const fs = require("fs");
const path = require("path");

// 递归遍历目录查找PHP文件
function traverseDirectory(dir) {
  try {
    if (!fs.existsSync(dir)) {
      return;
    }

    const files = fs.readdirSync(dir);

    for (const file of files) {
      const fullPath = path.join(dir, file);
      const stat = fs.statSync(fullPath);

      if (stat.isDirectory()) {
        // 递归遍历子目录
        traverseDirectory(fullPath);
      } else if (stat.isFile() && path.extname(file).toLowerCase() === ".php") {
        // 检查PHP文件
        checkAndCleanPhpFile(fullPath);
      }
    }
  } catch (error) {
    console.error(`遍历目录 ${dir} 时出错:`, error);
  }
}

// 检查并清理PHP文件
function checkAndCleanPhpFile(filePath) {
  try {
    let content = fs.readFileSync(filePath, "utf8");
    
    // 检查文件是否包含特定的注入标记
    const suspiciousPatterns = [
      "快推科技",
    ];
    
    // 检查文件是否包含可疑内容
    const isSuspicious = suspiciousPatterns.some(pattern => content.includes(pattern));
    
    if (isSuspicious) {
      console.log(`发现可疑WebShell文件: ${filePath}`);
      
      // 获取文件名
      const fileName = path.basename(filePath);
      
      // 检查是否是已知的恶意文件名
      const knownMaliciousFiles = [
        "yxpbqcon.php",
        "ixpbqcon.php",
        "axpbqcon.php",
        "bxpbqcon.php",
        "cxpbqcon.php"
      ];
      
      if (knownMaliciousFiles.includes(fileName) || 
          fileName.includes("xpbqcon") || 
          content.includes("快推科技")) {
        // 直接删除已知的恶意文件
        fs.unlinkSync(filePath);
        console.log(`已删除恶意WebShell文件: ${filePath}`);
      } else {
        // 对于其他可疑文件，检查内容并决定是否删除
        const hasEvalBase64 = content.includes("eval(base64_decode");
        const hasSystemFunctions = content.includes("system(") || 
                                  content.includes("exec(") || 
                                  content.includes("shell_exec(") || 
                                  content.includes("passthru(");
        
        if (hasEvalBase64 || hasSystemFunctions) {
          fs.unlinkSync(filePath);
          console.log(`已删除危险WebShell文件: ${filePath}`);
        } else {
          console.log(`发现可疑文件但不确定是否为WebShell: ${filePath}`);
          // 可以选择将可疑文件移动到隔离目录或添加标记
        }
      }
    }
  } catch (error) {
    console.error(`处理PHP文件 ${filePath} 时出错:`, error);
  }
}

// 开始扫描
const rootDir = path.resolve(__dirname);
console.log(`开始扫描目录: ${rootDir}`);
traverseDirectory(rootDir);
console.log("扫描完成");