|
||
|
|
if defstr in disables: continue;
|
||
|
|
tmp = {}
|
||
|
|
tmp['function'] = defstr;
|
||
|
|
tmp['version'] = phpv;
|
||
|
|
self.result['phpini'].append(tmp);
|
||
|
|
self.result['error'] += len(self.result['phpini']);
|
||
|
|
public.writeFile(self.result['path'] + '/scan.pl',json.dumps(self.result));
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
def checkSSH(self):
|
||
|
|
if self.md5sum('/etc/issue') == '3e3c7c4194b12af573ab11c16990c477':
|
||
|
|
if self.md5sum('/usr/sbin/sshd') != 'abf7a90c36705ef679298a44af80b10b': self.result['sshd'] = False
|
||
|
|
|
||
|
|
if self.md5sum('/etc/issue') == '6c9222ee501323045d85545853ebea55':
|
||
|
|
if self.md5sum('/usr/sbin/sshd') != '4bbf2b12d6b7f234fa01b23dc9822838': self.result['sshd'] = False
|
||
|
|
self.result['sshd'] = True
|
||
|
|
public.writeFile(self.result['path'] + '/scan.pl',json.dumps(self.result));
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
def suspect(self,path):
|
||
|
|
self.result['path'] = path;
|
||
|
|
self.checkSSH();
|
||
|
|
self.checkPHPINI();
|
||
|
|
self.checkUserINI(path);
|
||
|
|
public.writeFile(self.result['path'] + '/scan.pl',json.dumps(self.result));
|
||
|
|
self.scan(path);
|
||
|
|
self.result['scan'] = False
|
||
|
|
public.writeFile(self.result['path'] + '/scan.pl',json.dumps(self.result));
|
||
|
|
return self.result;
|
||
|
|
|
||
|
|
if __name__=='__main__':
|
||
|
|
|
||
|
|
if len(sys.argv)!=2:
|
||
|
|
print(public.GetMsg("INIT_ARGS_ERR"))
|
||
|
|
exit();
|
||
|
|
if os.path.lexists(sys.argv[1]) == False:
|
||
|
|
print(public.GetMsg("DIR_NOT_EXISTS"))
|
||
|
|
exit();
|
||
|
|
if len(sys.argv) ==2:
|
||
|
|
safe().suspect(sys.argv[1]);
|
||
|
|
else:
|
||
|
|
exit()
|