index.live.php

<?php

/**
 * Mike Snus' Simple Virus Scanner
 *
 * snus@sitebuilding.ru
 * sitebuilding.ru
 */

require '/usr/local/cpanel/php/cpanel.php';
require 'src/Account.php';
require 'src/hostname.php';

$cpanel = new CPANEL();
print $cpanel->header( "Simple Virus Scanner" );
$accountName = Account::name($cpanel);
$hostname = hostname($cpanel);

define('SVS_FILE_EXTENSIONS', "php,inc");
define('SVS_FORBIDDEN_DIRS', "img,images,upload,tmp,assets");
define('SVS_MAX_FILESIZE', 2100000);
define('SVS_VERSION', "1.02/2021-02-20");
?>

<link rel="stylesheet" type="text/css" href="assets/css/main.css" media="screen" />

<div class="container" style="width: auto">
        <div v-model=""></div>
        
        <div class="content">
        
<p>This simple file scanner is scanning PHP scripts in all folders for malicious code using several patterns. Each pattern has its 'weight', so the final score is made according to weight and infection probability.</p>
<p>Scanner does not clean files, you have to do it yourself. It only can help you to find the infected code.</p>

        
            <nav class="navbar navbar-default">
                <div class="container-fluid">
                    <ul class="nav navbar-nav">
<li><a href="https://pcx3.com/wp/how-to-check-if-file-is-infected/" target="_blank" style="">🔴 How to check if a file is actually infected</a></li>     
<li><a href="https://pcx3.com/wp/how-to-clean-up-hacked-wordpress-website-complete-guide/" target="_blank" style="">⚠️ How to clean a hacked WordPress website</a></li>                   
                    </ul>
                </div>
            </nav>


<?php
class RainbowCounter
{
	var $rainbowColors = ["#9b350c", "#009688", "#607d8b", "#03a9f4", "#9c27b0", "#673ab7", "#e91e63", "#ff9800", "#795548", "#cddc39", "#681676", "#4983dd", "#49ddd1", "#9b700c", "#e45023", "#a80b63", "#db246a", "#dd7128", "#e95a2f"];
	var $rainbowCnt = 0;
	var $isWeb = true;

	public function __construct($isWeb)
	{
		$this->isWeb = $isWeb;
	}

	public function rainbow($text)
	{
		if (!$this->isWeb) return $text;

		$text = "<span style='color:" . $this->rainbowColors[$this->rainbowCnt] . ";'>$text</span>";

		return $text;
	}

	public function reset()
	{
		$this->rainbowCnt = 0;
	}

	public function inc()
	{
		if ($this->rainbowCnt < count($this->rainbowColors) - 1) {
			$this->rainbowCnt++;
		} else {
			$this->rainbowCnt = 0;
		}
	}
}

class Scanner
{
	var $rootFolder = "";
	var $isWeb = true;
	var $scanList = [];
	var $forbiddenDirs = [];
	var $scanExtentions = [];
	private $selfSize = 0;
	private $selfCRC = "";
	private $totalFilesScanned = 0;
	private $totalFilesSuspicious = 0;
	private $totalFilesExcluded = 0;
	var $noSort = false;

	private $minScore = 6;

	public function __construct($rootFolder = __DIR__)
	{
		$this->rootFolder = ("/home/f32d23/");
		$this->isWeb = (php_sapi_name() !== 'cli');
		$options =  getopt('', ['html::', 'm::', 'root::', 'nosort::']);

		if (isset($options['html'])) $this->isWeb = true; //override with --html command line switch
		if (isset($_GET['plaintext'])) $this->isWeb = false; //override with URL parameter

		if (isset($options['root'])) $this->rootFolder = $options['root']; //override with --root command line switch

		if (isset($options['nosort'])) $this->noSort = true; //override with --nosort command line switch or parameter
		if (isset($_GET['nosort'])) $this->noSort = true;

		if (isset($options['m'])) $this->minScore = $options['m']; //set minimal reporting score via command line with --m=5 switch
		if (isset($_GET['m'])) $this->minScore = $_GET['m']; //set minimal reporting score via URL

		$this->selfSize = filesize(__FILE__);
		$this->selfCRC = crc32(file_get_contents(__FILE__));

 		$this->forbiddenDirs = explode(",", SVS_FORBIDDEN_DIRS);

		$exts = explode(",", SVS_FILE_EXTENSIONS);
		$this->scanExtentions = "~\.(" . join("|", $exts) . ")$~i";
	}

	/**
	 * Выводит сообщение об ошибке
	 */
	public function error($errorText)
	{
		if ($this->isWeb) {
			echo "<span style='color:red'>ERROR: </span><br>" . $errorText . "<br>";
		} else {
			echo ">> ERROR: " . $errorText . "\n";
		}
	}

	/**
	 * Выводит строку в правильном формате в зависимости от окружения
	 */
	private function out($message)
	{
		if ($this->isWeb) {
			echo $message . "<br>";
		} else {
			echo $message . "\n";
		}
	}

	/**
	 * Строит массив с файлами для последующего сканирования
	 */
	public function buildScanList($startDir = "", $level = 0)
	{
		// $this->out($startDir);
		$dirToScan = ($startDir != "") ? $this->rootFolder . "/" . $startDir : $this->rootFolder;
		if ($handle = opendir($dirToScan)) {
			$exts = $this->scanExtentions;

			$arrDirs  = [];
			$arrFiles = [];

			while (false !== ($entry = readdir($handle))) {
				if ($entry != "." && $entry != "..") {
					if (is_dir($dirToScan . "/" . $entry) && !is_link($dirToScan . "/" . $entry)) {
						$arrDirs[] = $entry;
					} else {
						//extension is in the list and the file is not self
						if (preg_match($exts, $entry) > 0 && $dirToScan . "/" . $entry !== __FILE__) {
							$arrFiles[] = $entry;
						}
					}
				}
			}

			closedir($handle);

			asort($arrDirs);
			asort($arrFiles);

			foreach ($arrFiles as $entry) {
				$dirPath = ($startDir != "") ? $startDir : "/";
				$this->totalFilesScanned++;
				$id = $this->totalFilesScanned;
				$this->scanList[$id]['dir'] = $dirPath;
				$this->scanList[$id]['name'] = $entry;
				$this->scanList[$id]['score'] = 0;
				$this->scanList[$id]['level'] = $level;
				$this->scanList[$id]['diag'] = [];
			}

			unset($arrFiles);

			foreach ($arrDirs as $entry) {
				$this->buildScanList($startDir . "/" . $entry, $level + 1);
			}
		} else {
			
		}
	}

	/**
	 * Проверяет путь и имя файла на совпадение со списком файлов-исключений
	 */
	function isExclusion($dirPath, $fileName)
	{
		$fullPath = ($dirPath == "/") ? $this->rootFolder : $this->rootFolder . $dirPath;
		$file = $fullPath . "/" . $fileName;
		$arrWhitelist = ['snusminer.php',
		'/administrator/components/com_akeeba/BackupEngine/Archiver/Jpa.php',
		'/administrator/components/com_akeeba/BackupEngine/Archiver/Jps.php',
		'/administrator/components/com_akeeba/BackupEngine/Archiver/Zip.php',
		'/administrator/components/com_akeeba/BackupEngine/Postproc/Sugarsync.php',
		'/administrator/components/com_akeeba/restore.php',
		'/administrator/components/com_akeeba/View/Upload/tmpl/default.php',
		'/administrator/components/com_akeeba/View/Upload/tmpl/done.php',
		'/administrator/components/com_akeeba/View/Upload/tmpl/error.php',
		'/administrator/components/com_akeeba/View/Upload/tmpl/uploading.php',
		'/administrator/components/com_finder/helpers/indexer/stemmer/fr.php',
		'/administrator/components/com_joomlaupdate/views/upload/tmpl/captive.php',
		'/administrator/components/com_media/views/images/tmpl/default.php',
		'/image_uploader/localization.php',
		'/libraries/idna_convert/idna_convert.class.php',
		'/libraries/vendor/joomla/string/src/phputf8/native/core.php',
		'/modules/fileman/classes/general/sticker.php',
		'/modules/iblock/admin/iblock_edit.php',
		'/modules/iblock/admin/iblock_element_admin.php',
		'/modules/iblock/admin/iblock_list_admin.php',
		'/modules/iblock/admin/templates/iblock_subelement_list.php',
		'/modules/iblock/classes/general/comp_pricetools.php',
		'/modules/main/admin/group_edit.php',
		'/modules/main/admin/restore.php',
		'/modules/main/admin/site_checker.php',
		'/modules/main/classes/general/backup.php',
		'/modules/main/classes/general/cache_files.php',
		'/modules/main/classes/general/cache_html.php',
		'/modules/main/classes/general/punycode.php',
		'/modules/main/classes/general/usertypedbl.php',
		'/modules/main/classes/general/virtual_io_filesystem.php',
		'/modules/main/classes/general/zip.php',
		'/modules/main/lib/io/directory.php',
		'/modules/main/tools.php',
		'administrator/components/com_joomlaupdate/restore.php',
		'modules/defa.socialmediaposter/classes/general/idna_convert.class.php',
		];

		$isEx =  false;

		//себя тоже добавляем в список исключений
		if ($fileName == __FILE__) {
			$isEx = true;
		}

		foreach($arrWhitelist as $wl) {
			if (strstr($file, $wl) !== false) {
				$isEx = true;
				break;
			}
		}

		return $isEx;
	}

	/**
	 * Сканируем файл на опасные факторы
	 */

	function scanFile($id)
	{
		//reset rainbow counter
		$rbc = new RainbowCounter($this->isWeb);

		/* no php files should be placed in forbidden dirs */
		$entry = &$this->scanList[$id];
		$dirPath = $entry['dir'];
		$fileName = $entry['name'];

		//script files should not be placed in suspicious directories
		foreach ($this->forbiddenDirs as $fd) {
			if (preg_match("~\/" . $fd . "[/$]~i", $dirPath) > 0) {
				$entry['score'] = $entry['score'] + 50;
				$entry['diag']['susp_dir'] = $rbc->rainbow('suspicious dir \''.$fd.'\'');
				break;
			}
		}
		$rbc->inc();


		$contents = "";
		$fullPath = ($dirPath == "/") ? $this->rootFolder : $this->rootFolder . $dirPath;
		if (filesize($fullPath . "/" . $fileName) < SVS_MAX_FILESIZE) {
			$contents = file_get_contents($fullPath . "/" . $fileName);
		} else {
			$this->error("File too big: " . $fullPath . "/" . $fileName. " (". filesize($fullPath . "/" . $fileName). ")");
			$entry['score'] = $entry['score'] + 50;
			$entry['diag']['too_big'] = $rbc->rainbow('file too big');
			return true;
		}
		$rbc->inc();

		if ($contents === false) {
			$this->error("Cannot read " . $fullPath . "/" . $fileName);
			$entry['score'] = $entry['score'] + 50;
			$entry['diag']['cant_read'] = $rbc->rainbow('can\'t read');
			return true;
		}
		$rbc->inc();


		//escaped sequence like \x47\x4c\x4f\x42\x41
		if (preg_match('~(\\\x[a-z0-9]{2,3}){3,}~', $contents) > 0) {
			$entry['score'] = $entry['score'] + 10;
			$entry['diag']['esc_seq'] = $rbc->rainbow('escape sequence');
		}
		$rbc->inc();

		//muted call to variable like @${"
		if (preg_match('~@\$\{\"~', $contents) > 0) {
			$entry['score'] = $entry['score'] + 30;
			$entry['diag']['weird_constr'] = $rbc->rainbow('weird construction');
		}
		$rbc->inc();


		//very long letter & digit string more than 1 time
		$matches = [];
		$cnt = preg_match_all('~[a-zA-Z0-9]{35,}~', $contents);
		if ($cnt > 1) {
			$entry['score'] = $entry['score'] + 5 + floor($cnt / 5)*5;
			$entry['diag']['long_id'] = $rbc->rainbow('long identifier (x' . $cnt . ')');
		}
		$rbc->inc();

		//usage of base64_decode
		if (preg_match('~base64_decode~', $contents) > 0) {
			$entry['score'] = $entry['score'] + 10;
			$entry['diag']['base64'] = $rbc->rainbow('base64_decode()');
		}
		$rbc->inc();

		//usage of php_uname
		if (preg_match('~php_uname~', $contents) > 0) {
			$entry['score'] = $entry['score'] + 20;
			$entry['diag']['php_uname'] = $rbc->rainbow('php_uname()');
		}
		$rbc->inc();

		//usage of chr() function like chr(56)
		$matches = [];
		$cnt = preg_match_all('~chr\(\d{2,3}\)~', $contents, $matches);
		if ($cnt > 0) {
			$entry['score'] = $entry['score'] + 5 + floor($cnt / 10)*5;
			$entry['diag']['chr'] = $rbc->rainbow('chr() (x' . $cnt . ')');
		}
		$rbc->inc();

		//usage of shell_exec() function
		if (preg_match('~shell_exec\s*\(~', $contents) > 0) {
			$entry['score'] = $entry['score'] + 50;
			$entry['diag']['shell_exec'] = $rbc->rainbow('shell_exec()');
		}
		$rbc->inc();

		//usage of chmod() function
		$matches = [];
		$cnt = preg_match_all('~chmod\s*\(~', $contents, $matches);
		if ($cnt > 0) {
			$entry['score'] = $entry['score'] + 10;
			$entry['diag']['chmod'] = $rbc->rainbow('chmod()');
		}
		$rbc->inc();

		//weird variable names like $xwbl209{30}
		if (preg_match('~\$[a-zA-Z0-9]{5,}\{\d{2}}~', $contents) > 0) {
			$entry['score'] = $entry['score'] + 30;
			$entry['diag']['weird_var'] = $rbc->rainbow('weird variables');
		}
		$rbc->inc();


		//usage of hex codes several times like 0x0080
		$matches = [];
		$cnt = preg_match_all('~0x[0-9A-F]{4}~', $contents, $matches);
		if ($cnt > 3) {
			$entry['score'] = $entry['score'] + 5 + floor($cnt / 20);
			$entry['diag']['hex'] = $rbc->rainbow('hex codes (x' . $cnt . ")");
		}
		$rbc->inc();

		//usage of eval() function
		$matches = [];
		$cnt = preg_match_all('~eval\(~', $contents, $matches);
		if ($cnt > 0) {
			$entry['score'] = $entry['score'] + 10 + floor($cnt / 5)*5;
			$entry['diag']['eval'] = $rbc->rainbow('eval()');
		}
		$rbc->inc();

		//usage of fileperms() function
		$matches = [];
		$cnt = preg_match_all('~fileperms\(~', $contents, $matches);
		if ($cnt > 0) {
			$entry['score'] = $entry['score'] + 10 + floor($cnt / 5)*5;
			$entry['diag']['fileperms'] = $rbc->rainbow('fileperms()');
		}
		$rbc->inc();


		//usage of gzinflate() function
		if (preg_match('~gzinflate\(~', $contents) > 0) {
			$entry['score'] = $entry['score'] + 10;
			$entry['diag']['gzinflate'] = $rbc->rainbow('gzinflate()');
		}
		$rbc->inc();

		//usage of register_shutdown_function() function
		if (preg_match('~register_shutdown_function\(~', $contents) > 0) {
			$entry['score'] = $entry['score'] + 5;
			$entry['diag']['register_shutdown_function'] = $rbc->rainbow('register_shutdown_function()');
		}
		$rbc->inc();

		//usage of goto function
		if (preg_match('~[^"a-zA-Z0-9_$]goto\s~', $contents) > 0) {
			$entry['score'] = $entry['score'] + 20;
			$entry['diag']['goto'] = $rbc->rainbow('goto');
		}
		$rbc->inc();

		//usage of upload form
		if (preg_match('~enctype\s*=\s*[\'"]multipart/form-data[\'"]~i', $contents) > 0) {
			$entry['score'] = $entry['score'] + 5;
			$entry['diag']['upload'] = $rbc->rainbow('upload form');
		}
		$rbc->inc();

		//include from $_GET
		if (preg_match('~include\s*\([^;]*\$_GET~Uis', $contents) > 0) {
			$entry['score'] = $entry['score'] + 50;
			$entry['diag']['include_get'] = $rbc->rainbow('include from $_GET');
		}
		$rbc->inc();

		//script files should not be placed in suspicious directories
		foreach ($this->forbiddenDirs as $fd) {
			if (preg_match("~include\s*\([^;]*\/".$fd."[^a-zA-Z0-9]~is", $contents) > 0) {
				$entry['score'] = $entry['score'] + 50;
				$entry['diag']['susp_include'] = $rbc->rainbow('include in \''.$fd.'\'');
				break;
			}


		}
		$rbc->inc();

		//usage of $USER->Authorize() function with int parameter
		if (preg_match('~\$USER->Authorize\([^\$]~', $contents) > 0) {
			$entry['score'] = $entry['score'] + 50;
			$entry['diag']['authorize'] = $rbc->rainbow('authorize()');
		}
		$rbc->inc();




		/* counting totals */

		//more than 2 alert types
		if (count($entry['diag']) > 2) {
			$entry['score'] = $entry['score'] + 20;
		}

		$entry['exclusion'] =  $this->isExclusion($dirPath, $fileName);
	}


/**
 * Запускает сканирование каждого файла в списке
 */
	public function scanFiles()
	{
		foreach ($this->scanList as $id => $entry) {
				$this->scanFile($id);
		}
	}

	/**
	 * Используется для отладки
	 */
	private function pre($var, $export =  false)
	{
		if ($this->isWeb) echo ("<pre>");

		if ($export) {
			var_export($var);
		} else {
			$this->out($var);
		}

		if ($this->isWeb) echo ("</pre>");
	}

	/**
	 * Сортирует список сканирования
	 */
	public function sortScanList(){
		global $noSort;
		$noSort = $this->noSort;

		function comp1($a, $b){
			global $noSort;
			if ($a["exclusion"] || $b["exclusion"] ) {
				if ($a["exclusion"] && $b["exclusion"]) {
					if ($noSort) return 0;
					return ($a["score"] > $b["score"]) ? -1 : 1;
				} else {
					return 1;
				}
			} else {
				if ($noSort) return 0;
				if ($a["score"] == $b["score"]) return 0;
				return ($a["score"] > $b["score"]) ? -1 : 1;
			}
		}

		usort($this->scanList, "comp1");
	}

	/**
	 * Выводит отчёт по результатам сканирования
	 */
	public function printScanList()
	{
		$marker = $this->isWeb ? "&bull;" : "+";

		$this->out('Minimal reporting score: '.$this->minScore);

		if ($this->isWeb) {
			ob_start();
			echo ("<html>
			<head>
			<title>SVS anti-virus file scanner</title>
			<style>
			body {
				font-family: Arial;
				font-size: 16px;
			}
			table {
				font-family: Arial;
				font-size: 16px;
				margin: 0 auto;
			}
			th {
				background-color: #e7eff5;
				padding: 10px;
			}
			td{
				border-bottom: solid 1px #eee;
				vertical-align: text-top;
				padding-right: 20px;
				height: 24px;
			}
			table tr td:nth-child(1) {
				text-align: left;
			}
			table tr td:nth-child(2) {
				text-align: right;
			}
			table tr td:nth-child(3) {
				font-size: 13px;
			}
			.directory {
				color: #765a16;
			}
			.marker {
				color: #ff0000;
				font-size: 30px;
			}
			.exclusion {
				color: #4caf50;
			}
			</style>
			</head>
			<body>
			</br>
			<table border='0' cellpadding='2' cellspacing='0'>
			<tr>
				<th>FILE</th>
				<th>SCORE</th>
				<th>ALERTS</th>
			</tr>
			");
		} else {
			$this->out("-- Running SVS anti-virus file scanner --");
		}

		foreach ($this->scanList as $entry) {
			$dir = $entry['dir'];
			$dirname = ($dir == "/" || $dir == "") ? "/" : substr($dir, 1) . "/";
			$dirname = $this->isWeb ? "<span class='directory'>" . $dirname . "</span>" : "" . $dirname . "";


			if ($entry['score'] > $this->minScore) {
				$markerCount = floor($entry['score'] / 10);
				if ($markerCount > 10) $markerCount = 10;

				if ($this->isWeb) {
					echo ("
						<tr>
							<td ".(($entry['exclusion']) ? " class='exclusion'" :	"").">$dirname<b>" . $entry['name'] . "</b> </td>
							<td>" . (($entry['exclusion']) ?
										" <span class='exclusion'>X</span>" :
										"<span class='marker'>".  str_repeat("$marker",  $markerCount) . "</span>") .
							" [".$entry['score']."]
							</td>
							<td>" . join(", ", $entry['diag']) . "</td>
						</tr>
						");
						ob_flush();
				} else {
					$name =  $entry['name'];
					$this->out((($entry['exclusion']) ? "X " : str_repeat("$marker",  $markerCount))  . " [".$entry['score']."] " . $dirname . $name .
						" [" . join(", ", $entry['diag']) . "]");
				}

				if ($entry['exclusion']) {
					$this->totalFilesExcluded++;
				} else {
					$this->totalFilesSuspicious++;
				}
			}

		}

		if ($this->isWeb) {
			echo ("</table>");
			ob_end_flush();
		}


		
		$this->out("</br> Total scanned files: " . $this->totalFilesScanned);
		$this->out("Total suspicious files: " . $this->totalFilesSuspicious." + ".$this->totalFilesExcluded." excluded.");
	}
}

$scanner = new Scanner();
$scanner->buildScanList();
$scanner->scanFiles();
$scanner->sortScanList();
$scanner->printScanList();
?>

<script src="https://code.jquery.com/jquery-3.5.0.js"></script>

<?php
echo $cpanel->footer();
$cpanel->end();