lookforbadguys.php

<?php
/* lookforbadguys.php 2011-09-27
Copyright (C)2011 Karen Chun, Steven Whitney.
Initially published by http://25yearsofprogramming.com.

This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License (GPL)
Version 3 as published by the Free Software Foundation.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

–Purpose: iterate through server files looking for hacker code snippets, backdoor scripts,
suspicious .htaccess code, suspicious file names.
Suspicious things to search for are stored in easily modifiable lists of regular expressions.

–Tested with PHP 5.2 and 5.3. It might work with earlier versions.
–It is designed for use in either Linux or Windows.
On my system, it runs much slower in Windows.

–Not all things it finds are hacks. Not all hacks are found.
–You should also search manually for weird files (such as .php files) in your image directories,
especially if your .htaccess has redirects or was made executable.
–Some searches are commented out because they can give too many false positives.

———-
CHANGELOG:

–2011-03-08 First published

–2011-09-08 Steven Whitney
1. Rewrote the recursive directory search function FindAndProcessFiles().
2. Added ability to exit with ‘Forbidden’ message unless request is from a specific IP address.
3. Changed malicious snippet regexes to allow for any whitespace, not just spaces, between function name and “(“.
4. Renamed $SuspiciousFileAndPathNames array to $SuspiciousFileNames because path names are not tested.
5. Revised comments.
6. Published under GPL3 license.

–2011-09-10 Steven Whitney
1. Added global variables to store counts of files/directories processed, and functions to reset/report them.
Added a global array variable to store the list of files that matched the regex(es).
2. Broke apart FindAndProcessFiles() into two functions:

1) BuildFileList() only traverses the filesystem and builds the list of files matching the regex.
This makes it a general purpose file-find search function like the Linux “find” utility program.
The regex for selecting filenames can either be a single regex string or an array of them.
If it is an array of regexes, a file is added to the list if its name matches any of them.

2) The new FindAndProcessFiles() calls BuildFileList() to build the file list, sorts the list,
and then applies the handler function to each file in the list.

–2011-09-13 Steven Whitney
1. Added GetCanonicalPath() and $UseAbsoluteFilePaths to control whether paths are absolute or relative.
2. Reorganized code blocks so that important user-configuration settings are at the top,
data arrays and handler functions for each search are grouped together,
and support functions are all at the end.
3. Added $FullpathExcludeRegexes and code using it, to allow excluding files from examination.
FindAndProcessFiles() and BuildFileList() both take 1 more argument.
A file is added to the file list if its name matches the include regexes,
UNLESS its fullpath also matches any of the $FullpathExcludeRegexes.
dirs are always traversed, but individual files in them can all be excluded from examination.
This allows dirs to be excluded with or without excluding their subdirs.
Example exclusion: ‘#/tiny_mce/.*\.php$#i’
4. In the search routines, one set of variables is reused instead of using different variable names,
to make it clear that there are 3 routines basically doing the same thing.
Only the data and handler functions change.
5. maliciouscodesnippets() renamed to FindMaliciousCodeSnippets.
In snippet search output, each file is only listed once.
After that, a list of all threats found, with initial portion of the matching strings for visual review.
Moved the special cases (RewriteRule, AddHandler, <script, <iframe) into normal snippet search array.
Moved the lookforbadguys.php exclusion into the fullpath exclusion array.
6. Changed default script execution time limit from unlimited to 5 minutes.
7. Changed CleanColorText() to allow numeric colors: #FFFFFF.
8. Some <script and <iframe detection is now enabled by default, with some of the
most common safe sources of them as exceptions.

–2011-09-14 Steven Whitney
1. In FindMaliciousCodeSnippets(), moved the option to print each filename processed to end of function
and changed its method.
2. In BuildFileList(), moved the test for whether a file matches the fullpath exclusion
so that it is only performed if the file has matched the inclusion criteria
(this fixed an inefficiency in previous version).

–2011-09-27 Steven Whitney
1. Revised the base64_decode regex to show more matched text, if present.
2. Revised the backtick operator regex to be less greedy and show individual occurrences.

—-

*/

# ================================================================================
# USER CONFIGURATION SECTION
# ================================================================================

/*
The next line only allows the script to run if the request came from your IP address.
It allows you to put the script in a public folder but prevent others from running it.
Change the IP address to yours. (127.0.0.1 is localhost.)
*/

if($_SERVER['REMOTE_ADDR'] !== ’127.0.0.1′) exit(‘Forbidden’);

/*
Searches will be done in this directory and all dirs inside it.
The default of ‘./’ means current directory, where this script is now.
Thus, to search everything inside public_html, that’s where this file should be put.
To search outside public_html, or to search a folder other than where this script is stored,
change this to the full pathname, such as /home/userid/ or /home/userid/public_html/somefolder/.
Always use forward slashes for the path. Windows example: C:/wamp/apache2/htdocs/test/
*/

$StartPath = ‘./’;

# TRUE = report shows full file paths such as /home/userid/public_html/blog/…
# FALSE = report shows relative file paths such as ./blog/…

$UseAbsoluteFilePaths = TRUE;

# These set maximum execution time, in seconds. The script can take a while.
# These have no effect if you run PHP in “safe mode” (safe mode is usually undesirable).
# Set to ’0′ for unlimited.

ini_set(‘max_execution_time’, ’300′);
ini_set(‘set_time_limit’, ’300′);

ini_set(‘display_errors’, ’1′);# 1=TRUE, ensure that you see errors such as time-outs.

# ================================================================================
# GLOBAL VARIABLES
# ================================================================================

# Besides being useful, reporting the counts helps ensure that
# new recursion methods work the same as the old.

$FilesCount = 0;
$FilesMatchedCount = 0;
$DirectoriesCount = 0;
$DirectoriesMatchedCount = 0;

# This array must be global because the function that builds it is re-entrant.

$AllFilesToProcess = array();

?>
<!DOCTYPE HTML PUBLIC “-//W3C//DTD HTML 4.01 Transitional//EN” “http://www.w3.org/TR/html4/loose.dtd”>
<head>
<meta http-equiv=”Content-Type” content=”text/html; charset=UTF-8″>
<meta http-equiv=”Content-Language” content=”en-us”>
<title>Looking for bad guys</title>
</head>

<body>
<p>Looking for bad guys. </p>
<p>This script looks for traces of malicious code including code injections,
modified .htaccess that makes images executable, and so on.</p>
<p>

<?php

$RealPath = GetCanonicalPath($StartPath);
if($RealPath === FALSE)
exit(CleanColorText(“Cannot continue. The starting directory is inaccessible to PHP.”, ‘red’) . “<br>”);
if($UseAbsoluteFilePaths)
$StartPath = $RealPath;

# ================================================================================
# START OF SEARCH ROUTINES.
# ================================================================================
/*
This program does two things: 1) finds files, and 2) does something with each one.

When designing a search, the two questions to ask are:

1) Which types of files (by their names) do I want to find or perform an action on?
2) What action do I want to do on each one?

Each search requires these data items to be defined:

1) An array that is a list of Perl-Compatible Regular Expressions (PCRE) of filenames to match.
The program searches directories for all the filenames that match any of the regexes.

2) Another array that is a list of PCREs of fullpaths NOT to match.
This allows excluding files in certain directories.
If a file’s NAME matches any regex in list 1)
and its PATH+NAME does NOT match any regexes list 2) (the exclusions),
its name gets passed to the handler function.

3) The handler function. It can perform any action you want on the file whose name is given to it.
Some of the handler functions below merely report that the filename is suspicious, but do nothing else.
Another handler searches the file extensively for malicious snippets and reports each one found.
You could write a handler that automatically cleans the snippet out of the file,
or even deletes the file automatically. The handler can do anything.

*/

# ================================================================================
# 1) SUSPICIOUS FILENAMES.
# Files with these strings in their *names* will be reported as suspicious.
# There is currently no method provided to check for suspiciously named folders.
# ================================================================================
# FILENAMES TO MATCH

$FileMatchRegexes = array
(
# ‘/root/i’,
# ‘/kit/i’,
‘/c(99|100)/i’,
‘/r57/i’,
‘/gifimg/i’
);
# AND FULLPATHS TO EXCLUDE FROM EXAMINATION

$FullpathExcludeRegexes = array
(
‘#lookforbadguys\.php$#i’
);

# ——————————————————————————–
# HANDLER FUNCTION – THIS IS THE ACTION PERFORMED ON A FILE WHOSE NAME IS A MATCH.

function badnames($filename)
{
echo CleanColorText($filename, ‘blue’) . ” is a ” . CleanColorText(‘suspicious file name’, ‘red’) . “.<br>”;
}

# ——————————————————————————–
# THIS CODE ACTUALLY DOES THE SEARCH.

echo CleanColorText(“Searching for files with suspicious names…”, ‘green’) . “<br>”;

FindAndProcessFiles($StartPath, $FileMatchRegexes, $FullpathExcludeRegexes, ‘badnames’);

# ================================================================================
# 2) WORDPRESS PHARMA HACK SUSPICIOUS FILENAMES.
# Files matching these names will be reported as possible pharma hack files.
# Regexes are based on the naming conventions described at
# http://www.pearsonified.com/2010/04/wordpress-pharma-hack.php
# ================================================================================
# FILENAMES TO MATCH

$FileMatchRegexes = array
(
‘/^\..*(cache|bak|old)\.php/i’, # HIDDEN FILES WITH PSEUDO-EXTENSIONS IN THE MIDDLE OF THE FILENAME
‘/^db-.*\.php/i’,

# Permit the standard WordPress files that start with class-, but flag all others as suspicious.
# The (?!) is called a negative lookahead assertion. It means “not followed by…”

‘/^class-(?!snoopy|smtp|feed|pop3|IXR|phpmailer|json|simplepie|phpass|http|oembed|ftp-pure|wp-filesystem-ssh2|wp-filesystem-ftpsockets|ftp|wp-filesystem-ftpext|pclzip|wp-importer|wp-upgrader|wp-filesystem-base|ftp-sockets|wp-filesystem-direct)\.php/i’
);
# AND FULLPATHS TO EXCLUDE FROM EXAMINATION

$FullpathExcludeRegexes = array
(
‘#lookforbadguys\.php$#i’
);

# ——————————————————————————–
# HANDLER FUNCTION – THIS IS THE ACTION PERFORMED ON A FILE WHOSE NAME IS A MATCH.
function pharma($filename)
{
echo CleanColorText($filename, ‘blue’) . ” is most likely a ” . CleanColorText(‘pharma hack’, ‘red’) . “.<br>”;
}

# ——————————————————————————–
# THIS CODE ACTUALLY DOES THE SEARCH.

echo “<br>” . CleanColorText(“Searching for files with names related to WordPress pharma hack…”, ‘green’) . “<br>”;

FindAndProcessFiles($StartPath, $FileMatchRegexes, $FullpathExcludeRegexes, ‘pharma’);

# ================================================================================
# 3) MALICIOUS CODE SNIPPETS.
# Search text files for snippets of malicious code and report all that are found.
# ================================================================================
# FILENAMES TO MATCH
# Ideally, this list should contain all common extensions of text files
# that can become hazardous when malicious text is injected into them.

$FileMatchRegexes = array
(
‘/\.htaccess$/i’,
‘/\.php[45]?$/i’,
‘/\.html?$/i’,
‘/\.aspx?$/i’,
‘/\.inc$/i’,
‘/\.cfm$/i’,
‘/\.js$/i’,
‘/\.txt$/i’,
‘/\.css$/i’
);
# AND FULLPATHS TO EXCLUDE FROM EXAMINATION

$FullpathExcludeRegexes = array
(
‘#lookforbadguys\.php$#i’
);

# ——————————————————————————–
# HANDLER FUNCTION – THIS IS THE ACTION PERFORMED ON A FILE WHOSE NAME IS A MATCH.

function FindMaliciousCodeSnippets($filename)
{
if(!is_readable($filename))
{
echo “Warning: Unable to read ” . CleanColorText($filename, ‘blue’) .
“. Check it manually and check its access permissions.<br>”;
return;
}

# READ THE FILE INTO A STRING, WITH LINE ENDS REMOVED AND WHITESPACE COMPRESSED.
$file = file_get_contents($filename);
$file = preg_replace(‘/\s+/’, ‘ ‘, $file);

# The file is searched for each of these snippets of suspicious text.
# These are regular expressions with the required /DELIMITERS/ and with metachars escaped.
# /i at the end means case insensitive.
# PHP function names are case-insensitive.
# If your regex itself contains / chars, you can use a different
# char as a delimiter like this: ‘#delimited#i’ to avoid confusion.

$SuspiciousSnippets = array
(
# POTENTIALLY SUSPICIOUS CODE

‘/edoced_46esab/i’,
‘/passthru\s*\(/i’,
‘/shell_exec\s*\(/i’,
‘/document\.write\s*\(unescape\s*\(/i’,

# THESE CAN GIVE MANY FALSE POSITIVES WHEN CHECKING WORDPRESS AND OTHER CMS.
# NONETHELESS, THEY CAN BE IMPORTANT TO FIND, ESPECIALLY BASE64_DECODE.

# THIS IS MUCH MORE SUSPICIOUS IF THE MATCHED TEXT CONTAINS THE EVAL() CODE.

‘/(eval\s*\(.{0,40})?base64_decode\s*\(/i’,

‘/system\s*\(/i’,

# PHP BACKTICK OPERATOR INVOKES SYSTEM FUNCTIONS, SAME AS system(),
# BUT IT IS ALSO A DATABASE,TABLE,FIELD DELIMITER IN SQL DATABASE QUERIES.

‘/`[^`]+`/’,

‘/phpinfo\s*\(/i’,

# THIS SET GENERATES MANY FALSE POSITIVES
# ‘/chmod\s*\(/i’,
# ‘/mkdir\s*\(/i’,
# ‘/fopen\s*\(/i’,
# ‘/fclose\s*\(/i’,
# ‘/readfile\s*\(/i’,

# THESE WERE PREVIOUSLY SPECIAL CASES; NOW MOVED INTO THIS ARRAY.
‘/RewriteRule\s/i’, # SUSPICIOUS IF THE DESTINATION IS A DIFFERENT SITE OR SUSPICIOUS FILE.
‘/AddHandler\s/i’, # THIS CAN MAKE IMAGE OR OTHER FILES EXECUTABLE.

# JAVASCRIPT SNIPPETS WHOSE SRC= REFERENCES AN HTTP:// SOURCE OTHER THAN ONES KNOWN TO BE SAFE.
# EVEN WITH EXCEPTIONS, THIS CAN GIVE MANY FALSE POSITIVES.
‘@<script[^>]+src=[\x22\x27]?http://(?!(www\.(google-analytics|gmodules)\.com|pagead2\.googlesyndication\.com/pagead/|(ws\.|((www|cls)\.assoc-))amazon\.com/))[^>]*>@i’,

# IFRAMES, WITH A KNOWN-HARMLESS EXCLUSION.
# IFRAME SEARCH CAN GIVE MANY FALSE POSITIVES IN SOME WEBSITES.

‘@<iframe[^>]+src=[\x22\x27]?http://(?!(rcm\.amazon\.com/))[^>]*>@i’,

# SUSPICIOUS NAMES. SOME HACKERS SIGN THEIR SCRIPTS. MANY NAMES COULD BE PUT INTO THIS LIST.
# HERE IS A GENERIC EXAMPLE OF TEXT FROM A DEFACED WEB PAGE.

‘/hacked by\s/i’,

# OTHER SUSPICIOUS TEXT STRINGS

‘/web[\s-]*shell/i’, # TO FIND BACKDOOR WEB SHELL SCRIPTS.
‘/c(99|100)/i’, # THE NAMES OF SOME POPULAR WEB SHELLS.
‘/r57/i’,

# YOU COULD/SHOULD ADD TO THIS LIST SOME REGULAR EXPRESSIONS TO MATCH THE NAMES OF
# MALICIOUS DOMAINS AND IP ADDRESSES MENTIONED IN YOUR
# GOOGLE SAFE BROWSING DIAGNOSTIC REPORT.
# SOME EXAMPLES:

‘/gumblar\.cn/i’,
‘/martuz\.cn/i’,
‘/beladen\.net/i’,
‘/gooqle/i’, # NOTE THIS HAS A Q IN IT.
# ‘/127\.0\.0\.1/’, # COMMENTED-OUT EXAMPLE OF AN IP ADDRESS REGEX

# THESE 2 ARE THE WORDPRESS CODE INJECTION IN FRONT OF EVERY INDEX.PHP AND SOME OTHERS

‘/_analist/i’, # EACH LIST ENTRY MUST BE TERMINATED WITH A COMMA…
‘/anaiytics/i’ # EXCEPT THE LAST ENTRY MUST NOT HAVE A COMMA.

);

# ACCUMULATES ALL THE WARNING MESSAGES FOR THIS FILE.
$OutputText = array(CleanColorText($filename, ‘blue’));

# SEARCH THE FILE FOR EACH OF THE ABOVE SNIPPETS.
foreach($SuspiciousSnippets as $snippet)
{
$matches = array();
if($matchcount = preg_match_all($snippet, $file, $matches, PREG_PATTERN_ORDER | PREG_OFFSET_CAPTURE))
{
$i = 0;
foreach($matches[0] as $occurrence) # $occurrence is an array itself 0=>string, 1=>offset
{
$i++;
# THE 80 CHARACTERS AFTER START OF MATCH INSTANCE
$s = substr($file, $occurrence[1], 80);
$newline = (($i === 1) ? ‘<br><br>’ : ‘<br>’);
$OutputText[] = $newline .
CleanColorText(“Regex ($i of $matchcount): “, ‘black’) .
CleanColorText($snippet, ‘red’) .
CleanColorText(“: ” . $s, ‘black’);
}
}
}

# REPORT ALL THREAT MESSAGES AT ONCE, IF THERE WERE ANY.
# TO PRINT EVERY FILENAME EXAMINED, MAKE THE THRESHOLD 0.
if(count($OutputText) > 1)
{
foreach($OutputText as $s)
echo $s;
echo ‘<br><br>’;
}

}

# ——————————————————————————–
# THIS CODE ACTUALLY DOES THE SEARCH.

echo “<br>” . CleanColorText(“Searching for files containing suspicious code or other text…”, ‘green’) . “<br>”;

FindAndProcessFiles($StartPath, $FileMatchRegexes, $FullpathExcludeRegexes, ‘FindMaliciousCodeSnippets’);

# ——————————————————————————–
# END OF THE SEARCH ROUTINES
# ================================================================================
# ================================================================================
# FUNCTION LIBRARY
# ——————————————————————————–
# Output text in specified color, cleaning it with htmlentities().
# Malicious text snippets could by definition be hazardous, so
# always use this to put text on the web page
# unless it is going into a text (input) box or textarea.

function CleanColorText($text, $color)
{
$outputcolor = ‘black’;
$color = trim($color);
if(preg_match(‘/^(red|blue|green|black|#[0-9A-F]{6})$/i’, $color))
$outputcolor = $color;
return ‘<span style=”color:’ . $outputcolor . ‘;”>’ . htmlentities($text, ENT_QUOTES) . ‘</span>’;
}

# ——————————————————————————–

function ResetCounts()
{
global $FilesCount, $FilesMatchedCount, $DirectoriesCount, $DirectoriesMatchedCount, $AllFilesToProcess;

$FilesCount = $FilesMatchedCount = $DirectoriesCount = $DirectoriesMatchedCount = 0;
$AllFilesToProcess = array();
}

# ——————————————————————————–

function ShowCounts()
{
global $FilesCount, $FilesMatchedCount, $DirectoriesCount, $DirectoriesMatchedCount;

$s = “Files encountered = $FilesCount” . ‘, ‘ .
“Matching regex and processed = $FilesMatchedCount” . ‘; ‘ .
“Directories encountered = $DirectoriesCount” . ‘, ‘ .
“Matched and processed = $DirectoriesMatchedCount”;

echo CleanColorText($s, ‘green’) . “<br>”;
}

# ——————————————————————————–
# Returns path translated to canonical absolute filesystem path,
# or FALSE if it fails (path does not exist or PHP cannot enter/read it).

function GetCanonicalPath($path)
{
# CLEAN IT UP AND CONVERT TO STANDARD PHP FORMAT (/)
$path = str_replace(‘\\’, ‘/’, $path);
$path = rtrim($path, ‘/’);
$path .= ‘/’;

$RealPath = realpath($path); # FALSE IF PHP CANNOT READ ANY DIR IN HIERARCHY
if($RealPath === FALSE)
return FALSE;

$RealPath = str_replace(‘\\’, ‘/’, $RealPath);
$RealPath = rtrim($RealPath, ‘/’);
$RealPath .= ‘/’;

return $RealPath;
}

# ——————————————————————————–
/*
Recursively search the starting directory and all below it to find files whose names
match the given regex(es).

Since this performs no action on the files found, it is now a generic file-finder
like the Linux “find” command. You can do whatever you want with the list once it’s built.

$FileMatchRegexes can be either a string or an array. Passing them all at once
allows the filesystem to be traversed only once to find all matches (20+% faster).
*/

function BuildFileList($StartDir, $FileMatchRegexes, $FullpathExcludeRegexes)
{
# NOTE THAT THIS FUNCTION REQUIRES THE GLOBAL VARIABLES DECLARED EARLIER.
global $FilesCount, $FilesMatchedCount, $DirectoriesCount, $DirectoriesMatchedCount,
$AllFilesToProcess;

# CHANGE BACKSLASHES TO FORWARD, WHICH IS OK IN PHP, EVEN IN WINDOWS.
# THEN REMOVE ANY TRAILING SLASHES AND ADD EXACTLY ONE.
$StartDir = str_replace(‘\\’, ‘/’, $StartDir);
$StartDir = rtrim($StartDir, ‘/’);
$StartDir .= ‘/’;

# ENSURE THAT THE CURRENT DIRECTORY EXISTS AND IS READABLE BY PHP.
if(!is_dir($StartDir))
{
echo “Warning: Directory does not exist: ” . CleanColorText($StartDir, ‘blue’) . “<br>”;
return;
}
$DirectoriesCount++; # COUNT IT AS A DIRECTORY (READABLE OR NOT)
if(!is_readable($StartDir))
{
echo CleanColorText(“Warning: Directory is not readable by PHP: “, ‘red’) .
CleanColorText($StartDir, ‘blue’) .
“. Check its owner/group permissions.<br>”;
return;
}

# THE DIR IS READABLE, SO IT WILL BE PROCESSED.
# A DIR IS NEVER ACTUALLY EXCLUDED FROM PROCESSING UNLESS IT CAN’T BE READ.
# ONLY FILES ARE AFFECTED BY THE EXCLUSION RULES.
$DirectoriesMatchedCount++;

# IF THESE ARE NOT ARRAYS, TURN THEM INTO ARRAYS.
if(!is_array($FileMatchRegexes))
$FileMatchRegexes = array($FileMatchRegexes);
if(!is_array($FullpathExcludeRegexes))
$FullpathExcludeRegexes = array($FullpathExcludeRegexes);

# DETERMINE IF EACH ENTRY IN THE CURRENT DIRECTORY IS A CANDIDATE FOR INCLUSION IN THE FILE LIST.
$dir = dir($StartDir);
while(($filename = $dir->read()) !== FALSE)
{
$fullname = $dir->path . $filename;
if(is_file($fullname))
{
$FilesCount++; # ADD IT TO THE COUNT OF *ALL* FILES, PROCESSED OR NOT.

# IF ITS NAME MATCHES ANY OF THE REGEXES, IT MIGHT GO INTO THE LIST…
$matches = 0;
foreach($FileMatchRegexes as $regex)
{
if(preg_match($regex, $filename))
{
$matches = 1;
# UNLESS ITS FULLPATH MATCHES ANY OF THE EXCLUSION REGEXES.
foreach($FullpathExcludeRegexes as $exclude)
{
if(preg_match($exclude, $fullname))
{
$matches = 0;
break;
}
}
break;
}
}
if($matches)
{
$FilesMatchedCount++;
$AllFilesToProcess[] = $fullname;
}
}
else if(is_dir($fullname))
{
# ELSE IF IT IS A DIRECTORY AND NOT THE CURRENT ONE OR ITS PARENT,
# RECURSIVELY CALL THIS FUNCTION TO PROCESS ALL *ITS* ENTRIES
# BEFORE CONTINUING WITH THE CURRENT DIRECTORY.

if(($filename !== ‘.’) && ($filename !== ‘..’))
BuildFileList($fullname, $FileMatchRegexes, $FullpathExcludeRegexes);
}
}
$dir->close();
}

# ——————————————————————————–
# BUILD A MASTER LIST OF ALL THE FILES TO PROCESS,
# THEN SORT THE ARRAY AND PROCESS ALL ITS ENTRIES AT ONCE.

function FindAndProcessFiles($StartDir, $FileMatchRegexes, $FullpathExcludeRegexes, $FileHandlerFunction)
{
global $AllFilesToProcess;

ResetCounts();
BuildFileList($StartDir, $FileMatchRegexes, $FullpathExcludeRegexes);
sort($AllFilesToProcess, SORT_STRING);
foreach($AllFilesToProcess as $filename)
{
call_user_func($FileHandlerFunction, $filename);
}
ShowCounts();
}

# ——————————————————————————–
# END FUNCTION LIBRARY
# ================================================================================

echo “<br>” . CleanColorText(“Done!”, ‘green’) . “<br>”;

?>

</p>
</body>
</html>

How to understand the Google Safe Browsing Diagnostic report for malicious or hacked websites

When the Google web crawler visits a site and gets attacked by malware, Google flags the site as suspicious with a “This site may harm your computer” warning in search results. The search result links no longer go to the site, but go instead to an explanatory page about the warning. The Firefox browser, which looks up sites in the Google Safe Browsing database, displays a “Reported Attack Site!” warning, with a link to the explanation. By either of these routes, you can end up at a Google Safe Browsing Diagnostic report.

Another way to view the Safe Browsing Diagnostic, for any site, is to enter this URL in your browser address bar. Replace EXAMPLE.COM with the name of the site:

http://www.google.com/safebrowsing/diagnostic?site=EXAMPLE.COM

The report is short and lacks explanation, but it contains useful information for webmasters who are trying to clean up their legitimate sites that have been turned dangerous by hackers.

Below are explanations of the sections of the Safe Browsing Diagnostic report, directed toward webmasters who are trying to clean up their websites.

What is the current listing status for _____?

Site is listed as suspicious – visiting this web site may harm your computer.

This tells you whether your site is listed right now as suspicious. If it is, it means that Google has determined that at least one of your pages, by one method or another, under at least some circumstances, is causing visitors to get attacked by malware. There will be warnings (as described above) in Google search results and in the Firefox and Chrome browsers. Internet Explorer does not use the Google Safe Browsing database (it uses a Microsoft database), so IE might not give any warning message. That does not mean the site is clean. If the Google Safe Browsing diagnostic says that visiting a site can cause malicious content to be downloaded to your computer without your permission, you can be almost 100% sure that their assessment is correct.

If this report disagrees with what you see in search results (for example, you know that your site currently is flagged in search results, but the diagnostic says it is not listed as suspicious), it’s possible your site has more than one diagnostic report and you need to find the other(s). There are at least two situations where you can have more than one diagnostic report:

1. Only part of your site, not the whole site, is flagged. In the search results, click the link to one of the pages that is flagged, to get the diagnostic report for that part of the site, such as example.com, example.com/forum, or blog.example.com.
2. In the past, it was possible to have separate diagnostic reports (which sometimes did not agree with each other) for example.com and www.example.com. Google seems to have resolved that problem in most cases, but check out this possibility anyway if the diagnostic does not seem to be accurate for your situation.

If the diagnostic report says your site is not listed as suspicious, but you still get warnings in Firefox, it is due to a delay in Firefox updating from the Google database, and is normally resolved within a day or so.

Part of this site was listed for suspicious activity 9 time(s) over the past 90 days.

This tells you the recent history. In the example above, the site has been flagged and unflagged 9 separate times, which is a lot. Its webmaster has probably been removing malicious code over and over again but not fixing the site’s security vulnerabilities, so the site keeps getting hacked repeatedly.

What happened when Google visited this site?

Of the 110 pages we tested on the site over the past 90 days, 11 page(s) resulted in malicious software being downloaded and installed without user consent.

This is mostly self-explanatory. It gives you an indication how widespread the infection is in the pages of your site. You can get a partial listing of the pages Google considers suspicious at Webmaster Tools at Google Webmaster Central.

The last time Google visited this site was on 2009-11-20, and the last time suspicious content was found on this site was on 2009-11-20.

When the first and second dates are the same, it means that the most recent review found malware. The site is still infected.

The last time Google visited this site was on 2009-11-20, and the last time suspicious content was found on this site was on 2009-11-18.

This means that the most recent review did not find malware. If your site is still shown as “suspicious” even though the last scan did not find malware, the status should change to “not suspicious” within approximately 1 day, unless the site has been flagged many times recently. In that case, there might be a several-day delay while Google waits to see if the site stays clean. Another reason for a delay is if you deleted the infected pages instead of cleaning them. Google wants to see cleaned pages. They do not want you to delete pages, get the flag removed, and then put infected pages back online.

Malicious software includes 1 scripting exploit(s), 1 trojan(s). Successful infection resulted in an average of 1 new process(es) on the target machine.

This itemizes the kinds of malware that attacked the Google crawler when it visited your pages.

Malicious software is hosted on 2 domain(s), including gumblar.cn/, beladen.net/.

When your pages cause malware to be loaded into a visitor’s browser, it means just that: they cause it to happen. It does not necessarily mean the actual virus code is in your page. It probably isn’t, and it probably is not even in some other file on your website. Usually, the virus code is stored at some other site. But if your page contains an iframe that fetches its content from that other site, it will cause the malicious code to be loaded into the visitor’s browser.

This line in the diagnostic is the list of sites where the malware is actually hosted (stored). The visitor’s browser is fetching the virus code from there. If you are hunting for malicious iframes in your website files, these domain names are ones you should be hunting for. Unfortunately, they might be encoded in a way that makes them hard to find with a text search, and it is also possible that other domains, rather than these, are referenced in your iframes. The reason is that sometimes there is a chain or sequence of events, involving other intermediary websites, that eventually, but not immediately, causes malware from the above sites to be loaded. I will discuss intermediaries in the next section.

This list of hosting domains can be very helpful. In the first of the examples above, the reference to gumblar.cn means that it is certain your site was hacked as the result of a virus infection on the PC of one of your website administrators, which stole the FTP password. In the second example, the reference to beladen.net means that it is not just your website that is compromised; the entire server is infected, and so are all the websites on it. A web search on the domain names you find in this list can help discover what type of infection your website has and also can indicate what type of security vulnerability it has that allowed it to be infected. Unfortunately, it doesn’t often lead to such definitive conclusions as it does for gumblar or beladen.

3 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including…

As mentioned above, when your site is loaded in a browser, elements in your page such as iframes can trigger a chain of events that bring malicious content to the visitor’s browser. That chain could involve several hops, through several different websites, before the malicious code gets delivered.

For example, let’s say your page contains an iframe that loads a page from site A, but that page consists of JavaScript code that fetches and executes a VBScript from site B, which fetches a Trojan downloader (the payload, the first part of the actual malicious software, which might consist of several parts carrying different types of attacks) from site C.

In this scenario, your site will certainly be flagged for causing the malicious content to get loaded into the visitor’s browser (initiating the sequence). Sites A and B are intermediaries in the chain, and site C is the host of the code that carries out the attack.

When you are searching your code for hidden iframes, search for domains listed in this section of the report as intermediaries, in addition to the ones listed in the previous section as hosts.

This site was hosted on 1 network(s) including…

This tells you the internet network where your site is hosted. You might recognize the name of your webhost here, or the name of a larger network that your host is part of. This does not seem to be particularly useful information. Any large network will have many compromised websites in it, and no large network will consist 100% of compromised websites.

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, _____ appeared to function as an intermediary for the infection of __ site(s) including _____, _____, …

Is your site one of the intermediaries as described in the previous section? In addition to the general scenario presented above, here are two more specific ones:

• Let’s say you host a PHP script that other sites call to get dynamically generated content from you. Your site gets hacked, and someone injects your PHP code with iframes that point to a third site that hosts malicious code. As long as your own site’s pages don’t call your own PHP script, you’re not causing malware to be loaded into a visitor’s browser, and you’re not the host of the malware, either, but your PHP script is facilitating the distribution of malware by acting as a middle link. You’re an intermediary.
• Let’s say you are an advertising distributor. You accept ads submitted to you by companies who want to advertise, and you place those ads on the sites in your publisher network. One of your advertisers submits a malicious ad. When the ad appears on your publisher websites, you’re an intermediary. This Safe Browsing report is an example of an advertiser listed as an intermediary at the time of this writing. Note that although they are not flagged as suspicious, and their own pages are not flagged in search results with “This site may harm your computer”, they can be causing their publisher network sites to get flagged.

Has this site hosted malware?

This part of the report usually says No. As mentioned earlier, most sites, even compromised ones, do not actually host (contain) the virus code. The hackers store the virus code at a central location. Then they hack many sites, injecting iframe code that points to the central location. With this arrangement, they can change the virus code quickly and easily. The changes get propagated throughout the internet without their having to re-hack thousands of sites to update the code to the new and improved version.

If your report says Yes, your site is hosting malware, then you are one of the chosen few where they actually are storing the virus code. When web surfers load pages from other sites, those pages contain iframes that point to your site and fetch the virus code from your site. Obviously, you need to find where the virus code is being stored in your website files.

If your report says No, this site has not hosted malware, that does not mean your site is clean. It only means your site is not a central location where the virus code is being stored.

Notes

• In the scenario described earlier where your site is flagged because its pages initiate the sequence of malware delivery and “sites A and B are intermediaries, and C is the host”, the intermediaries and hosts will not necessarily be flagged as suspicious. This is counterintuitive because the intermediaries and hosts area danger to the internet because they are either conduits to the flow of malware or store it so it can be used in attacks against web surfers or against other websites.The internet danger level would be reduced if these sites wereflagged as suspicious. It would alert the webmasters (at least the ones who are innocent victims) that their sites need to be cleaned and better secured. Without such warning, many webmasters of sites that are intermediaries or hosts have no idea that they have a problem.The best sense I can make of this situation is that the Google search result warning is intended to help protect web surfersby giving them information they can do something about: they can avoid going to a flagged site.Intermediary and host sites usually play their part through “orphan” files hidden inside their sites. These are files that have no ordinary hyperlinks pointing to them from anywhere on the internet. Because they are not pages that web surfers can get to by following links, and because Google’s intent is to protect web surfers using their search results (not necessarily to “make the internet safer”), they do not bother to flag intermediaries and hosts. Once a web surfer visits a site that initiatesthe delivery of malware, the chain through the intermediaries and hosts is automatic. There is nothing a web surfer could do about it even if they had advance warning, so there is no point in creating such a warning.There is something a web surfer can do for protection, however: turn JavaScript Off. In many cases, that will prevent you from being redirected into the chain of intermediaries and hosts, and prevent the malware from being delivered to your browser.

What is Badware?

ls

List information about files.

Syntax
      ls [Options]... [File]...

Key
      Sort entries alphabetically if none of -cftuSUX nor --sort.

  -a, --all                  Do not hide entries starting with .

  -A, --almost-all           Do not list implied . and ..

  -b, --escape               Print octal escapes for nongraphic characters

      --block-size=SIZE      Use SIZE-byte blocks

  -B, --ignore-backups       Do not list implied entries ending with ~

  -c                         Sort by change time; with -l: show ctime

  -C                         List entries by columns

      --color[=WHEN]         Control whether color is used to distinguish file
                             types. WHEN may be `never', `always', or `auto'

  -d, --directory            List directory entries instead of contents

  -D, --dired                Generate output designed for Emacs' dired mode

  -f                         Do not sort, enable -aU, disable -lst

  -F, --classify             Append indicator (one of */=@|) to entries

      --format=WORD          Across -x, commas -m, horizontal -x, long -l,
                             single-column -1, verbose -l, vertical -C

      --full-time            List both full date and full time

  -g                         (ignored)

  -G, --no-group             Inhibit display of group information

  -h, --human-readable       Print sizes in human readable format (e.g., 1K 234M 2G)
  -H, --si                   Likewise, but use powers of 1000 not 1024

      --indicator-style=WORD Append indicator with style WORD to entry names:
                             none (default), classify (-F), file-type (-p)

  -i, --inode                Print index number of each file

  -I, --ignore=PATTERN       Do not list implied entries matching shell PATTERN

  -k, --kilobytes            Like --block-size=1024

  -l                         Use a long listing format

  -L, --dereference          List entries pointed to by symbolic links

  -m                         Fill width with a comma separated list of entries

  -n, --numeric-uid-gid      List numeric UIDs and GIDs instead of names

  -N, --literal              Print raw entry names (don't treat e.g. control
                             characters specially)

  -o                         Use long listing format without group info

  -p, --file-type            Append indicator (one of /=@|) to entries

  -q, --hide-control-chars   Print ? instead of non graphic characters

      --show-control-chars   Show non graphic characters as-is (default)

  -Q, --quote-name           Enclose entry names in double quotes
      --quoting-style=WORD   Use quoting style WORD for entry names:
                             literal, shell, shell-always, c, escape

  -r, --reverse              Reverse order while sorting

  -R, --recursive            List subdirectories recursively

  -s, --size                 Print size of each file, in blocks

  -S                         Sort by file size

      --sort=WORD            time -t, version -v, status -c
                             size -S, extension -X, none -U
                             atime -u, access -u, use -u

      --time=WORD            Show time as WORD instead of modification time:
                               atime, access, use, ctime or status;
                               also use this as a sort key if --sort=time

  -t                         sort by modification time

  -T, --tabsize=COLS         assume tab stops at each COLS instead of 8

  -u                         sort by last access time; with -l: show atime

  -U                         do not sort; list entries in directory order

  -v                         sort by version

  -w, --width=COLS           assume screen width instead of current value

  -x                         list entries by lines instead of by columns

  -X                         sort alphabetically by entry extension

  -1                         list one file per line

      --help                 display help and exit

      --version              output version information and exit

The most common options are -a (all files) and -l (long or details)
When output to file the files are listed one per line.

By default, colour is not used to distinguish types of files. That is equivalent to using –color=none.
Using the –color option without the optional WHEN argument is equivalent to using –color=always.
With –color=auto, color codes are output only if standard output is connected to a terminal (tty).

Examples

# List the contents of your home directory
$ ls ~

# list everything in a vertical list:
$ ls -al

total 109
drwxr-xr-x  18 root     root         4096 Jun  9 21:12 ./
drwxr-xr-x  18 root     root         4096 Jun  9 21:12 ../
drwxr-xr-x   2 root     root         4096 Jun  9 21:14 bin/
drwxr-xr-x   3 root     root         1024 Jun  9 20:32 boot/
drwxr-xr-x   6 root     root        36864 Jul 12 10:26 dev/
drwxr-xr-x  34 root     root         4096 Jul 12 10:25 etc/
^
the first column is the file type
d = directory
f = file

# List the directories in the current directory:
$ ls -d */

# list ALL subdirectories
$ ls *

The default behaviour of ls is to only pass color control codes to tty output –color=auto.
To pipe the output to a second command complete with color codes then set –color=always

$ ls -lAXh –color=auto|less -R

Password Recovery Speeds

This document shows the approximate amount of time required for a computer or a cluster of computers to guess various passwords. The figures shown are approximate and are the maximum time required to guess each password using a simple brute force “key-search” attack, it may (and probably will) be possible to guess correctly without trying all the combinations shown using other methods of attack or by having a “lucky guess”.

See the bottom of the page for details about the classes of attack.

10 Characters

Just numbers.  As you can see choosing a password from such a small range of characters is a bad idea.

26 Characters

The full alphabet, either upper or lower case (not both in this case).

36 Characters

The full alphabet, either upper or lower case (not both in this case) plus numbers.

52 Characters

This time we’re trying the full alphabet but using a mixture of upper and lower case letters, that effectively doubles the number of combinations when compared with just using a single case.

62 Characters

Mixed upper and lower case alphabetic characters plus numbers.

86 Characters

Mixed upper and lower case alphabet and common symbols.

96 Characters

Mixed upper and lower case alphabet plus numbers and common symbols.

Examples

These are just a couple of examples to show the resilience of certain types of password, using the information in the tables above you will be able to make your own examples.

Classes of Attack

These are just some example speeds, I’d be interested to hear from people with more information about the speed taken to crack various types of passwords with various hardware.

A. 10,000  Passwords/sec
Typical for recovery of Microsoft Office passwords on a Pentium 100

B. 100,000 Passwords/sec
Typical for recovery of Windows Password Cache (.PWL Files) passwords on a Pentium 100

C. 1,000,000        Passwords/sec
Typical for recovery of ZIP or ARJ passwords on a Pentium 100

D. 10,000,000        Passwords/sec

Fast PC, Dual Processor PC.

E. 100,000,000        Passwords/sec

Workstation, or multiple PC’s working together.

F. 1,000,000,000 Passwords/sec
Typical for medium to large scale distributed computing, Supercomputers.

Distributed.net‘s Project Bovine RC5-64 possibly the fastest computer on earth has recently reached a speed of 76.1 Billion passwords per second!