<%@language="vbscript" codepage="936"%>
<!--#include file="virus_lib.asp"-->
<%
server.scripttimeout =90000
dim act
act=request.querystring("act")
const password = "totscan"
if act="login" then
if request.form("pwd") = password then session("login")="ok"
end if
%>
<!doctype html public "-//w3c//dtd html 4.01 transitional//en" "http://www.w3.org/tr/html4/loose.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=gb2312">
<title>asp木马扫描器</title>
<script language="javascript" type="text/javascript">
function confirmdel()
{
if(confirm("确认删除？并且不能恢复！"))
return true;
else
return false;
}
</script>
</head>
<body>
<div align="center"><h2>asp木马扫描器</h2></div>
<hr>
<%
if session("login") <> "ok" then
call loginform()
else
dim pathstr
if request("path")<>"" then
pathstr=request("path")
else
pathstr=server.mappath("/")
end if
response.write("<a href=""javascript:history.back();"">←返回</a><br>"&chr(10))
if act="scan" then
dim scanfiletype,suspect,scanfilenum,scanfoldernum,begintime,endtime,tmppath,report
scanfiletype = "asp,cer,asa,cdx"
suspect = 0
scanfilenum = 0
scanfoldernum =0
begintime = timer
response.write("<textarea name=""textarea"" style=""width:100%"" rows=""5"">"&chr(10))
response.write("扫描日志："&vbcrlf)
if(request.querystring("file")<>"") then
call scanfile(request.querystring("file"),"")
else
call scanfolder(pathstr)
end if
response.write("</textarea>")
call showresult()
endtime = timer
response.write "<br><font size=""2"">执行时间："&cstr(int(((endtime-begintime)*10000 )+0.5)/10)&"毫秒</font>"
elseif act="del" then
call delfile(request.querystring("file"))
response.write("<br><a href="""&request.servervariables("http_referer")&""">返回</a>")
elseif act="down" then
call download(request.querystring("file"))
else
call filelist(pathstr)
call scanform()
end if
end if
%>
<hr>
</body>
</html>
<%
sub loginform
%>
<form name="form1" method="post" action="?act=login">
<div align="center">password:
<input name="pwd" type="password" size="15">
<input type="submit" name="submit" value="提交">
</div>
</form>
<%
end sub
sub scanform
%>
<form action="?act=scan" method="post">
<input type="submit" value=" 全站扫描 " style="background:#fff;border:1px solid #999;padding:2px 2px 0px 2px;margin:4px;border-width:1px 3px 1px 3px" />
</form>
<%
end sub
'遍历处理path及其子目录所有文件
sub filelist(path)
set fso = createobject("scripting.filesystemobject")
if not fso.folderexists(path) then exit sub
set folders = fso.getfolder(path)'目录下所有对象
set files = folders.files
set subfolders = folders.subfolders
'列表文件夹
for each fl in subfolders
response.write("<a href=""?path="&path&"\"&fl.name&"""><img src=""images/folder.gif"" border=""0"">"&fl.name&"</a>"&chr(10))
response.write("<a href=""?act=scan&path="&path&"\"&fl.name&""">扫描</a><br>"&chr(10))
next
'列表文件
for each file_f in files
response.write("<img src=""images/file.gif"">"&file_f.name&""&chr(10))
response.write("<a href=""?act=scan&file="&path&"\"&file_f.name&""">扫描</a><br>"&chr(10))
next
set folders=nothing
set files=nothing
set subfolders=nothing
set fso = nothing
end sub
sub showresult
%>
<table width="100%" border="0" cellpadding="0" cellspacing="0" class="ccontent">
<tr>
<td class="cpanel" style="padding:5px;line-height:170%;clear:both;font-size:12px">
扫描完毕！一共检查文件夹<font color="#ff0000"><%=scanfoldernum%></font>个，文件<font color="#ff0000"><%=scanfilenum%></font>个，发现可疑点<font color="#ff0000"><%=suspect%></font>个
</td></tr></table>
<table width="100%" border="0" cellpadding="0" cellspacing="1" style="padding:5px; background-color:#666666;line-height:18px;clear:both;font-size:12px">
<tr>
<td width="30%" bgcolor="#ffffff">文件名称</td>
<td width="20%" bgcolor="#ffffff">特征码</td>
<td width="30%" bgcolor="#ffffff">描述</td>
<td width="20%" bgcolor="#ffffff">创建/修改时间</td>
</tr>
<p>
<%=report%>
<br/>
</p>
</table>
<%
end sub
'遍历处理path及其子目录所有文件
sub scanfolder(path)
dim folders,files,subfolders
scanfoldernum = scanfoldernum + 1
set fso = createobject("scripting.filesystemobject")
if not fso.folderexists(path) then exit sub
set folders = fso.getfolder(path)
set files = folders.files
for each myfile in files
if checkext(fso.getextensionname(path&"\"&myfile.name)) then
call scanfile(path&"\"&myfile.name, "")
end if
next
set subfolders = folders.subfolders
for each f1 in subfolders
scanfolder path&"\"&f1.name
next
set folders=nothing
set files=nothing
set subfolders=nothing
set fso = nothing
end sub
'检测文件
sub scanfile(filepath, infile)
dim fsos,ofile,filetxt,fileuri,vi
scanfilenum = scanfilenum + 1
response.write("扫描文件:"&filepath&vbcrlf)
response.flush()
if infile <> "" then
infiles = "该文件被<a href=""http://"&request.servervariables("server_name")&"\"&infile&""" target=_blank>"& infile & "</a>文件包含执行"
end if
set fsos = createobject("scripting.filesystemobject")
on error resume next
set ofile = fsos.opentextfile(filepath)
filetxt = lcase(ofile.readall())
if err then exit sub end if
if len(filetxt)>0 then
'特征码检查
fileuri = "<a href=""http://"&request.servervariables("server_name")&":"&request.servervariables("server_port")&"\"&replace(filepath,server.mappath("\")&"\","",1,1,1)&""" target=_blank>"&replace(filepath,server.mappath("\")&"\","",1,1,1)&"</a><br>"
fileuri=fileuri&"操作： <a href=""?act=del&file="&filepath&""" onclick=""return confirmdel()"">删除</a>"
fileuri=fileuri&" <a href=""?act=down&file="&filepath&""">下载</a>"
for vi=0 to ubound(virus,2)
if instr(filetxt, lcase(virus(0,vi))) then
report = report&"<tr bgcolor=""#ffffff""><td>"&fileuri&"</td><td>"&virus(0,vi)&"</td><td>"&virus(1,vi)&infiles&"</td><td>创建:"&getdatecreate(filepath)&"<br>修改:"&getdatemodify(filepath)&"</td></tr>"
suspect = suspect + 1
end if
next
for vi=0 to ubound(virus_regx,2)
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = virus_regx(0,vi)
if regex.test(filetxt) then
report = report&"<tr bgcolor=""#ffffff""><td>"&fileuri&"</td><td>"&virus_regx(0,vi)&"</td><td>"&virus_regx(1,vi)&infiles&"</td><td>创建:"&getdatecreate(filepath)&"<br>修改:"&getdatemodify(filepath)&"</td></tr>"
suspect = suspect + 1
end if
next
'check include file
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "<!--\s*#include\s*file\s*=\s*"".*"""
set matches = regex.execute(filetxt)
for each match in matches
tfile = replace(mid(match.value, instr(match.value, """") + 1, len(match.value) - instr(match.value, """") - 1),"/","\")
if not checkext(fsos.getextensionname(tfile)) then
call scanfile( mid(filepath,1,instrrev(filepath,"\"))&tfile, replace(filepath,server.mappath("\")&"\","",1,1,1) )
sumfiles = sumfiles + 1
end if
next
set matches = nothing
set regex = nothing
'check include virtual
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "<!--\s*#include\s*virtual\s*=\s*"".*"""
set matches = regex.execute(filetxt)
for each match in matches
tfile = replace(mid(match.value, instr(match.value, """") + 1, len(match.value) - instr(match.value, """") - 1),"/","\")
if not checkext(fsos.getextensionname(tfile)) then
call scanfile( server.mappath("\")&"\"&tfile, replace(filepath,server.mappath("\")&"\","",1,1,1) )
end if
next
set matches = nothing
set regex = nothing
'check server&.execute|transfer
set regex = new regexp
regex.ignorecase = true
regex.global = true
regex.pattern = "server.(exec"&"ute|transfer)([ \t]*|\()"".*"""
set matches = regex.execute(filetxt)
for each match in matches
tfile = replace(mid(match.value, instr(match.value, """") + 1, len(match.value) - instr(match.value, """") - 1),"/","\")
if not checkext(fsos.getextensionname(tfile)) then
call scanfile( mid(filepath,1,instrrev(filepath,"\"))&tfile, replace(filepath,server.mappath("\")&"\","",1,1,1) )
end if
next
set matches = nothing
set regex = nothing
end if
set ofile = nothing
set fsos = nothing
end sub
'检查文件后缀，如果与预定的匹配即返回true
function checkext(fileext)
if scanfiletype = "*" then checkext = true
ext = split(scanfiletype,",")
for i = 0 to ubound(ext)
if lcase(fileext) = ext(i) then
checkext = true
exit function
end if
next
end function
'删除文件
sub delfile(filepath)
set fso = server.createobject("scripting.filesystemobject")
if fso.fileexists(filepath) then
fso.deletefile(filepath)
response.write("<h2>成功删除文件:</h2>" &filepath)
else
response.write("<h2>删除失败!文件:"&filepath&"没有找到!</2>")
end if
set fso=nothing
end sub
'下载文件
sub download(filepath)
dim ostream
set fso = server.createobject("scripting.filesystemobject")
if fso.fileexists(filepath) then
set ostream=server.createobject("adodb.stream")
ostream.type=1
ostream.open
on error resume next
ostream.loadfromfile(filepath)
if err.number=0 then
response.addheader "content-disposition", "attachment; filename=" & fso.getfilename(filepath)
response.addheader "content-length", ostream.size
response.contenttype="bad/type" 'yeu cau ie hien hop thoai save-as
response.binarywrite ostream.read
end if
ostream.close
set ostream=nothing
end if
set fso=nothing
end sub
function getdatemodify(filepath)
dim s,days
set fso = createobject("scripting.filesystemobject")
set f = fso.getfile(filepath)
s = f.datelastmodified
set f = nothing
set fso = nothing
days=datediff("d",cdate(s),now())
if(days>-7 and days<7) then
s="<font color=""red"">"&s&"</font>"
end if
getdatemodify = s
end function
function getdatecreate(filepath)
dim s,days
set fso = createobject("scripting.filesystemobject")
set f = fso.getfile(filepath)
s = f.datecreated
set f = nothing
set fso = nothing
days=datediff("d",cdate(s),now())
if(days>-7 and days<7) then
s="<font color=""red"">"&s&"</font>"
end if
getdatecreate = s
end function
%>
我要评论
网友评论