<?php

/**
 * 迅睿专用木马扫描、文件异常排查
 */

header('Content-Type: text/html; charset=utf-8');

$auto = 1;

#define('WEBPATH', '/www/wwwroot/');

if (strpos(dirname(__FILE__), 'public') !== false) {
    define('WEBPATH', dirname(dirname(__FILE__)).'/');
} else {
    define('WEBPATH', dirname(__FILE__).'/');
}
#
define('ROOTPATH', WEBPATH);
define('SELF', pathinfo(__FILE__, PATHINFO_BASENAME));
if (function_exists('ini_get')) {
    $pfile = ini_get('auto_prepend_file');
    if ($pfile) {
        echo '<font color="#ff7f50">php.ini中auto_prepend_file参数疑似可疑代码：'.$pfile.'</font><br>';
    }
    $afile = ini_get('auto_append_file');
    if ($afile) {
        echo '<font color="#ff7f50">php.ini中auto_append_file参数疑似可疑代码：'.$afile.'</font><br>';
    }
} else {
    echo '<font color="#ff7f50">ini_get不支持</font><br>';
}

$vcfg = [];
if (is_file(dirname(__FILE__).'/'.'dayrui/My/Config/Version.php')) {
    $vcfg = require dirname(__FILE__).'/'.'dayrui/My/Config/Version.php';
} elseif (is_file(dirname(dirname(__FILE__)).'/dayrui/My/Config/Version.php')) {
    $vcfg = require dirname(dirname(__FILE__)).'/dayrui/My/Config/Version.php';
}

if ($vcfg) {
    echo '当前CMS版本：V'.$vcfg['version'].'（'.$vcfg['downtime'].'）- '.$vcfg['name'].'（如果版本不是最新，请尽快升级到最新版本）<br>';
}

$msg = [];
echo '检查开始: '.WEBPATH.'<hr>';
checkdir(ROOTPATH);
$cts = [];
foreach ($msg as $i => $t) {
    if (!isset($cts[$t[0]])) {
        $cts[$t[0]] = 1;
    }
    $cts[$t[0]]++;
    if (!isset($cts[$t[1]])) {
        $cts[$t[1]] = 1;
    }
    $cts[$t[1]]++;
}

foreach ($msg as $i => $t) {
    if (!isset($cts[$t[0]]) or $cts[$t[0]]< 3) {
        $t[2] = str_replace('xxxx', 'red', $t[2]);
    }
    if (!isset($cts[$t[1]]) or $cts[$t[1]]< 3) {
        $t[2] = str_replace('xxxx', 'red', $t[2]);
    }

    echo $t[2];
}


echo '<hr>检查完毕（'.$auto.'），以上红色提示的文件需要手动观察里面的文件源码是否可疑。';
echo '<br>如果自己不会分析可疑代码，请联系官方专业人员帮你排查：https://www.xunruicms.com/anquan/';

function checkdir($basedir){
    global $msg;
    if ($dh = @opendir($basedir)) {
        while (($file = readdir($dh)) !== false) {
            if ($file != '.' && $file != '..'){
                $ext = trim(strtolower(strrchr($file, '.')), '.');
                if (!is_dir($basedir."/".$file)) {
                    if (in_array($ext, ['php', 'html', 'js']) and filesize($basedir."/".$file) < 1024*1024*3 and $file != SELF) {
                        $rt = checkBOM("$basedir/$file");
                        if ($rt) {
                            $a = filectime($basedir."/".$file);
                            $b = filemtime($basedir."/".$file);
                            $msg[] = [
                                $a, $b,
                                "<font color=xxxx>C".date('Y-m-d H:i:s', $a)." -- M".date('Y-m-d H:i:s', $b)."</font> -- 文件：".str_replace(WEBPATH, '', $basedir."/".$file)." ".$rt." <br>",
                            ];
                        }
                    }
                }else{
                    $dirname = $basedir."/".$file;
                    checkdir($dirname);
                }
            }
        }
        closedir($dh);
    }
}

function checkBOM ($filename) {
    global $auto;
    $contents = @file_get_contents($filename);
    $charset[1] = substr($contents, 0, 1);
    $charset[2] = substr($contents, 1, 1);
    $charset[3] = substr($contents, 2, 1);
    $auto++;

    $times = [
        //'2023-03-23 14:28:08',
    ];
    if ($times) {
        foreach ($times as $time) {
            if (date('Y-m-d H:i:s',filectime($filename)) != $time) {
                return ("<font color=red>时间可疑</font>");
            }
        }
    }

    foreach ([
                 'baidu',
                 'xysword',
                 '"base64_decode"',
                 'httpGet(',
                 'curl_init',
                 'set_time_limit(0)',
                 'error_reporting(0)',
                 'base64'
             ] as $t) {
        if (stripos($contents, $t)) {
            return ("<font color=red>可疑代码：".$t."</font>");
        }
    }
    return '';
}