本文讲述了一个python查找 webshell脚本的代码，除了查找webshell功能之外还具有白名单功能，以及发现恶意代码发送邮件报警等功能，感兴趣的朋友可以自己测试一下看看效果。

具体的功能代码如下：

#!/usr/bin/env python
#-*- coding: utf-8 -*-

import os
import sys
import re
import smtplib

#设定邮件
fromaddr = \"smtp.qq.com\"
toaddrs = [\"voilet@qq.com\"]
username = \"voilet\"
password = \"xxxxxx\"


#设置白名单
pass_file = [\"api_ucenter.php\"]

#定义发送邮件函数
def sendmail(toaddrs,sub,content):
  \'发送邮件模块\'
  # Add the From: and To: headers at the start!
  msg = (\"From: %s\\r\\nTo: %s\\r\\nSubject: %s\\r\\n\\r\\n\"
      % (fromaddr, \", \".join(toaddrs), sub))
  msg += content
  server = smtplib.SMTP(\'mail.funshion.com\', 25,)
  server.login(username, password)
  server.sendmail(fromaddr, toaddrs, msg)
  server.quit()

#设置搜索特征码
rulelist = [
  \'(\\$_(GET|POST|REQUEST)\\[.{0,15}\\]\\(\\$_(GET|POST|REQUEST)\\[.{0,15}\\]\\))\',
  \'(base64_decode\\([\\\'\"][\\w\\+/=]{200,}[\\\'\"]\\))\',
  \'eval\\(base64_decode\\(\',
  \'(eval\\(\\$_(POST|GET|REQUEST)\\[.{0,15}\\]\\))\',
  \'(assert\\(\\$_(POST|GET|REQUEST)\\[.{0,15}\\]\\))\',
  \'(\\$[\\w_]{0,15}\\(\\$_(POST|GET|REQUEST)\\[.{0,15}\\]\\))\',
  \'(wscript\\.shell)\',
  \'(gethostbyname\\()\',
  \'(cmd\\.exe)\',
  \'(shell\\.application)\',
  \'(documents\\s+and\\s+settings)\',
  \'(system32)\',
  \'(serv-u)\',
  \'(提权)\',
  \'(phpspy)\',
  \'(后门)\',
  \'(webshell)\',
  \'(Program\\s+Files)\',
  \'www.phpdp.com\',
  \'phpdp\',
  \'PHP神盾\',
  \'decryption\',
  \'Ca3tie1\',
  \'GIF89a\',
  \'IKFBILUvM0VCJD\\/APDolOjtW0tgeKAwA\',
  \'\\\'e\\\'\\.\\\'v\\\'\\.\\\'a\\\'\\.\\\'l\\\'\',
]

def Scan(path):
  for root,dirs,files in os.walk(path):
    for filespath in files:
      isover = False
      if \'.\' in filespath:
        ext = filespath[(filespath.rindex(\'.\')+1):]
        if ext==\'php\' and filespath not in pass_file:
          file= open(os.path.join(root,filespath))
          filestr = file.read()
          file.close()
          for rule in rulelist:
            result = re.compile(rule).findall(filestr)
            if result:
              print \'文件：\'+os.path.join(root,filespath)
              print \'恶意代码：\'+str(result[0])
              print \'\\n\\n\'
              sendmail(toaddrs,\"增值发现恶意代码\",\'文件：\'+os.path.join(root,filespath)+\"\\n\" + \'恶意代码：\'+str(result[0]))
              break

try:
  if os.path.lexists(\"/home/web_root/\"):
    print(\'\\n\\n开始扫描：\'+ \"/home/web_root/\")
    print(\'        可疑文件         \')
    print(\'########################################\')
    Scan(\"/home/web_root/\")
    print(\'提示：扫描完成--~\')
  else:
    print \'提示：指定的扫描目录不存在--- \'
except IndexError:
  print \"请指定扫描文件目录\"