在线扫描探测检查asp站点木马后门的程序


答案：[复制此代码]CODE:

<%@LANGUAGE="VBSCRIPT" CODEPAGE="936"%> 
<% 
'设置登陆密码，使用前务必修改此密码 
PASSWORD = "www.pifoo.com" 
'其他扫描设置 
DimFileExt = "asp,cer,asa,cdx"  '文件类型扩展名列表，不在此列表的将不被扫描 
maxfilesize= 51200 '500K，超过此文件大小的文件(一般不是木马)，将不被扫描 
timeout=600 '如果扫描超过600秒，脚本将终止 
'jspadmin@asp.web.csdn=阿笨狗=飞云 修改于2006.07.07 
'获取最新修改版本，请关注http://www.pifoo.com 
'QQ:33323489 Email:subaoliang@etang.com Guestbook:http://www.pifoo.com/lyb 
dim Report 
if request.QueryString("act")="login" then 
if request.Form("pifoo") = PASSWORD then session("pifoo")="#)\'www.pifoo.com" 
end if 
%> 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> 
<html> 
<head> 
<meta http-equiv="Content-Type" content="text/html; charset=gb2312"> 
<title>asp木马、后门探测器</title> 
</head> 
<body> 
<%If Session("pifoo") <>"#)\'www.pifoo.com" then%> 
<form name="form1" method="post" action="?act=login"> 
<div align="center">Password:  
<input name="pifoo" type="password" size="15">  
<input type="submit" name="Submit" value="提交"> 
</div> 
</form> 
<% 
else 
if request.QueryString("act")<>"scan" then 
%> 
<form action="?act=scan" method="post"> 
<b>填入你要检查的路径：</b> 
<input name="path" type="text" style="border:1px solid #999" value="." size="30" /> 
<br> 
* 网站根目录的相对路径，填"\"即检查整个网站；"."为程序所在目录 
<br> 
<br> 
<input type="submit" value=" 开始扫描 " style="background:#fff;border:1px solid #999;padding:2px 2px 0px 2px;margin:4px;border-width:1px 3px 1px 3px" /> 
</form> 
<% 
else 
server.ScriptTimeout = timeout 
Sun = 0 
SumFiles = 0 
SumFolders = 1 
if request.Form("path")="" then 
response.Write("没有发现被入侵的迹象.") 
response.End() 
end if 
timer1 = timer 
if request.Form("path")="\" then 
TmpPath = Server.MapPath("\") 
elseif request.Form("path")="." then 
TmpPath = Server.MapPath(".") 
else 
TmpPath = Server.MapPath("\")&"\"&request.Form("path") 
end if 
Call ShowAllFile(TmpPath) 
%> 
<table width="100%" border="0" cellpadding="0" cellspacing="0" class="CContent"> 
<tr> 
<th>ASP木马、后门、漏洞扫描探测 
</tr> 
<tr> 
<td class="CPanel" style="padding:5px;line-height:170%;clear:both;font-size:12px"> 
<div id="updateInfo" style="background:ffffe1;border:1px solid #89441f;padding:4px;display:none"></div> 
扫描完毕！一共检查文件夹<font color="#FF0000"><%=SumFolders%></font>个，文件<font color="#FF0000"><%=SumFiles%></font>个，发现可疑点<font color="#FF0000"><%=Sun%></font>个 
<table width="100%" border="0" cellpadding="0" cellspacing="0"> 
<tr> 
<td valign="top"> 
<table width="100%" border="1" cellpadding="0" cellspacing="0" style="padding:5px;line-height:170%;clear:both;font-size:12px"> 
<tr> 
<td width="20%">文件相对路径</td> 
<td width="20%">特征码</td> 
<td width="40%">描述</td> 
<td width="20%">创建/修改时间</td> 
</tr> 
<p> 
<%=Report%> 
<br/></p> 
</table></td> 
</tr> 
</table> 
</td></tr></table> 
<% 
timer2 = timer 
thetime=cstr(int(((timer2-timer1)*10000 )+0.5)/10) 
response.write "<br><font size=""2"">本页执行共用了"&thetime&"毫秒</font>" 
end if 
end if 
%> 
<hr> 
<div align="center"><br> 
Modified by <a href=></div> 
</body> 
</html> 
<% 
'遍历处理path及其子目录所有文件 
Sub ShowAllFile(Path) 
Set FSO = createObject("Scripting.FileSystemObject") 
if not fso.FolderExists(path) then exit sub 
Set f = FSO.GetFolder(Path) 
Set fc2 = f.files 
For Each myfile in fc2 
If CheckExt(FSO.GetExtensionName(path&"\"&myfile.name)) and (myfile.size<=maxfilesize) Then 
Call ScanFile(Path&Temp&"\"&myfile.name, "") 
SumFiles = SumFiles + 1 
End If 
Next 
Set fc = f.SubFolders 
For Each f1 in fc 
ShowAllFile path&"\"&f1.name 
SumFolders = SumFolders + 1 
Next 
Set FSO = Nothing 
End Sub 
'检测文件 
Sub ScanFile(FilePath, InFile) 
If InFile <> "" Then 
Infiles = "该文件被<a href=>End If 
Set FSOs = createObject("Scripting.FileSystemObject") 
on error resume next 
set ofile = fsos.OpenTextFile(FilePath) 
filetxt = Lcase(ofile.readall()) 
If err Then Exit Sub end if 
if len(filetxt)>0 then 
'特征码检查 
temp = "<a href=>'Check "WScr"&DoMyBest&"ipt.Shell" 
If instr( filetxt, Lcase("WScr"&DoMyBest&"ipt.Shell") ) or Instr( filetxt, Lcase("clsid:72C24DD5-D70A"&DoMyBest&"-438B-8A42-98424B88AFB8") ) then 
Report = Report&"<tr><td>"&temp&"</td><td>WScr"&DoMyBest&"ipt.Shell 或者 clsid:72C24DD5-D70A"&DoMyBest&"-438B-8A42-98424B88AFB8</td><td>危险组件，一般被ASP木马利用。"&infiles&"</td><td>"&GetDatecreate(filepath)&"<br>"&GetDatemodify(filepath)&"</td></tr>" 
Sun = Sun + 1 
End if 
'Check "She"&DoMyBest&"ll.Application" 
If instr( filetxt, Lcase("She"&DoMyBest&"ll.Application") ) or Instr( filetxt, Lcase("clsid:13709620-C27"&DoMyBest&"9-11CE-A49E-444553540000") ) then 
Report = Report&"<tr><td>"&temp&"</td><td>She"&DoMyBest&"ll.Application 或者 clsid:13709620-C27"&DoMyBest&"9-11CE-A49E-444553540000</td><td>危险组件，一般被ASP木马利用。"&infiles&"</td><td>"&GetDatecreate(filepath)&"<br>"&GetDatemodify(filepath)&"</td></tr>" 
Sun = Sun + 1 
End If 
'Check .Encode 
Set regEx = New RegExp 
regEx.IgnoreCase = True 
regEx.Global = True 
regEx.Pattern = "@\s*LANGUAGE\s*=\s*[""]?\s*(vbscript|jscript|javascript).encode\b" 
If regEx.Test(filetxt) Then 
Report = Report&"<tr><td>"&temp&"</td><td>(vbscript|jscript|javascript).Encode</td><td>似乎脚本被加密了，一般ASP文件是不会加密的。"&infiles&"</td><td>"&GetDatecreate(filepath)&"<br>"&GetDatemodify(filepath)&"</td></tr>" 
Sun = Sun + 1 
End If 
'Check my ASP backdoor :( 
regEx.Pattern = "\bEv"&"al\b" 
If regEx.Test(filetxt) Then 
Report = Report&"<tr><td>"&temp&"</td><td>Ev"&"al</td><td>e"&"val()函数可以执行任意ASP代码，被一些后门利用。其形式一般是：ev"&"al(X)<br>但是javascript代码中也可以使用，有可能是误报。"&infiles&"</td><td>"&GetDatecreate(filepath)&"<br>"&GetDatemodify(filepath)&"</td></tr>" 
Sun = Sun + 1 
End If 
'Check exe&cute backdoor 
regEx.Pattern = "[^.]\bExe"&"cute\b" 
If regEx.Test(filetxt) Then 
Report = Report&"<tr><td>"&temp&"</td><td>Exec"&"ute</td><td>e"&"xecute()函数可以执行任意ASP代码，被一些后门利用。其形式一般是：ex"&"ecute(X)。<br>"&infiles&"</td><td>"&GetDatecre
上一个：flash和asp分页的一点心得与flash脚本
下一个：用asp实现批量删除bak文件
更多图片编程知识: