Finding Php Shell Scripts In Your Website

PHP vulnerabilities are the norm, there is not much that can be done to prevent uploads of malicious files on a PHP site when there are world writeable directories especially when your website is using a well known open source community driven software product to power your website.PHP shell code can usually be found in many websites around the web specially when the administrator does not know much about how to clean out the backdoors after a hack has been done.

Here is a simple bash shell script that will search your public_html directories for common method with a large number of files. It will dump the results to a file called "php_backdoors" which you can examine to determine what is and what is not a false positive.

To use this shell script just past this into a file called checker.sh in the directory before your public_html folder, then run it with the following command:
sh checker.sh

script :

#!/bin/bash cd public_html/ find . -type f \( -iname "1.*" -o -iname "sh.php" \) -print0 >> ../php_backdoors find . -type f \( -iname "*.php" -o -iname "*.inc" \) -print0 | xargs -0 -r grep -REn \ '(c99|r57|exif_read_data|extract|passthru|shell_ex ec|base64_decode|fopen|fclose|eval|Refresh|refresh |justrulz)' >> ../php_backdoors find . -type f \( -iname "*.gif" -o -iname "*.jpg" -o -iname "*.jpeg" \) -print0 | xargs -0 -r grep -REn \ '(eval|base64_decode)' >> ../image_backdoors 


Note: It is not the best but it is a good one for a start

Leave your comments for inspire us :)