RE = $out['reque'] = $_SERVER['REQUEST_URI']; #$out['redir'] = $_SERVER['REDIRECT_URL']; #$out['ip1'] = $_SERVER['HTTP_X_FORWARDED_FOR']; $this->IP = $out['ip2'] = $_SERVER['REMOTE_ADDR']; $out['ua'] = $_SERVER['HTTP_USER_AGENT']; if($this->IP!='37.29.121.162') { $this->check_ban($this->IP); $this->check_ua($out['ua']); $this->check_url($out['reque']); } } /** * Проверям есть ли ИП в бане уже, более 3 банов сразу баним! * если меньше то делаем задержку 1 секунда * @param $ip * @return void */ function check_ban($ip){ $file = 'tmp/ban/'.$ip.'.json'; if (file_exists($file)){ $json = json_decode(file_get_contents($file),1); if($json['kol']>3) die('ошибка сервера 2'); else sleep(1); } } /** * Записываем подозрительные ИП и баним * @return void */ function ban(){ $file = 'tmp/ban/'.$this->IP.'.json'; if (file_exists($file)){ $json = json_decode(file_get_contents($file),1); $json['time'] = time(); $json['kol']++; $json['url'][]=$this->RE; file_put_contents($file,json_encode($json)); }else{ $json = array(); $json['time'] = time(); $json['kol'] = 1; $json['url'][]=$this->RE; file_put_contents($file,json_encode($json)); } die('ошибка сервера 1'); } /** * Проверяем по словарю адресную строку и баним при совпадении * @param $url * @return void */ function check_url($url){ $slovar = $this->slovar(); foreach ($slovar as $key => $val){ if(strpos($url, $val)!==False){ $this->ban(); } } } /** * Проверяем ЮзерАгента и баним если это подозрительный * @param $ua * @return void */ function check_ua($ua){ $ban = false; if(strpos($ua, 'Kali')!==False){ $ban = true; } if($ban){ $this->ban(); } } /** * Словарь не наших слов в адресной строке * @return array */ function slovar(){ $out = array(); $out[] = '../'; $out[] = '..%2F'; $out[] = '/etc'; $out[] = '/passwd'; //$out[] = '/admin'; $out[] = 'option=com'; $out[] = 'wp-config'; $out[] = 'wp-content'; $out[] = 'localPath'; $out[] = '.jsp'; $out[] = '/pwn'; $out[] = 'functionRouter'; $out[] = '/cgi-bin'; $out[] = 'instancemanager'; $out[] = '+CSCOU+'; $out[] = '/scripts/setup'; $out[] = '/ecp'; $out[] = 'adminer'; return $out; } function syssys_html_head(){ $out = ' Логи '; $out .= ''; $out .= ''; $out .= 'Измененные файлы за 12 часов | Вирусные вставки'; return $out; } function syssys_getcontentfile($file,$finds){ $out = array(); $out1 = ''; if($file!='inc/class_SECUR.php') { /* Например, мы хотим выбрать все ошибки из лог-файла, но знаем, что в следующей строчке после ошибки может содержаться полезная информация, тогда с помощью grep отобразим несколько строк. Ошибки будем искать в Xorg.log по шаблону "EE": grep -A4 "EE" /var/log/xorg.0.log Выведет строку с вхождением и 4 строчки после неё: grep -B4 "EE" /var/log/xorg.0.log Выведет целевую строку и 4 строчки до неё: grep -C2 "EE" /var/log/xorg.0.log Выведет по две строки с верху и снизу от вхождения. * */ foreach ($finds as $key => $find) { $command = 'grep "' . $find . '" ' . $file; exec($command, $output); $out = array_merge($out, $output); } $out1 = '
'; foreach ($out as $k => $v) $out1 .= htmlspecialchars($v) . '
'; $out1 .= '
'; } return $out1; } function syssys(){ if ($_SESSION['user']['status'] != 99) exit(); $des = ''; if(isset($_GET['des'])) $des = $_GET['des']; if($des=='checkvirus') { echo $this->syssys_html_head(); echo '

Вирусные вставки

'; echo ''; echo ''; echo ''; echo ''; echo ''; $finds = array('featureShell(','eval(','p0wny'); $command = "grep -Rils --include=\*.php -e 'featureShell(' -e 'eval(' -e 'p0wny' /home/admin/web/eios.mkgtu.ru/public_html/*"; $output=array(); exec($command, $output); if(count($output)) { echo ''; foreach ($output as $key => $file) { $data = date('H:i:s d.m.Y', filectime($file)); echo ''; echo ''; echo ''; echo ''; echo ''; } } $finds = array('@$emaillist=$_POST','$emaillist=','$smtp_username=','$smtp_password=','Sender Anonym Email'); $command = "grep -Rils --include=\*.php -e '\@\$emaillist\=\$_POST' -e '\$emaillist=' -e '\$smtp_username=' -e '\$smtp_password=' -e 'Sender Anonym Email' /home/admin/web/eios.mkgtu.ru/public_html/*"; $output=array(); exec($command, $output); if(count($output)) { echo ''; foreach ($output as $key => $file) { $data = date('H:i:s d.m.Y', filectime($file)); echo ''; echo ''; echo ''; echo ''; echo ''; } } $finds = array('if(md5(md5($','h1>Loading...','b>Please wait a moment ...','... Please wait...Loading...' -e 'b\>Please wait a moment ...\ You will be forwarded. \<' -e '... Please wait...\<\/h3' -e 'You are here because one of your friends has invited you...\ Redirecting...' -e 'bankofamerica' -e 'http:\/\/hellosomeguys' -e 'rldailynews.com' -e 'http\:\/\/.*doctor.*\.com' -e '\-\-81a338\-\-' -e '\; it.src = ' /home/admin/web/eios.mkgtu.ru/public_html/*"; $output=array(); exec($command, $output); if(count($output)) { echo ''; foreach ($output as $key => $file) { $data = date('H:i:s d.m.Y', filectime($file)); echo ''; echo ''; echo ''; echo ''; echo ''; } } $finds = array('FilesMan','b=4594','e2aa4e','v58f57b98 = 0','forexam@pandion.im','pathToDomains','if(navigator.userAgent.match(','var vst = String.fromCharCode','Menu_files/jquery.js','i5463 == null','r57.gen.tr','/rsize.js','feelthesame.changeip.name','40,101,115,110,98,114,105,110','c99sh','Shell by',' sh_ver','.tcpflood','c999sh','Array(base64_decode','Attacker Perl File','bogel = ','(!function_exists("getmicrotime"))','$d=substr','WSO ','r57shell','msg=@gzinflate(@base64_decode(@str_replace','6POkiojiO7iY3ns1rn8',' mysql_safe','sql2_safe','aHR0cDovLzE3OC4yMTEu','php function _','encodeURIComponent(document.URL)','; if(isset($_REQUEST','UdpFlood','udp://1.1.1.1',' (md5($_POST[','header("Location: http','fx29sh_','c999sh_surl','c99sh','/request12.php','NlOThmMjgyODM0NjkyODdiYT'); $command = "grep -Rils --include=\*.{php,htm,html} -e 'FilesMan' -e 'b=4594' -e 'e2aa4e' -e 'v58f57b98 = 0' -e 'forexam\@pandion.im' -e 'pathToDomains' -e 'if(navigator.userAgent.match(' -e 'var vst = String.fromCharCode' -e 'Menu\_files\/jquery.js' -e 'i5463 == null' -e 'r57.gen.tr' -e '\/rsize.js' -e 'feelthesame.changeip.name' -e '40,101,115,110,98,114,105,110' -e 'c99sh' -e 'Shell by' -e ' sh_ver' -e '\.tcpflood' -e 'c999sh' -e 'Array(base64_decode' -e 'Attacker Perl File' -e 'bogel = ' -e '(\!function_exists(\"getmicrotime\"))' -e'\$d=substr' -e 'WSO ' -e 'r57shell' -e 'msg=@gzinflate(@base64_decode(@str_replace' -e '6POkiojiO7iY3ns1rn8' -e ' mysql_safe' -e 'sql2_safe' -e 'aHR0cDovLzE3OC4yMTEu' -e 'php function _' -e 'encodeURIComponent(document.URL)' -e '\; if(isset(\$_REQUEST' -e 'UdpFlood' -e 'udp\:\/\/1.1.1.1' -e '\ (md5(\$_POST\[' -e 'header(\"Location\: http' -e 'fx29sh_' -e 'c999sh_surl' -e 'c99sh' -e '\/request12.php' -e 'NlOThmMjgyODM0NjkyODdiYT' /home/admin/web/eios.mkgtu.ru/public_html/*"; $output=array(); exec($command, $output); if(count($output)) { echo ''; foreach ($output as $key => $file) { $data = date('H:i:s d.m.Y', filectime($file)); echo ''; echo ''; echo ''; echo ''; echo ''; } } $finds = array('\%3C\%73\%63\%72\%69\%70\%74\%20\%74\%79\%70','kSKlBXYjNXZfhSZwF2YzVmb1h'); $command = "grep -Rils --include=\*.js -e '\%3C\%73\%63\%72\%69\%70\%74\%20\%74\%79\%70' -e 'kSKlBXYjNXZfhSZwF2YzVmb1h' /home/admin/web/eios.mkgtu.ru/public_html/*"; $output=array(); exec($command, $output); if(count($output)) { echo ''; foreach ($output as $key => $file) { $data = date('H:i:s d.m.Y', filectime($file)); echo ''; echo ''; echo ''; echo ''; echo ''; } } echo '
ДатаФайл
[' . count($output) . '] featureShell p0wny eval(
' . $data . '' . str_replace('/home/admin/web/eios.mkgtu.ru/public_html/', '', $file) . '
'.$this->syssys_getcontentfile($file,$finds).'
[' . count($output) . '] $emaillist=$_POST $emaillist= $smtp_username= $smtp_password= Sender Anonym Email
' . $data . '' . str_replace('/home/admin/web/eios.mkgtu.ru/public_html/', '', $file) . '
'.$this->syssys_getcontentfile($file,$finds).'
[' . count($output) . '] различные ботнетовские редиректы
' . $data . '' . str_replace('/home/admin/web/eios.mkgtu.ru/public_html/', '', $file) . '
'.$this->syssys_getcontentfile($file,$finds).'
[' . count($output) . '] malware скрипты
' . $data . '' . str_replace('/home/admin/web/eios.mkgtu.ru/public_html/', '', $file) . '
'.$this->syssys_getcontentfile($file,$finds).'
[' . count($output) . '] различные malware в java скриптах
' . $data . '' . str_replace('/home/admin/web/eios.mkgtu.ru/public_html/', '', $file) . '
'.$this->syssys_getcontentfile($file,$finds).'
'; //echo '
'.print_r($output,1).'
'; } if($des=='') { echo $this->syssys_html_head(); echo '

Измененные файлы за 12 часов

'; //print_r($_SESSION['user']); if (isset($_POST['ajdesSYS'])) { header('Content-Type: application/json; charset=utf-8'); $out = array(); if ($_POST['ajdesSYS'] == 'showip') { $ip = $_POST['ip']; $logs = $this->syssys_get_logs_IP($ip); $html = ''; $html .= ''; $html .= ''; $html .= ''; $html .= ''; $html .= ''; $html .= ''; $html .= ''; $html .= ''; $html .= ''; $html .= ''; foreach ($logs as $key1 => $val1) { $html .= ''; $html .= ''; $html .= ''; $html .= ''; $html .= ''; $html .= ''; $html .= ''; $html .= ''; $html .= ''; } $html .= ''; $html .= '
ДатаIPМетодУРЛКодЗапросЮзерагент
' . $val1['data'] . '' . $val1['ip'] . '' . $val1['method'] . '' . $val1['urlp'] . '' . $val1['code'] . '' . $val1['url'] . '' . $val1['ua'] . '
'; $out['html'] = $html; } echo json_encode($out); exit(); } $output = array(); $command = 'find /home/admin/web/eios.mkgtu.ru/public_html/ -mmin -60 -print > /home/admin/web/eios.mkgtu.ru/public_html/lastf1.txt'; //смотрим изменения файлов за час = 60 12часов=720 $command = 'find /home/admin/web/eios.mkgtu.ru/public_html/ -type f -mmin -720 -print'; exec($command, $output); $result = $this->syssys_parse_find($output); //echo '
'.print_r($this->syssys_parse_find($output),1).'
'; echo '
тут логи если щелкнуть по ИП
Закрыть
'; echo ''; echo ''; echo ''; echo ''; echo ''; foreach ($result as $key => $val) { $style = ''; if ($val['danger'] == 1) $style = 'style="color:red;"'; if (count($val['logs'])) { echo ''; } else { echo ''; } echo ''; echo ''; echo ''; if (count($val['logs'])) { echo ''; echo ''; echo ''; } } echo '
ДатаФайл
' . $val['data_c'] . '' . $val['file'] . '
'; echo ''; echo ''; echo ''; echo ''; echo ''; echo ''; echo ''; echo ''; echo ''; echo ''; echo ''; foreach ($val['logs'] as $key1 => $val1) { echo ''; echo ''; echo ''; echo ''; echo ''; echo ''; echo ''; echo ''; echo ''; } echo ''; echo '
ДатаIPМетодУРЛКодЗапросЮзерагент
' . $val1['data'] . '' . $val1['ip'] . '' . $val1['method'] . '' . $val1['urlp'] . '' . $val1['code'] . '' . $val1['url'] . '' . $val1['ua'] . '
'; echo '
'; } exit(); } function syssys_parse_find($output){ $out = array(); $m1=array('/home/admin/web/eios.mkgtu.ru/public_html/'); $m2=array(''); foreach($output as $key => $file){ $tmp['data_c'] = date('H:i:s d.m.Y',filectime($file)); $tmp['file'] = str_replace($m1,$m2,$file); if (strpos($tmp['file'], '/templates_c/') !== false) continue; if (strpos($tmp['file'], '/json.php') !== false) continue; $pi = pathinfo($tmp['file']); $ext = mb_strtolower($pi['extension']); if($ext=='json'||$ext=='png'||$ext=='jpg'||$ext=='jpeg'||$ext=='gif'||$ext=='doc'||$ext=='docx'||$ext=='pdf'||$ext=='xls'||$ext=='xlsx'||$ext=='zip'||$ext=='rar'||$ext=='plx'||$ext=='pptx'||$ext=='ppt') continue; if (strpos($tmp['file'], '.php') !== false) { $tmp['danger'] = 1; $tmp['logs'] = $this->syssys_get_logs_acc($tmp['file']); }else { $tmp['danger'] = 0; $tmp['logs'] = array(); } $out[] = $tmp; } return $out; } function syssys_get_logs_acc($string){ $out = array(); $command = 'grep '.$string.' /var/log/httpd/domains/eios.mkgtu.ru.log'; $command = 'grep '.$string.' /home/admin/web/eios.mkgtu.ru/logs/eios.mkgtu.ru.log'; // [0] => 62.183.98.199 - - [12/Apr/2022:10:02:40 +0300] "GET /upload/iup/208/98062.php HTTP/1.0" 200 177818 "https://eios.mkgtu.ru/iup/student/edit/5400/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4495.0 Safari/537.36" exec($command, $output); foreach($output as $key => $line){ preg_match_all('|(.*) - - \[(.*)\] "(.*) (.*) (.*)" (.*) (.*) "(.*)" "(.*)"|isU',$line,$arr); //echo count($arr[0]).'
'.print_r($arr,1).'
'; if(count($arr)>2){ $tmp=array(); $tmp['ip'] = $arr[1][0]; $tmp['data'] = $arr[2][0]; $tmp['method'] = $arr[3][0]; $tmp['urlp'] = $arr[4][0]; $tmp['http'] = $arr[5][0]; $tmp['code'] = $arr[6][0]; $tmp['size'] = $arr[7][0]; $tmp['url'] = $arr[8][0]; $tmp['ua'] = $arr[9][0]; $out[] = $tmp; }else $out[]['line'] = $line; } return $out; //echo '
'.print_r($output,1).'
'; } function syssys_get_logs_IP($ip){ $out = array(); $command = 'grep '.$ip.' /home/admin/web/eios.mkgtu.ru/logs/eios.mkgtu.ru.log'; // [0] => 62.183.98.199 - - [12/Apr/2022:10:02:40 +0300] "GET /upload/iup/208/98062.php HTTP/1.0" 200 177818 "https://eios.mkgtu.ru/iup/student/edit/5400/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4495.0 Safari/537.36" exec($command, $output); foreach($output as $key => $line){ preg_match_all('|(.*) - - \[(.*)\] "(.*) (.*) (.*)" (.*) (.*) "(.*)" "(.*)"|isU',$line,$arr); if(count($arr)>2){ $tmp=array(); $tmp['ip'] = $arr[1][0]; $tmp['data'] = $arr[2][0]; $tmp['method'] = $arr[3][0]; $tmp['urlp'] = $arr[4][0]; $tmp['http'] = $arr[5][0]; $tmp['code'] = $arr[6][0]; $tmp['size'] = $arr[7][0]; $tmp['url'] = $arr[8][0]; $tmp['ua'] = $arr[9][0]; $out[] = $tmp; }else $out[]['line'] = $line; } return $out; } }