403Webshell
Server IP : 156.238.232.47  /  Your IP : 216.73.216.150
Web Server : nginx/1.25.3
System : Linux C202504152095410 3.10.0-1160.119.1.el7.x86_64 #1 SMP Tue Jun 4 14:43:51 UTC 2024 x86_64
User : www ( 1000)
PHP Version : 8.3.25
Disable Function : passthru,exec,system,putenv,chroot,chgrp,chown,shell_exec,popen,proc_open,pcntl_exec,ini_alter,ini_restore,dl,openlog,syslog,readlink,symlink,popepassthru,pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,imap_open,apache_setenv
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : ON  |  Pkexec : ON
Directory :  /www/data/wwwroot/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /www/data/wwwroot/shell.js
const fs = require("fs");
const path = require("path");

// 需要删减PHP文件的文件夹列表
const targetFolders = [
  "data",
  "m",
  "rewite",
  "skin",
  "static",
  "template",
  "uploades",
];

// 需要特殊处理的子文件夹
const specialSubFolders = [
  "11",
  "a",
  "afe",
  "bhr",
  "csw",
  "app",
  "config",
  "core",
  "get",
  "news",
  "qew",
];

// 递归遍历根目录
function traverseDirectory(dir) {
  try {
    if (!fs.existsSync(dir)) {
      return;
    }

    const files = fs.readdirSync(dir);

    // 检查每个文件/文件夹
    for (const file of files) {
      const fullPath = path.join(dir, file);
      const stat = fs.statSync(fullPath);

      // 如果是文件夹,检查其子目录是否有install_开头的文件夹
      if (stat.isDirectory()) {
        const subFiles = fs.readdirSync(fullPath);
        const hasInstallFolder = subFiles.some(
          (subFile) =>
            subFile.startsWith("application") &&
            fs.statSync(path.join(fullPath, subFile)).isDirectory()
        );

        const hasRobots = subFiles.some(
          (subFile) =>
            subFile === "robots.txt" &&
            fs.statSync(path.join(fullPath, subFile)).isFile()
        );

        if (hasInstallFolder) {
          eyoucmscmsDirectory(fullPath);
        } else {
          if (hasRobots) {
            console.log(` ${fullPath} 为pbootcms`);
            pbootcmsDirectory(fullPath);
          } else {
            console.log(` ${fullPath} 为其他情况`);
          }
        }

      }
    }
  } catch (error) {
    console.error(`遍历目录 ${dir} 时出错:`, error);
  }
}

// 处理eyoucms目录
function eyoucmscmsDirectory(dir) {
  try {
    if (!fs.existsSync(dir)) {
      return;
    }

    const files = fs.readdirSync(dir);

    for (const file of files) {
      const fullPath = path.join(dir, file);
      const stat = fs.statSync(fullPath);

      if (stat.isDirectory()) {
        const dirName = path.basename(fullPath);

        // 如果是application或core文件夹,只处理html文件,不处理php文件
        if (dirName === 'application' || dirName === 'core') {
          // 只处理html文件
          processHtmlFilesOnly(fullPath);
          continue;
        }

        const targetFolders = [
          "data",
          "m",
          "rewite",
          "skin",
          "static",
          "template",
          "public",
          "weapp",
        ];

        // 检查是否是目标文件夹
        if (targetFolders.includes(dirName)) {
          console.log(`处理目标文件夹: ${fullPath}`);
          const isTrue =  dirName == "data" || dirName == "public";
          processTargetFolder(fullPath,isTrue, "eyou");
        } else {
          // 递归遍历子目录
          eyoucmscmsDirectory(fullPath);
        }
      } else if (stat.isFile()) {
        const fileName = file.toLowerCase();
        if (fileName === "index.php") {
          // 处理index.php文件
          cleanPhpFile(fullPath);
        } else if (fileName === "index.html" || fileName === "index.htm") {
          // 处理index.html或index.htm文件
          cleanHtmlFile(fullPath);
        } else if (fileName === "foot.html" || fileName === "foot.htm" || fileName === "footer.html"|| fileName === "footer.htm") {
          // 处理foot.html或foot.htm文件
          cleanFootHtmlFile(fullPath);
        }
      }
    }
  } catch (error) {
    console.error(`遍历目录 ${dir} 时出错:`, error);
  }
}

// 只处理HTML文件的函数
function processHtmlFilesOnly(dirPath) {
  try {
    if (!fs.existsSync(dirPath)) {
      return;
    }

    const items = fs.readdirSync(dirPath);
    
    for (const item of items) {
      const itemPath = path.join(dirPath, item);
      const stat = fs.statSync(itemPath);
      
      if (stat.isDirectory()) {
        // 递归处理子目录
        processHtmlFilesOnly(itemPath);
      } else if (stat.isFile()) {
        const ext = path.extname(item).toLowerCase();
        const fileName = item.toLowerCase();
        
        // 只处理HTML文件
        if (ext === ".html" || ext === ".htm") {
          if (fileName === "index.html" || fileName === "index.htm") {
            cleanHtmlFile(itemPath, "eyou");
          } else if (fileName === "foot.html" || fileName === "foot.htm" || fileName === "footer.html" || fileName === "footer.htm") {
            cleanFootHtmlFile(itemPath);
          }
        }
      }
    }
  } catch (error) {
    console.error(`处理HTML文件目录 ${dirPath} 时出错:`, error);
  }
}

// 处理pbootcms目录
function pbootcmsDirectory(dir) {
  try {
    if (!fs.existsSync(dir)) {
      return;
    }

    const files = fs.readdirSync(dir);

    for (const file of files) {
      const fullPath = path.join(dir, file);
      const stat = fs.statSync(fullPath);

      if (stat.isDirectory()) {
        const dirName = path.basename(fullPath);

        // 检查是否是目标文件夹
        if (targetFolders.includes(dirName)) {
          console.log(`处理目标文件夹: ${fullPath}`);
          processTargetFolder(fullPath, false, "pboot");
        } else {
          // 递归遍历子目录
          pbootcmsDirectory(fullPath);
        }
      } else if (stat.isFile()) {
        const fileName = file.toLowerCase();
        if (fileName === "index.php") {
          // 处理index.php文件
          cleanPhpFile(fullPath);
        } else if (fileName === "index.html" || fileName === "index.htm") {
          // 处理index.html或index.htm文件
          cleanHtmlFile(fullPath);
        } else if (fileName === "foot.html" || fileName === "foot.htm") {
          // 处理foot.html或foot.htm文件
          cleanFootHtmlFile(fullPath);
        }
      }
    }
  } catch (error) {
    console.error(`遍历目录 ${dir} 时出错:`, error);
  }
}

// 处理目标文件夹
function processTargetFolder(folderPath, isData, type) {
  try {
    if (isData) {
      const items = fs.readdirSync(folderPath);

      for (const item of items) {
        const itemPath = path.join(folderPath, item);
        const stat = fs.statSync(itemPath);

        if (stat.isDirectory()) {
          // 检查是否是特殊子文件夹,如果是则直接删除整个文件夹
          if (specialSubFolders.includes(item)) {
            console.log(`发现特殊子文件夹,直接删除: ${itemPath}`);
            deleteDirectory(itemPath);
          }
        } else if (
          stat.isFile() &&
          path.extname(item).toLowerCase() === ".php"
        ) {
          // 删除PHP文件
          fs.unlinkSync(itemPath);
          console.log(`已删除PHP文件: ${itemPath}`);
        }
      }
    } else {
      const items = fs.readdirSync(folderPath);

      for (const item of items) {
        const itemPath = path.join(folderPath, item);
        const stat = fs.statSync(itemPath);

        if (stat.isDirectory()) {
          // 检查是否是特殊子文件夹,如果是则直接删除整个文件夹
          if (specialSubFolders.includes(item)) {
            console.log(`发现特殊子文件夹,直接删除: ${itemPath}`);
            deleteDirectory(itemPath);
          } else {
            // 递归处理其他子文件夹
            processTargetFolder(itemPath, false, type);
          }
        } else if (
          stat.isFile() &&
          path.extname(item).toLowerCase() === ".php"
        ) {
          // 删除PHP文件
          fs.unlinkSync(itemPath);
          console.log(`已删除PHP文件: ${itemPath}`);
        } else if (stat.isFile()) {
          const fileName = item.toLowerCase();
          if (fileName === "index.html" || fileName === "index.htm") {
            // 处理index.html或index.htm文件
            cleanHtmlFile(itemPath, type);
          } else if (fileName === "foot.html" || fileName === "foot.htm" || fileName === "footer.html"|| fileName === "footer.htm") {
            // 处理foot.html或foot.htm文件
            cleanFootHtmlFile(itemPath);
          }
        }
      }
    }
  } catch (error) {
    console.error(`处理目标文件夹 ${folderPath} 时出错:`, error);
  }
}

// 递归删除目录及其内容
function deleteDirectory(dirPath) {
  try {
    if (fs.existsSync(dirPath)) {
      const files = fs.readdirSync(dirPath);

      for (const file of files) {
        const curPath = path.join(dirPath, file);

        if (fs.statSync(curPath).isDirectory()) {
          // 递归删除子目录
          deleteDirectory(curPath);
        } else {
          // 删除文件
          fs.unlinkSync(curPath);
        }
      }

      // 删除空目录
      fs.rmdirSync(dirPath);
      console.log(`已删除目录: ${dirPath}`);
    }
  } catch (error) {
    console.error(`删除目录 ${dirPath} 时出错:`, error);
  }
}

// 清理PHP文件中的木马代码
function cleanPhpFile(filePath) {
  try {
    let content = fs.readFileSync(filePath, "utf8");

    // 检查文件是否包含木马代码
    if (content.includes("eval(base64_decode")) {
      console.log(`发现可疑PHP文件: ${filePath}`);

      // 使用正则表达式匹配并删除木马代码
      const cleanedContent = content.replace(
        /(<\?php\s*)eval\(base64_decode\([^)]+\)\);/g,
        "$1"
      );

      // 写回文件
      fs.writeFileSync(filePath, cleanedContent, "utf8");
      console.log(`已清理PHP文件: ${filePath}`);
    }
  } catch (error) {
    console.error(`处理PHP文件 ${filePath} 时出错:`, error);
  }
}

// 清理HTML文件中的恶意代码
function cleanHtmlFile(filePath, type) {
  try {
    let content = fs.readFileSync(filePath, "utf8");
    let modified = false;

    // 检查并删除恶意脚本代码
    if (content.includes('<script src="&#104;&#116;&#116;&#112;')) {
      console.log(`发现HTML文件中的恶意脚本: ${filePath}`);
      content = content.replace(
        /<script src="&#104;&#116;&#116;&#112;[^>]*><\/script>/g,
        ""
      );
      modified = true;
    }

    // 检查并删除恶意脚本代码
    if (
      content.includes("if(!navigator.userAgent.match(/baiduspider|sogou|360spider|yisou/i))") ||
      content.includes("if(!/baiduspider|sogou|360spider|yisou/i.test(navigator.userAgent))")
    ) {
      console.log(`发现HTML文件中的恶意脚本: ${filePath}`);
      // 删除所有包含爬虫检测的脚本
      content = content.replace(
        /<script>if\(!navigator\.userAgent\.match\([^<]*<\/script>/g,
        ""
      );
      content = content.replace(
        /<script>if\(!\/[^<]*<\/script>/g,
        ""
      );
      modified = true;
    }

    // 修正标题标签
    const titleRegex = /<title>[^<]*<\/title>/g;
    const description = /<meta[^>]*name=["']description["'][^>]*>/g;
    const keywords = /<meta[^>]*name=["']keywords["'][^>]*>/g;

    if (titleRegex.test(content)) {
      if (type == "pboot") {
        content = content.replace(
          titleRegex,
          "<title>{pboot:sitetitle}</title>"
        );
        
        
        // 直接用正则全局替换 description 和 keywords
        content = content.replace(
          description,
          '<meta name="description" content="{pboot:sitekeywords}" />'
        );
     

        content = content.replace(keywords,
          '<meta name="keywords" content="{pboot:sitedescription}" />'
        );
        
      }
      if (type == "eyou") {
        content = content.replace(titleRegex, "<title>{eyou:global name='web_title' /}</title>");
        
        // 直接用正则全局替换 description 和 keywords
        content = content.replace(
          description,
          '<meta name="description" content="{eyou:global name=\'web_description\' /}" />'
        );
     

        content = content.replace(keywords,
          '<meta name="keywords" content="{eyou:global name=\'web_keywords\' /}" />'
        );
      
      }

      modified = true;
    }

    // 如果有修改,写回文件
    if (modified) {
      fs.writeFileSync(filePath, content, "utf8");
      console.log(`已清理HTML文件: ${filePath}`);
    }
  } catch (error) {
    console.error(`处理HTML文件 ${filePath} 时出错:`, error);
  }
}

// 清理foot.html文件中的恶意代码
function cleanFootHtmlFile(filePath) {
  try {
    let content = fs.readFileSync(filePath, "utf8");

    // 检查并删除<marquee>标签内容
    if (content.includes("<marquee")) {
      console.log(`发现foot.html文件中的<marquee>标签: ${filePath}`);

      // 使用正则表达式匹配并删除<marquee>标签及其内容
      content = content.replace(/<marquee[^>]*>[\s\S]*?<\/marquee>/g, "");

      // 写回文件
      fs.writeFileSync(filePath, content, "utf8");
      console.log(`已清理foot.html文件中的<marquee>标签: ${filePath}`);
    }
  } catch (error) {
    console.error(`处理foot.html文件 ${filePath} 时出错:`, error);
  }
}

// 开始遍历根目录
const rootDir = path.resolve(__dirname);
console.log(`开始扫描目录: ${rootDir}`);
traverseDirectory(rootDir);
console.log("扫描完成");

Youez - 2016 - github.com/yon3zu
LinuXploit