+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Finding Php Shell Scripts In Your Website (/showthread.php?tid=4942025)
Finding Php Shell Scripts In Your Website - DarkMethods - Aug 9, 2015
Here is a simple bash shell script that will search your public_html directories for common file names as well as search all files for common methods used for shell scripts using the fastest possible method with a large number of files. It will dump the results to a file called "php_backdoors" which you can examine to determine what is and what is not a false positive.
To use this shell script just paste this into a file called checker.sh in the directory before your public_html folder, then run it with the following command:
sh checker.sh
Here it's code.
Code
#!/bin/bash
cd public_html/
find . -type f \( -iname "1.*" -o -iname "sh.php" \) -print0 >> ../php_backdoors
find . -type f \( -iname "*.php" -o -iname "*.inc" \) -print0 | xargs -0 -r grep -REn \
'(c99|r57|exif_read_data|extract|passthru|shell_ex ec|base64_decode|fopen|fclose|eval|Refresh|refresh |justrulz)' >> ../php_backdoors
find . -type f \( -iname "*.gif" -o -iname "*.jpg" -o -iname "*.jpeg" \) -print0 | xargs -0 -r grep -REn \
'(eval|base64_decode)' >> ../image_backdoors* - xorl - Aug 9, 2015
lol that's shittiest php shell detector i've ever seen
* - IDK - Aug 9, 2015
(Aug 9, 2015 10:15 AM)xorl Wrote: lol that's shittiest php shell detector i've ever seen
can't agree with you more 😏😏
* - Th3PonyWizard - Aug 9, 2015
(Aug 9, 2015 10:15 AM)xorl Wrote: lol that's shittiest php shell detector i've ever seenThis is scratching the top when you're scanning your site from outside the PHP system. This is not the correct way to approach this.
* - ras4sc - Aug 9, 2015
This will pick up the most common web shells.. nothing wrong with this
* - Manipulate - Aug 13, 2015
Let me just rename mt file to TO0R.php ok fixed now its undetectable (rofl)
* - ProblemSolva - Aug 14, 2015
This will only find skid shells, who doesnt know how to hide a shell.
* - Th3PonyWizard - Aug 14, 2015
Quote:justrulz
I don't get this one, halp
* - Disparity - Aug 15, 2015
(Aug 9, 2015 04:34 AM)DarkMethods Wrote: Here is a simple bash shell script that will search your public_html directories for common file names as well as search all files for common methods used for shell scripts using the fastest possible method with a large number of files.
It's fast because it has nothing to it.