完美扫描PHP特殊一句话后门【转】

 -1 || strpos($name,'%00') > -1 || strpos($name,'/') > -1) {
                        echo '特征  '.$path.'
'; flush(); ob_flush();
                } else {
                        if(!preg_match($exs,$name)) continue;
                        if(filesize($path) > 10000000) continue;
                        $fp = fopen($path,'r');
                        $code = fread($fp,filesize($path));
                        fclose($fp);
                        if(empty($code)) continue;
                        foreach($matches as $matche) {
                                $array = array();
                                preg_match($matche,$code,$array);
                                if(!$array) continue;
                                if(strpos($array[0],"\x24\x74\x68\x69\x73\x2d\x3e")) continue;
                                $len = strlen($array[0]);
                                if($len > 6 && $len < 200) {
                                        echo '特征  '.$path.'
';
                                        flush(); ob_flush(); break;
                                }
                        }
                        unset($code,$array);
                }
        }
        closedir($handle);
        return true;
}
 
function strdir($str) { return str_replace(array('\\','//','//'),array('/','/','/'),chop($str)); }
 
echo '
';
echo '路径: 
';
echo '后缀: 
';
echo '操作: 
';
echo '
';
 
if(file_exists($_POST['dir']) && $_POST['exs']) {
        $dir = strdir($_POST['dir'].'/');
        $exs = '/('.str_replace('.','\\.',$_POST['exs']).')/i';
        echo antivirus($dir,$exs,$matches) ? '
扫描完毕' : '
扫描中断';
}
?>

 

另一个版本

        
        


 

 
 -1 || strpos($name,'%00') > -1 || strpos($name,'/') > -1) {
                        echo '特征  '.$path.'
'; flush(); ob_flush();
                }elseif(weevelyshell($path)){
                        echo '特征  '.$path.'
'; flush(); ob_flush();
 
                } else {
                        if(!preg_match($exs,$name)) continue;
                        if(filesize($path) > 10000000) continue;
                        $fp = fopen($path,'r');
                        $code = fread($fp,filesize($path));
                        fclose($fp);
                        if(empty($code)) continue;
                        foreach($matches as $matche) {
                                $array = array();
                                preg_match($matche,$code,$array);
                                if(!$array) continue;
                                if(strpos($array[0],"\x24\x74\x68\x69\x73\x2d\x3e")) continue;
                                $len = strlen($array[0]);
                                if($len > 6 && $len < 200) {
                                        echo '特征  '.$path.'
';
                                        flush(); ob_flush(); break;
                                }
                        }
                        unset($code,$array);
                }
        }
        closedir($handle);
        return true;
}
 
function strdir($str) { return str_replace(array('\\','//','//'),array('/','/','/'),chop($str)); }
 
echo '
';
echo '路径: 
';
echo '后缀: 
';
echo '操作: 
';
echo '
';
 
if(file_exists($_POST['dir']) && $_POST['exs']) {
        $dir = strdir($_POST['dir'].'/');
        $exs = '/('.str_replace('.','\\.',$_POST['exs']).')/i';
        echo antivirus($dir,$exs,$matches) ? '
扫描完毕' : '
扫描中断';
}
?>