当前位置: 首页 > 图文教程 > 网络编程 > ASP > 在线扫描探测检查asp站点木马后门的程序

ASP
Access 2000 数据库 80 万记录通用快速分页类
Microsoft JET Database Engine 错误 ''80004005'' 未指定的错误的完美解决方法
收藏的ASP常用的函数集
asp分页的一个类
ASP开发网页牢记注意事项
ASP下操作Excel技术总结分析
ASP数据岛操作类
ASP经典分页类
asp论坛在线人数统计研究
ASP调用SQL SERVER存储程序
asp输出bmp
ASP连接数据库的全能代码
ASP面向对象编程探讨及比较
web文件管理器的后续开发
一小偷类!!有兴趣的可以看看
利用ASP实现事务处理的方法
大数量查询分页显示 微软的解决办法
如何把ASP编写成DLL
asp实现树型结构
超级ASP大分页_我的类容我做主

No. « 56 57 58 59 »

技术文章搜索

关键字

ASP 中的 在线扫描探测检查asp站点木马后门的程序

出处:互联网   整理: 软晨网（RuanChen.com）   发布: 2009-09-13   浏览: 37 ::
收藏到网摘: n/a

复制代码 代码如下:

<%@LANGUAGE="VBSCRIPT" CODEPAGE="936"%>
<%
'设置登陆密码，使用前务必修改此密码
PASSWORD = "www.pifoo.com"
'其他扫描设置
DimFileExt = "asp,cer,asa,cdx" '文件类型扩展名列表，不在此列表的将不被扫描
maxfilesize= 51200 '500K，超过此文件大小的文件(一般不是木马)，将不被扫描
timeout=600 '如果扫描超过600秒，脚本将终止
'[email protected]=阿笨狗=飞云 修改于2006.07.07
'获取最新修改版本，请关注http://www.pifoo.com
'QQ:33323489 Email:[email protected] Guestbook:http://www.pifoo.com/lyb
dim Report
if request.QueryString("act")="login" then
if request.Form("pifoo") = PASSWORD then session("pifoo")="#)\'www.pifoo.com"
end if
%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<title>asp木马、后门探测器</title>
</head>
<body>
<%If Session("pifoo") <>"#)\'www.pifoo.com" then%>
<form name="form1" method="post" action="?act=login">
<div align="center">Password:
<input name="pifoo" type="password" size="15">
<input type="submit" name="Submit" value="提交">
</div>
</form>
<%
else
if request.QueryString("act")<>"scan" then
%>
<form action="?act=scan" method="post">
<b>填入你要检查的路径：</b>
<input name="path" type="text" style="border:1px solid #999" value="." size="30" />
<br>
* 网站根目录的相对路径，填"\"即检查整个网站；"."为程序所在目录
<br>
<br>
<input type="submit" value=" 开始扫描 " style="background:#fff;border:1px solid #999;padding:2px 2px 0px 2px;margin:4px;border-width:1px 3px 1px 3px" />
</form>
<%
else
server.ScriptTimeout = timeout
Sun = 0
SumFiles = 0
SumFolders = 1
if request.Form("path")="" then
response.Write("没有发现被入侵的迹象.")
response.End()
end if
timer1 = timer
if request.Form("path")="\" then
TmpPath = Server.MapPath("\")
elseif request.Form("path")="." then
TmpPath = Server.MapPath(".")
else
TmpPath = Server.MapPath("\")&"\"&request.Form("path")
end if
Call ShowAllFile(TmpPath)
%>
<table width="100%" border="0" cellpadding="0" cellspacing="0" class="CContent">
<tr>
<th>ASP木马、后门、漏洞扫描探测
</tr>
<tr>
<td class="CPanel" style="padding:5px;line-height:170%;clear:both;font-size:12px">
<div id="updateInfo" style="background:ffffe1;border:1px solid #89441f;padding:4px;display:none"></div>
扫描完毕！一共检查文件夹<font color="#FF0000"><%=SumFolders%></font>个，文件<font color="#FF0000"><%=SumFiles%></font>个，发现可疑点<font color="#FF0000"><%=Sun%></font>个
<table width="100%" border="0" cellpadding="0" cellspacing="0">
<tr>
<td valign="top">
<table width="100%" border="1" cellpadding="0" cellspacing="0" style="padding:5px;line-height:170%;clear:both;font-size:12px">
<tr>
<td width="20%">文件相对路径</td>
<td width="20%">特征码</td>
<td width="40%">描述</td>
<td width="20%">创建/修改时间</td>
</tr>
<p>
<%=Report%>
<br/></p>
</table></td>
</tr>
</table>
</td></tr></table>
<%
timer2 = timer
thetime=cstr(int(((timer2-timer1)*10000 )+0.5)/10)
response.write "<br><font size=""2"">本页执行共用了"&thetime&"毫秒</font>"
end if
end if
%>
<hr>
<div align="center"><br>
Modified by <a href="http://www.pifoo.com" target=_blank>jspadmin</a> at 2006.07.07
</div>
</body>
</html>
<%
'遍历处理path及其子目录所有文件
Sub ShowAllFile(Path)
Set FSO = createObject("Scripting.FileSystemObject")
if not fso.FolderExists(path) then exit sub
Set f = FSO.GetFolder(Path)
Set fc2 = f.files
For Each myfile in fc2
If CheckExt(FSO.GetExtensionName(path&"\"&myfile.name)) and (myfile.size<=maxfilesize) Then
Call ScanFile(Path&Temp&"\"&myfile.name, "")
SumFiles = SumFiles + 1
End If
Next
Set fc = f.SubFolders
For Each f1 in fc
ShowAllFile path&"\"&f1.name
SumFolders = SumFolders + 1
Next
Set FSO = Nothing
End Sub
'检测文件
Sub ScanFile(FilePath, InFile)
If InFile <> "" Then
Infiles = "该文件被<a href=""http://"&Request.Servervariables("server_name")&"\"&InFile&""" target=_blank>"& InFile & "</a>文件包含执行"
End If
Set FSOs = createObject("Scripting.FileSystemObject")
on error resume next
set ofile = fsos.OpenTextFile(FilePath)
filetxt = Lcase(ofile.readall())
If err Then Exit Sub end if
if len(filetxt)>0 then
'特征码检查
temp = "<a href=""http://"&Request.Servervariables("server_name")&"\"&replace(FilePath,server.MapPath("\")&"\","",1,1,1)&""" target=_blank>"&replace(FilePath,server.MapPath("\")&"\","",1,1,1)&"</a>"
'Check "WScr"&DoMyBest&"ipt.Shell"
If instr( filetxt, Lcase("WScr"&DoMyBest&"ipt.Shell") ) or Instr( filetxt, Lcase("clsid:72C24DD5-D70A"&DoMyBest&"-438B-8A42-98424B88AFB8") ) then
Report = Report&"<tr><td>"&temp&"</td><td>WScr"&DoMyBest&"ipt.Shell 或者 clsid:72C24DD5-D70A"&DoMyBest&"-438B-8A42-98424B88AFB8</td><td>危险组件，一般被ASP木马利用。"&infiles&"</td><td>"&GetDatecreate(filepath)&"<br>"&GetDatemodify(filepath)&"</td></tr>"
Sun = Sun + 1
End if
'Check "She"&DoMyBest&"ll.Application"
If instr( filetxt, Lcase("She"&DoMyBest&"ll.Application") ) or Instr( filetxt, Lcase("clsid:13709620-C27"&DoMyBest&"9-11CE-A49E-444553540000") ) then
Report = Report&"<tr><td>"&temp&"</td><td>She"&DoMyBest&"ll.Application 或者 clsid:13709620-C27"&DoMyBest&"9-11CE-A49E-444553540000</td><td>危险组件，一般被ASP木马利用。"&infiles&"</td><td>"&GetDatecreate(filepath)&"<br>"&GetDatemodify(filepath)&"</td></tr>"
Sun = Sun + 1
End If
'Check .Encode
Set regEx = New RegExp
regEx.IgnoreCase = True
regEx.Global = True
regEx.Pattern = "@\s*LANGUAGE\s*=\s*[""]?\s*(vbscript|jscript|javascript).encode\b"
If regEx.Test(filetxt) Then
Report = Report&"<tr><td>"&temp&"</td><td>(vbscript|jscript|javascript).Encode</td><td>似乎脚本被加密了，一般ASP文件是不会加密的。"&infiles&"</td><td>"&GetDatecreate(filepath)&"<br>"&GetDatemodify(filepath)&"</td></tr>"
Sun = Sun + 1
End If
'Check my ASP backdoor :(
regEx.Pattern = "\bEv"&"al\b"
If regEx.Test(filetxt) Then
Report = Report&"<tr><td>"&temp&"</td><td>Ev"&"al</td><td>e"&"val()函数可以执行任意ASP代码，被一些后门利用。其形式一般是：ev"&"al(X)<br>但是javascript代码中也可以使用，有可能是误报。"&infiles&"</td><td>"&GetDatecreate(filepath)&"<br>"&GetDatemodify(filepath)&"</td></tr>"
Sun = Sun + 1
End If
'Check exe&cute backdoor
regEx.Pattern = "[^.]\bExe"&"cute\b"
If regEx.Test(filetxt) Then
Report = Report&"<tr><td>"&temp&"</td><td>Exec"&"ute</td><td>e"&"xecute()函数可以执行任意ASP代码，被一些后门利用。其形式一般是：ex"&"ecute(X)。<br>"&infiles&"</td><td>"&GetDatecreate(filepath)&"<br>"&GetDatemodify(filepath)&"</td></tr>"
Sun = Sun + 1
End If
Set regEx = Nothing
'检查包含文件
Set regEx = New RegExp
regEx.IgnoreCase = True
regEx.Global = True
regEx.Pattern = "<!--\s*#include\s*file\s*=\s*"".*"""
Set Matches = regEx.Execute(filetxt)
For Each Match in Matches
tFile = Replace(Mid(Match.Value, Instr(Match.Value, """") + 1, Len(Match.Value) - Instr(Match.Value, """") - 1),"/","\")
If Not CheckExt(FSOs.GetExtensionName(tFile)) Then
Call ScanFile( Mid(FilePath,1,InStrRev(FilePath,"\"))&tFile, replace(FilePath,server.MapPath("\")&"\","",1,1,1) )
SumFiles = SumFiles + 1
End If
Next
Set Matches = Nothing
Set regEx = Nothing
'检查虚拟目录
Set regEx = New RegExp
regEx.IgnoreCase = True
regEx.Global = True
regEx.Pattern = "<!--\s*#include\s*virtual\s*=\s*"".*"""
Set Matches = regEx.Execute(filetxt)
For Each Match in Matches
tFile = Replace(Mid(Match.Value, Instr(Match.Value, """") + 1, Len(Match.Value) - Instr(Match.Value, """") - 1),"/","\")
If Not CheckExt(FSOs.GetExtensionName(tFile)) Then
Call ScanFile( Server.MapPath("\")&"\"&tFile, replace(FilePath,server.MapPath("\")&"\","",1,1,1) )
SumFiles = SumFiles + 1
End If
Next
Set Matches = Nothing
Set regEx = Nothing
'检查特殊命令：Server&.Execute|Transfer
Set regEx = New RegExp
regEx.IgnoreCase = True
regEx.Global = True
regEx.Pattern = "Server.(Exec"&"ute|Transfer)([ \t]*|\()"".*"""
Set Matches = regEx.Execute(filetxt)
For Each Match in Matches
tFile = Replace(Mid(Match.Value, Instr(Match.Value, """") + 1, Len(Match.Value) - Instr(Match.Value, """") - 1),"/","\")
If Not CheckExt(FSOs.GetExtensionName(tFile)) Then
Call ScanFile( Mid(FilePath,1,InStrRev(FilePath,"\"))&tFile, replace(FilePath,server.MapPath("\")&"\","",1,1,1) )
SumFiles = SumFiles + 1
End If
Next
Set Matches = Nothing
Set regEx = Nothing
'Check Server&.Execute|Transfer
Set regEx = New RegExp
regEx.IgnoreCase = True
regEx.Global = True
regEx.Pattern = "Server.(Exec"&"ute|Transfer)([ \t]*|\()[^""]\)"
If regEx.Test(filetxt) Then
Report = Report&"<tr><td>"&temp&"</td><td>Server.Exec"&"ute</td><td>不能跟踪检查Server.e"&"xecute()函数执行的文件。请管理员自行检查。<br>"&infiles&"</td><td>"&GetDatecreate(filepath)&"<br>"&GetDatemodify(filepath)&"</td></tr>"
Sun = Sun + 1
End If
Set Matches = Nothing
Set regEx = Nothing
'检查createobject命令 Crea"&"teObject
Set regEx = New RegExp
regEx.IgnoreCase = True
regEx.Global = True
regEx.Pattern = "createO"&"bject[ |\t]*\(.*\)"
Set Matches = regEx.Execute(filetxt)
For Each Match in Matches
If Instr(Match.Value, "&") or Instr(Match.Value, "+") or Instr(Match.Value, """") = 0 or Instr(Match.Value, "(") <> InStrRev(Match.Value, "(") Then
Report = Report&"<tr><td>"&temp&"</td><td>Creat"&"eObject</td><td>Crea"&"teObject函数使用了变形技术，仔细复查。"&infiles&"</td><td>"&GetDatecreate(filepath)&"<br>"&GetDatemodify(filepath)&"</td></tr>"
Sun = Sun + 1
exit sub
End If
Next
Set Matches = Nothing
Set regEx = Nothing
end if
set ofile = nothing
set fsos = nothing
End Sub
'检查文件后缀，如果与预定的匹配即返回TRUE
Function CheckExt(FileExt)
If DimFileExt = "*" Then CheckExt = True
Ext = Split(DimFileExt,",")
For i = 0 To Ubound(Ext)
If Lcase(FileExt) = Ext(i) Then
CheckExt = True
Exit Function
End If
Next
End Function
Function GetDatemodify(filepath)
Set fso = createObject("Scripting.FileSystemObject")
Set f = fso.GetFile(filepath)
s = f.DateLastModified
set f = nothing
set fso = nothing
GetDatemodify = s
End Function
Function GetDatecreate(filepath)
Set fso = createObject("Scripting.FileSystemObject")
Set f = fso.GetFile(filepath)
s = f.Datecreated
set f = nothing
set fso = nothing
GetDatecreate = s
End Function
%>

【asp木马探测器】-在线扫描探测检查asp站点木马后门的程序

可以在线扫描检查探测站点内的所有asp程序代码，检测代码中是否含有危险代码

目前检测的特征码有：CreateObject、Execute、Shell.Application、WScript.Shell、Eval、include......等。

对程序的改进是：增加扩展名后缀列表自定义、扫描文件大小限制、扫描超时限制、session验证改复杂了一点点......

具体请自己打开原始代码查看。

使用后，要么及时删除，要么将登陆密码改掉，尽量改复杂点。（虽然这个程序不会直接提供在线打开文件的功能，但仍然有可能被hacker利用）

准备下一个修改版本加入检查iframe特征码的功能，目前太多站点都是被人挂了iframe，当然，那只是表现，具体漏洞根源还是在程序或其他方面。

点击这里下载asp木马探测器 [注意：解压密码和默认登陆密码都是www.pifoo.com]

原作者：雷客图
jspadmin=阿笨狗=飞云 修改于2006.07.07
'获取最新修改版本，请关注http://www.pifoo.com
'QQ:33323489 Email:[email protected] Guestbook:http://www.pifoo.com/lyb