dedecms织梦内容管理系统  
 
首页 | 方舟产品 | 系统优化 | 硬件系统 | 软件系统 | 网络系统 | 无盘网络 | 软件下载 | 杀毒防黑 | 专题 | 会员中心 | 方舟论坛
  当前位置:方舟系统站>杀毒防黑>黑客技术>入门教程>文章内容
黑客资源之网站程序安全分析器VB源码
来源: 作者: 发布时间:2007-03-22  


本程序通杀:

ASP、ASPX、PHP、CGI、JSP、VBS等脚本WebShell,并能查出99%加密过的脚本WebShell。后来发现,精度越高误杀越高,基本做到宁误扫三千不放过一马!

其实是利用串判断,原理很简单。有很多人向偶要代码,想到人家ScanWebshell都贡献出来了,偶要是不贡献出来就不厚道咯。以下是全部代码。
Private Declare Function GetWindowLong Lib "user32"
Alias "GetWindowLongA" (ByVal hwnd As Long, ByVal nIndex As Long) As Long
Private Declare Function SetWindowLong Lib "user32" Alias "SetWindowLongA" (ByVal hwnd As
Long, ByVal nIndex As Long, ByVal dwNewLong As Long) As Long
Private Declare Function SetLayeredWindowAttributes Lib "user32" (ByVal hwnd As Long,
ByVal crKey As Long, ByVal bAlpha As Byte, ByVal dwFlags As Long) As Long
Private Const WS_EX_LAYERED = &H80000
Private Const GWL_EXSTYLE = (-20)
Private Const LWA_ALPHA = &H2
Private Const LWA_COLORKEY = &H1
Private Declare Function ReleaseCapture Lib "user32" () As Long
Private Declare Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal hwnd As
Long, ByVal wMsg As Long, ByVal wParam As Long, lParam As Any) As Long
Private Const HTCAPTION = 2
Private Const WM_NCLBUTTONDOWN = &HA1
Private Declare Function timeGetTime Lib "winmm.dll" () As Long
Private Declare Sub InitCommonControls Lib "comctl32.dll" ()
Dim SuJu1 As Long
Dim Faxian As String
Dim FaJs As String
Private Declare Function FindFirstFile Lib "kernel32" Alias "FindFirstFileA" (ByVal
lpFileName As String, lpFindFileData As WIN32_FIND_DATA) As Long
Private Declare Function FindNextFile Lib "kernel32" Alias "FindNextFileA" (ByVal
hFindFile As Long, lpFindFileData As WIN32_FIND_DATA) As Long
Private Declare Function GetFileAttributes Lib "kernel32" Alias "GetFileAttributesA"
(ByVal lpFileName As String) As Long
Private Declare Function FindClose Lib "kernel32" (ByVal hFindFile As Long) As Long
Const MAX_PATH = 260
Const MAXDWORD = &HFFFF
Const INVALID_HANDLE_VALUE = -1
Const FILE_ATTRIBUTE_ARCHIVE = &H20
Const FILE_ATTRIBUTE_DIRECTORY = &H10
Const FILE_ATTRIBUTE_HIDDEN = &H2
Const FILE_ATTRIBUTE_NORMAL = &H80
Const FILE_ATTRIBUTE_READONLY = &H1
Const FILE_ATTRIBUTE_SYSTEM = &H4
Const FILE_ATTRIBUTE_TEMPORARY = &H100
Private Declare Function SHBrowseForFolder Lib "shell32" (lpbi As BrowseInfo) As Long
Private Declare Function SHGetPathFromIDList Lib "shell32.dll"
Alias "SHGetPathFromIDListA" (ByVal pIdl As Long, ByVal pszPath As String) As Long
Private Type BrowseInfo
hwndOwner As Long
piDLroot As Long
pszdisplayName As String
lpsztitle As String
ulFlags As Long
lpfncallback As Long
lParam As Long
iImage As Long
End Type
Private Type FILETIME
  dwLowDateTime As Long
  dwHighDateTime As Long
End Type
Private Type WIN32_FIND_DATA
  dwFileAttributes As Long
  ftCreationTime As FILETIME
  ftLastAccessTime As FILETIME
  ftLastWriteTime As FILETIME
  nFileSizeHigh As Long
  nFileSizeLow As Long
  dwReserved0 As Long
  dwReserved1 As Long
  cFileName As String * MAX_PATH
  cAlternate As String * 14
End Type
Private Sub Form_MouseDown(Button As Integer, Shift As Integer, X As Single, Y As Single)
ReleaseCapture
SendMessage hwnd, WM_NCLBUTTONDOWN, HTCAPTION, 0&
End Sub
Private Sub Form_Initialize()
  InitCommonControls
  Dim rtn As Long
  rtn = GetWindowLong(hwnd, GWL_EXSTYLE)
  rtn = rtn Or WS_EX_LAYERED
  SetWindowLong hwnd, GWL_EXSTYLE, rtn
  SetLayeredWindowAttributes hwnd, &HFF00FF, 0, LWA_COLORKEY
End Sub
Sub YS()
  Dim Savetime As Double
  Savetime = timeGetTime
  While timeGetTime < Savetime + 200
  DoEvents
  Wend
End Sub
Private Sub Image1_MouseDown(Button As Integer, Shift As Integer, X As Single, Y As
Single)
Me.Image1.Visible = False
Me.Image2.Visible = True
YS
WindowState = 1
Me.Image1.Visible = True
Me.Image2.Visible = False
End Sub
Private Sub Image4_MouseDown(Button As Integer, Shift As Integer, X As Single, Y As
Single)
Me.Image4.Visible = False
Me.Image3.Visible = True
YS
End
End Sub
Private Sub Command1_Click()
Dim bi As BrowseInfo
Dim folderid As Long
Dim pb As String
With bi
.hwndOwner = Me.hwnd
.lpsztitle = "选择查杀的文件夹:"
.ulFlags = 3
End With
folderid = SHBrowseForFolder(bi)
If folderid = 0 Then Exit Sub
pb = String$(260, 0)
SHGetPathFromIDList folderid, pb
pb = Left$(pb, InStr(pb, vbNullChar) - 1)
Text1.Text = pb
End Sub
Function StripNulls(OriginalStr As String) As String
  If (InStr(OriginalStr, Chr(0)) > 0) Then
  OriginalStr = Left(OriginalStr, InStr(OriginalStr, Chr(0)) - 1)
  End If
  StripNulls = OriginalStr
End Function

Function FindFilesAPI(path As String, SearchStr As String)
  Dim FileName As String
  Dim DirName As String
  Dim dirNames() As String
  Dim nDir As Integer
  Dim i As Integer
  Dim hSearch As Long
  Dim WFD As WIN32_FIND_DATA
  Dim Cont As Integer
  If Right(path, 1) <> "\" Then path = path & "\"
 
  nDir = 0
  ReDim dirNames(nDir)
  Cont = True
  hSearch = FindFirstFile(path & "*.*", WFD)
  If hSearch <> INVALID_HANDLE_VALUE Then
  Do While Cont
  DirName = StripNulls(WFD.cFileName)
  If (DirName <> ".") And (DirName <> "..") Then
  If GetFileAttributes(path & DirName) And FILE_ATTRIBUTE_DIRECTORY Then
  dirNames(nDir) = DirName
  nDir = nDir + 1
  ReDim Preserve dirNames(nDir)
  End If
  End If
  Cont = FindNextFile(hSearch, WFD)
  DoEvents
  Loop
 
  Cont = FindClose(hSearch)
  End If
  hSearch = FindFirstFile(path & SearchStr, WFD)
  Cont = True
  If hSearch <> INVALID_HANDLE_VALUE Then
  While Cont
  FileName = StripNulls(WFD.cFileName)
  If (FileName <> ".") And (FileName <> "..") Then
 
  SuJu1 = SuJu1 + 1
 

  Dim strFileContent As String
  Dim strTemp As String
 
  If Dir(path & FileName) <> "" Then
  Open path & FileName For Input As #1
  While Not EOF(1)
  Line Input #1, strTemp
 
  If InStr(1, strTemp, "WScr" & DoMyBest & "ipt.Shell", vbTextCompare) Or InStr(1,
strTemp, "clsid:72C24DD5-D70A" & DoMyBest & "-438B-8A42-98424B88AFB8", vbTextCompare)
Then
  List1.AddItem "发现 " & FileName & " 包含危险组件! " & " 安全评估: 危险度极高!"
  List1.AddItem "描述:一般被ASP木马利用来获取CMD SHELL 序列:1"
  Faxian = "发现危险"
  End If
 
  If InStr(1, strTemp, "She" & DoMyBest & "ll.Application", vbTextCompare) Or InStr
(1, strTemp, "clsid:13709620-C27" & DoMyBest & "9-11CE-A49E-444553540000", vbTextCompare)
Then
  List1.AddItem "发现 " & FileName & " 包含危险组件! " & " 安全评估: 危险度极高!"
  List1.AddItem "描述:一般被ASP木马利用来获取系统信息 序列:2"
  Faxian = "发现危险"
  End If
 
  If InStr(1, strTemp, "<%@ LANGUAGE = VBScript.Encode %>", vbTextCompare) Or InStr
(1, strTemp, "#@", vbTextCompare) Then
  List1.AddItem "发现 " & FileName & " 文件被加密! " & " 安全评估: 危险度极高!"
  List1.AddItem "描述:此文件被加过密!一般安全的程序是不可能加密的!极有可能是木马.图
片格式文件可能会误杀请详细检查 序列:3"
  Faxian = "发现危险"
  End If
 
  If InStr(1, strTemp, "clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B", vbTextCompare)
Or InStr(1, strTemp, "clsid:0D43FE01-F093-11CF-8940-00A0C9054228", vbTextCompare) Then
  List1.AddItem "发现 " & FileName & " 包含危险组件! " & " 安全评估: 危险度高!"
  List1.AddItem "描述:此文件包含文件读写指令.如非上传组件.请删除! 序列:4"
  Faxian = "发现危险"
  End If
 
  If InStr(1, strTemp, "上传组件", vbTextCompare) Or InStr(1, strTemp, "Upload",
 vbTextCompare) Then
  List1.AddItem "发现 " & FileName & " 包含危险特征! " & " 安全评估: 危险度中!(未
知)"
  List1.AddItem "描述:此文件包含上传组件或上传文件的专用串.请检查是否合法. 序列:5"
  Faxian = "发现危险"
  End If
 
  If InStr(1, strTemp, "FSO", vbTextCompare) Or InStr(1, strTemp, "<SCRIPT
RUNAT=SERVER LANGUAGE=JAVASCRIPT>", vbTextCompare) Then
  List1.AddItem "发现 " & FileName & " 包含危险特征! " & " 安全评估: 危险度高!(未
知)"
  List1.AddItem "描述:此文件包含木马执行特征.请检查是否合法. 序列:6"
  Faxian = "发现危险"
  End If
 
  If InStr(1, strTemp, "execute request", vbTextCompare) Or InStr(1, strTemp, "FQAAAA",
 vbTextCompare) Then
  List1.AddItem "发现 " & FileName & " 包含危险特征! " & " 安全评估: 危险度极高!"
  List1.AddItem "描述:此文件包含一句话木马.请手工分析删除! 序列:7"
  Faxian = "发现危险"
  End If
 
  If InStr(1, strTemp, "java.io", vbTextCompare) Or InStr(1, strTemp, "java.util",
vbTextCompare) Then
  List1.AddItem "发现 " & FileName & " 包含危险组件! " & " 安全评估: 危险度极高!"
  List1.AddItem "描述:此文件包含JSP木马.请删除! 序列:8"
  Faxian = "发现危险"
  End If
 
  If InStr(1, strTemp, "System.IO", vbTextCompare) Or InStr(1,
strTemp, "System.Diagnostics", vbTextCompare) Then
  List1.AddItem "发现 " & FileName & " 包含危险组件! " & " 安全评估: 危险度极高!"
  List1.AddItem "描述:此文件包含ASP.NET木马.请删除! 序列:9"
  Faxian = "发现危险"
  End If

  If InStr(1, strTemp, "TBNnGMfflrqBF", vbTextCompare) Or InStr(1, strTemp, "POST
[cmd]", vbTextCompare) Then
  List1.AddItem "发现 " & FileName & " 包含危险组件! " & " 安全评估: 危险度高!"
  List1.AddItem "描述:此文件包含PHP木马.请删除! 序列:10"
  Faxian = "发现危险"
  End If
 
  If InStr(1, strTemp, "务服", vbTextCompare) Or InStr(1, strTemp, "琳",
vbTextCompare) Then
  List1.AddItem "发现 " & FileName & " 文件被加密! " & " 安全评估: 危险度极高!"
  List1.AddItem "描述:此文件有可能被加过密!一般安全的程序是不可能加密的!极有可能是木
马 序列:11"
  Faxian = "发现危险"
  End If
 
  If InStr(1, strTemp, "System.Net.Sockets", vbTextCompare) Or InStr(1, strTemp,
"UnEncode=temp", vbTextCompare) Then
  List1.AddItem "发现 " & FileName & " 包含危险特征! " & " 安全评估: 危险度极高!"
  List1.AddItem "描述:此文件包含木马执行特征.请检查是否合法 序列:12"
  Faxian = "发现危险"
  End If
 
  If InStr(1, strTemp, "execute request(", vbTextCompare) Or InStr(1, strTemp, "vbs&",
vbTextCompare) Then
  List1.AddItem "发现 " & FileName & " 文件被加密! " & " 安全评估: 危险度极高!"
  List1.AddItem "描述:此文件有可能被加过密!一般安全的程序是不可能加密的!极有可能是木
马 序列:13"
  Faxian = "发现危险"
  End If
 
  If InStr(1, strTemp, "MSXML2.XMLHTTP", vbTextCompare) Or InStr(1, strTemp, "127.0.0.1",
vbTextCompare) Then
  List1.AddItem "发现 " & FileName & " 包含危险组件! " & " 安全评估: 危险度高!"
  List1.AddItem "描述:此文件包含木马执行特征.请检查是否合法 序列:14"
  Faxian = "发现危险"
  End If
 
  If InStr(1, strTemp, "Encoding.ASCII", vbTextCompare) Or InStr(1, strTemp, "cmd",
vbTextCompare) Then
  List1.AddItem "发现 " & FileName & " 包含危险特征! " & " 安全评估: 危险度高!"
  List1.AddItem "描述:此文件包含木马转码特征或CMD关键字.请检查是否合法 序列:15"
  Faxian = "发现危险"
  End If
 
  If InStr(1, strTemp, "GetSpecialFolder", vbTextCompare) Or InStr(1, strTemp, "Socket",
 vbTextCompare) Then
  List1.AddItem "发现 " & FileName & " 包含危险特征! " & " 安全评估: 危险度高!"
  List1.AddItem "描述:此文件包含木马执行特征.请检查是否合法 序列:16"
  Faxian = "发现危险"
  End If
 
  If InStr(1, strTemp, "gif""" & "--", vbTextCompare) Or InStr(1, strTemp, "jpg"""
& "--", vbTextCompare) Then
  List1.AddItem "发现 " & FileName & " 包含危险特征! " & " 安全评估: 危险度极高!"
  List1.AddItem "描述:此文件引用了图片极有可能是图片木马 序列:17"
  Faxian = "发现危险"
  End If

  If InStr(1, strTemp, "bmp""" & "--", vbTextCompare) Or InStr(1, strTemp, "png"""
& "--", vbTextCompare) Then
  List1.AddItem "发现 " & FileName & " 包含危险特征! " & " 安全评估: 危险度极高!"
  List1.AddItem "描述:此文件引用了图片极有可能是图片木马 序列:18"
  Faxian = "发现危险"
  End If
 
  If InStr(1, strTemp, "<?require(", vbTextCompare) Or InStr(1, strTemp, "require
($", vbTextCompare) Then
  List1.AddItem "发现 " & FileName & " 包含危险特征! " & " 安全评估: 危险度高!(未
知)"
  List1.AddItem "描述:此文件包涵了PHP的特殊引用如发现类似<?require($AAA);?>引用请检
查是否合法 序列:19"
  Faxian = "发现危险"
  End If
 
  If InStr(1, strTemp, "4e454c33322", vbTextCompare) Or InStr(1, strTemp, """\x",
 vbTextCompare) Then
  List1.AddItem "发现 " & FileName & " 包含危险特征! " & " 安全评估: 危险度高!(未
知)"
  List1.AddItem "描述:此文件极有可能是提权PHP木马或加过密的文件 序列:20"
  Faxian = "发现危险"
  End If
 
  Wend
 
  If SuJu1 > 100 Then
  Text5.Text = ""
  End If
 
  If Faxian = "发现危险" Then
  List1.AddItem "发现存在危险的文件是: "
  List1.AddItem ""
  List1.AddItem path & FileName
  List1.AddItem "-------------------------------------------------------------------
----------------------------"
  Faxian = ""
  FaJs = FaJs + 1
  Me.Label2.Caption = "发现有隐患的文件有:" & FaJs & "个"
  Else
  Faxian = ""
  End If
 
  Close #1
  End If
 
  GC1 = Text5.Text & "正在检测文件..." & Chr(13) & Chr(10) & path & FileName
& Chr(13) & Chr(10)
  Text5.Text = GC1
 
  End If
 
  If Me.Command3.Enabled = True Then
  Exit Function
  End If
 
  Cont = FindNextFile(hSearch, WFD)
  DoEvents
 
  Me.Label3.Caption = "扫描进程: " & "已经扫描文件:" & SuJu1 & "个"
 
  Wend
  Cont = FindClose(hSearch)
  End If
 
  If nDir > 0 Then
  For i = 0 To nDir - 1
  FindFilesAPI = FindFilesAPI + FindFilesAPI(path & dirNames(i) & "\", SearchStr)
  Next i
  End If
 
End Function

Private Sub Command3_Click()

Dim SearchPath As String, FindStr As String
Dim FileSize As Long

If Text1.Text = "" Then
MsgBox "请输入正确扫描路径"
Exit Sub
End If

Me.Command3.Enabled = False
Me.Command7.Enabled = True

List1.Clear
FaJs = 0
SuJu1 = 0
Me.Text5 = ""
  Screen.MousePointer = vbHourglass
  List1.Clear
  LUjin = Text1.Text & "\"
  SearchPath = LUjin
  FindStr = "*.*"
  FindFilesAPI SearchPath, FindStr
  Screen.MousePointer = vbDefault
  If Screen.MousePointer = vbDefault Then
  MsgBox "扫描完成!自动导出扫描结果."
  CxLog
  FaJs = "0"
  Me.Command3.Enabled = True
  Me.Command7.Enabled = False
  End If
End Sub

Sub CxLog()
  On Error Resume Next
  Open App.path & "\LOG\" & Date & "查杀结果.log" For Output As #1
  Print #1, "www.ChinNetHack.Com - 网站程序安全分析器 零号服务器专用"
  Print #1, "发现对服务器具有安全隐患的文件有" & FaJs & "个. 具体结果如下:" & Chr(13) &
Chr(10)
  For i = 0 To List1.ListCount
  Print #1, List1.List(i)
  Next
  Close #1
  Shell "NOTEPAD.EXE " & App.path & "\LOG\" & Date & "查杀结果.log", vbMaximizedFocus
End Sub
Private Sub Command7_Click()
Me.Command3.Enabled = True
Me.Command7.Enabled = False
Screen.MousePointer = vbDefault
End Sub
Private Sub Text5_Change()
Text5.SelStart = Len(Text5.Text)
End Sub



 
[收藏] [推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
用户名: 新注册) 密码: 匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·Keymake实现免密码查看本地QQ聊
·代理跳板与其它突破封锁软件的比
·恶搞祖玛之修改器(图)
·最新炸QQ方法,绝对原创
·SERV-U配置文件详解
·绝对经典的ftp技巧入侵大全
·网络入侵一般步骤及思路
·系统安全之制作编写超级批处理病
·黑客入侵基础知识FTP命令登陆提
·利用智能abc漏洞,破解网吧计费
·Baidu
·黑客技巧
  相关文章
·网站程序中非SI漏洞的利用
·黑客知识介绍之哪类站点可以入侵
·黑客教程之鸽子内网上线详细教程
·安全知识之木马新技术 反弹式木
·黑客技巧之浅谈网络入侵的提高方
·黑客技巧之利用图片做木马应用完
·骇客学堂:关于木马隐藏的一个新
·黑客知识系列之木马程序隐身的技
·二个非常规ASP木马
·黑客知识之网络蠕虫的初步研究及
·黑客技巧之DOS命令扫描网段的端
·VBS实现SQL注入
  主题推广
方舟网络 版权所有|关于本站|隐私保护|