| Server IP : 156.238.232.47 / Your IP : 216.73.216.150 Web Server : nginx/1.25.3 System : Linux C202504152095410 3.10.0-1160.119.1.el7.x86_64 #1 SMP Tue Jun 4 14:43:51 UTC 2024 x86_64 User : www ( 1000) PHP Version : 8.3.25 Disable Function : passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /www/data/wwwroot/ |
Upload File : |
const fs = require("fs");
const path = require("path");
// 需要删减PHP文件的文件夹列表
const targetFolders = [
"data",
"m",
"rewite",
"skin",
"static",
"template",
"uploades",
];
// 需要特殊处理的子文件夹
const specialSubFolders = [
"11",
"a",
"afe",
"bhr",
"csw",
"app",
"config",
"core",
"get",
"news",
"qew",
];
// 递归遍历根目录
function traverseDirectory(dir) {
try {
if (!fs.existsSync(dir)) {
return;
}
const files = fs.readdirSync(dir);
// 检查每个文件/文件夹
for (const file of files) {
const fullPath = path.join(dir, file);
const stat = fs.statSync(fullPath);
// 如果是文件夹,检查其子目录是否有install_开头的文件夹
if (stat.isDirectory()) {
const subFiles = fs.readdirSync(fullPath);
const hasInstallFolder = subFiles.some(
(subFile) =>
subFile.startsWith("application") &&
fs.statSync(path.join(fullPath, subFile)).isDirectory()
);
const hasRobots = subFiles.some(
(subFile) =>
subFile === "robots.txt" &&
fs.statSync(path.join(fullPath, subFile)).isFile()
);
if (hasInstallFolder) {
eyoucmscmsDirectory(fullPath);
} else {
if (hasRobots) {
console.log(` ${fullPath} 为pbootcms`);
pbootcmsDirectory(fullPath);
} else {
console.log(` ${fullPath} 为其他情况`);
}
}
}
}
} catch (error) {
console.error(`遍历目录 ${dir} 时出错:`, error);
}
}
// 处理eyoucms目录
function eyoucmscmsDirectory(dir) {
try {
if (!fs.existsSync(dir)) {
return;
}
const files = fs.readdirSync(dir);
for (const file of files) {
const fullPath = path.join(dir, file);
const stat = fs.statSync(fullPath);
if (stat.isDirectory()) {
const dirName = path.basename(fullPath);
// 如果是application或core文件夹,只处理html文件,不处理php文件
if (dirName === 'application' || dirName === 'core') {
// 只处理html文件
processHtmlFilesOnly(fullPath);
continue;
}
const targetFolders = [
"data",
"m",
"rewite",
"skin",
"static",
"template",
"public",
"weapp",
];
// 检查是否是目标文件夹
if (targetFolders.includes(dirName)) {
console.log(`处理目标文件夹: ${fullPath}`);
const isTrue = dirName == "data" || dirName == "public";
processTargetFolder(fullPath,isTrue, "eyou");
} else {
// 递归遍历子目录
eyoucmscmsDirectory(fullPath);
}
} else if (stat.isFile()) {
const fileName = file.toLowerCase();
if (fileName === "index.php") {
// 处理index.php文件
cleanPhpFile(fullPath);
} else if (fileName === "index.html" || fileName === "index.htm") {
// 处理index.html或index.htm文件
cleanHtmlFile(fullPath);
} else if (fileName === "foot.html" || fileName === "foot.htm" || fileName === "footer.html"|| fileName === "footer.htm") {
// 处理foot.html或foot.htm文件
cleanFootHtmlFile(fullPath);
}
}
}
} catch (error) {
console.error(`遍历目录 ${dir} 时出错:`, error);
}
}
// 只处理HTML文件的函数
function processHtmlFilesOnly(dirPath) {
try {
if (!fs.existsSync(dirPath)) {
return;
}
const items = fs.readdirSync(dirPath);
for (const item of items) {
const itemPath = path.join(dirPath, item);
const stat = fs.statSync(itemPath);
if (stat.isDirectory()) {
// 递归处理子目录
processHtmlFilesOnly(itemPath);
} else if (stat.isFile()) {
const ext = path.extname(item).toLowerCase();
const fileName = item.toLowerCase();
// 只处理HTML文件
if (ext === ".html" || ext === ".htm") {
if (fileName === "index.html" || fileName === "index.htm") {
cleanHtmlFile(itemPath, "eyou");
} else if (fileName === "foot.html" || fileName === "foot.htm" || fileName === "footer.html" || fileName === "footer.htm") {
cleanFootHtmlFile(itemPath);
}
}
}
}
} catch (error) {
console.error(`处理HTML文件目录 ${dirPath} 时出错:`, error);
}
}
// 处理pbootcms目录
function pbootcmsDirectory(dir) {
try {
if (!fs.existsSync(dir)) {
return;
}
const files = fs.readdirSync(dir);
for (const file of files) {
const fullPath = path.join(dir, file);
const stat = fs.statSync(fullPath);
if (stat.isDirectory()) {
const dirName = path.basename(fullPath);
// 检查是否是目标文件夹
if (targetFolders.includes(dirName)) {
console.log(`处理目标文件夹: ${fullPath}`);
processTargetFolder(fullPath, false, "pboot");
} else {
// 递归遍历子目录
pbootcmsDirectory(fullPath);
}
} else if (stat.isFile()) {
const fileName = file.toLowerCase();
if (fileName === "index.php") {
// 处理index.php文件
cleanPhpFile(fullPath);
} else if (fileName === "index.html" || fileName === "index.htm") {
// 处理index.html或index.htm文件
cleanHtmlFile(fullPath);
} else if (fileName === "foot.html" || fileName === "foot.htm") {
// 处理foot.html或foot.htm文件
cleanFootHtmlFile(fullPath);
}
}
}
} catch (error) {
console.error(`遍历目录 ${dir} 时出错:`, error);
}
}
// 处理目标文件夹
function processTargetFolder(folderPath, isData, type) {
try {
if (isData) {
const items = fs.readdirSync(folderPath);
for (const item of items) {
const itemPath = path.join(folderPath, item);
const stat = fs.statSync(itemPath);
if (stat.isDirectory()) {
// 检查是否是特殊子文件夹,如果是则直接删除整个文件夹
if (specialSubFolders.includes(item)) {
console.log(`发现特殊子文件夹,直接删除: ${itemPath}`);
deleteDirectory(itemPath);
}
} else if (
stat.isFile() &&
path.extname(item).toLowerCase() === ".php"
) {
// 删除PHP文件
fs.unlinkSync(itemPath);
console.log(`已删除PHP文件: ${itemPath}`);
}
}
} else {
const items = fs.readdirSync(folderPath);
for (const item of items) {
const itemPath = path.join(folderPath, item);
const stat = fs.statSync(itemPath);
if (stat.isDirectory()) {
// 检查是否是特殊子文件夹,如果是则直接删除整个文件夹
if (specialSubFolders.includes(item)) {
console.log(`发现特殊子文件夹,直接删除: ${itemPath}`);
deleteDirectory(itemPath);
} else {
// 递归处理其他子文件夹
processTargetFolder(itemPath, false, type);
}
} else if (
stat.isFile() &&
path.extname(item).toLowerCase() === ".php"
) {
// 删除PHP文件
fs.unlinkSync(itemPath);
console.log(`已删除PHP文件: ${itemPath}`);
} else if (stat.isFile()) {
const fileName = item.toLowerCase();
if (fileName === "index.html" || fileName === "index.htm") {
// 处理index.html或index.htm文件
cleanHtmlFile(itemPath, type);
} else if (fileName === "foot.html" || fileName === "foot.htm" || fileName === "footer.html"|| fileName === "footer.htm") {
// 处理foot.html或foot.htm文件
cleanFootHtmlFile(itemPath);
}
}
}
}
} catch (error) {
console.error(`处理目标文件夹 ${folderPath} 时出错:`, error);
}
}
// 递归删除目录及其内容
function deleteDirectory(dirPath) {
try {
if (fs.existsSync(dirPath)) {
const files = fs.readdirSync(dirPath);
for (const file of files) {
const curPath = path.join(dirPath, file);
if (fs.statSync(curPath).isDirectory()) {
// 递归删除子目录
deleteDirectory(curPath);
} else {
// 删除文件
fs.unlinkSync(curPath);
}
}
// 删除空目录
fs.rmdirSync(dirPath);
console.log(`已删除目录: ${dirPath}`);
}
} catch (error) {
console.error(`删除目录 ${dirPath} 时出错:`, error);
}
}
// 清理PHP文件中的木马代码
function cleanPhpFile(filePath) {
try {
let content = fs.readFileSync(filePath, "utf8");
// 检查文件是否包含木马代码
if (content.includes("eval(base64_decode")) {
console.log(`发现可疑PHP文件: ${filePath}`);
// 使用正则表达式匹配并删除木马代码
const cleanedContent = content.replace(
/(<\?php\s*)eval\(base64_decode\([^)]+\)\);/g,
"$1"
);
// 写回文件
fs.writeFileSync(filePath, cleanedContent, "utf8");
console.log(`已清理PHP文件: ${filePath}`);
}
} catch (error) {
console.error(`处理PHP文件 ${filePath} 时出错:`, error);
}
}
// 清理HTML文件中的恶意代码
function cleanHtmlFile(filePath, type) {
try {
let content = fs.readFileSync(filePath, "utf8");
let modified = false;
// 检查并删除恶意脚本代码
if (content.includes('<script src="http')) {
console.log(`发现HTML文件中的恶意脚本: ${filePath}`);
content = content.replace(
/<script src="http[^>]*><\/script>/g,
""
);
modified = true;
}
// 检查并删除恶意脚本代码
if (
content.includes("if(!navigator.userAgent.match(/baiduspider|sogou|360spider|yisou/i))") ||
content.includes("if(!/baiduspider|sogou|360spider|yisou/i.test(navigator.userAgent))")
) {
console.log(`发现HTML文件中的恶意脚本: ${filePath}`);
// 删除所有包含爬虫检测的脚本
content = content.replace(
/<script>if\(!navigator\.userAgent\.match\([^<]*<\/script>/g,
""
);
content = content.replace(
/<script>if\(!\/[^<]*<\/script>/g,
""
);
modified = true;
}
// 修正标题标签
const titleRegex = /<title>[^<]*<\/title>/g;
const description = /<meta[^>]*name=["']description["'][^>]*>/g;
const keywords = /<meta[^>]*name=["']keywords["'][^>]*>/g;
if (titleRegex.test(content)) {
if (type == "pboot") {
content = content.replace(
titleRegex,
"<title>{pboot:sitetitle}</title>"
);
// 直接用正则全局替换 description 和 keywords
content = content.replace(
description,
'<meta name="description" content="{pboot:sitekeywords}" />'
);
content = content.replace(keywords,
'<meta name="keywords" content="{pboot:sitedescription}" />'
);
}
if (type == "eyou") {
content = content.replace(titleRegex, "<title>{eyou:global name='web_title' /}</title>");
// 直接用正则全局替换 description 和 keywords
content = content.replace(
description,
'<meta name="description" content="{eyou:global name=\'web_description\' /}" />'
);
content = content.replace(keywords,
'<meta name="keywords" content="{eyou:global name=\'web_keywords\' /}" />'
);
}
modified = true;
}
// 如果有修改,写回文件
if (modified) {
fs.writeFileSync(filePath, content, "utf8");
console.log(`已清理HTML文件: ${filePath}`);
}
} catch (error) {
console.error(`处理HTML文件 ${filePath} 时出错:`, error);
}
}
// 清理foot.html文件中的恶意代码
function cleanFootHtmlFile(filePath) {
try {
let content = fs.readFileSync(filePath, "utf8");
// 检查并删除<marquee>标签内容
if (content.includes("<marquee")) {
console.log(`发现foot.html文件中的<marquee>标签: ${filePath}`);
// 使用正则表达式匹配并删除<marquee>标签及其内容
content = content.replace(/<marquee[^>]*>[\s\S]*?<\/marquee>/g, "");
// 写回文件
fs.writeFileSync(filePath, content, "utf8");
console.log(`已清理foot.html文件中的<marquee>标签: ${filePath}`);
}
} catch (error) {
console.error(`处理foot.html文件 ${filePath} 时出错:`, error);
}
}
// 开始遍历根目录
const rootDir = path.resolve(__dirname);
console.log(`开始扫描目录: ${rootDir}`);
traverseDirectory(rootDir);
console.log("扫描完成");