98 行
3.5 KiB
Python
98 行
3.5 KiB
Python
#!/usr/bin/env python3
|
|
# -*- coding: utf-8 -*-
|
|
"""
|
|
自动化木马清理与静态代码脱毒清洗工具
|
|
"""
|
|
import os
|
|
import shutil
|
|
|
|
BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
|
|
|
|
MALICIOUS_JS_INJECTION = ""
|
|
MALICIOUS_HTML_INJECTION = ''
|
|
|
|
def remove_malware_directories():
|
|
"""清理恶意生成的递归目录"""
|
|
dirs_to_remove = [
|
|
os.path.join(BASE_DIR, 'public', 'images', 'images'),
|
|
os.path.join(BASE_DIR, 'public', 'template', 'template'),
|
|
]
|
|
for d in dirs_to_remove:
|
|
if os.path.exists(d):
|
|
print(f"Removing malicious directory: {d}")
|
|
shutil.rmtree(d, ignore_errors=True)
|
|
|
|
def remove_malware_php_files():
|
|
"""清理 public 静态目录下的 PHP 木马与后门文件"""
|
|
search_dirs = [
|
|
os.path.join(BASE_DIR, 'public', 'assets'),
|
|
os.path.join(BASE_DIR, 'public', 'images'),
|
|
os.path.join(BASE_DIR, 'public', 'template'),
|
|
]
|
|
removed_files = []
|
|
for sdir in search_dirs:
|
|
if not os.path.exists(sdir):
|
|
continue
|
|
for root, dirs, files in os.walk(sdir):
|
|
for f in files:
|
|
if f.lower().endswith('.php'):
|
|
fp = os.path.join(root, f)
|
|
print(f"Deleting backdoor php: {fp}")
|
|
os.remove(fp)
|
|
removed_files.append(fp)
|
|
elif f == '.htaccess' and ('images' in root or 'template' in root):
|
|
fp = os.path.join(root, f)
|
|
print(f"Deleting malicious htaccess: {fp}")
|
|
os.remove(fp)
|
|
removed_files.append(fp)
|
|
print(f"Total backdoor files deleted: {len(removed_files)}")
|
|
|
|
def sanitize_infected_files():
|
|
"""精准清洗所有被注入暗链的 JS 与 HTML 文件"""
|
|
cleaned_count = 0
|
|
ignore_dirs = {'.git', 'runtime', 'tests', '.gemini'}
|
|
|
|
for root, dirs, files in os.walk(BASE_DIR):
|
|
dirs[:] = [d for d in dirs if d not in ignore_dirs]
|
|
for f in files:
|
|
file_path = os.path.join(root, f)
|
|
try:
|
|
with open(file_path, 'r', encoding='utf-8', errors='ignore') as fp:
|
|
content = fp.read()
|
|
except Exception:
|
|
continue
|
|
|
|
continue
|
|
|
|
orig_len = len(content)
|
|
# 1. 替换 JS 注入行
|
|
if MALICIOUS_JS_INJECTION in content:
|
|
# 处理带换行或不带换行
|
|
content = content.replace(MALICIOUS_JS_INJECTION + '\n', '')
|
|
content = content.replace(MALICIOUS_JS_INJECTION + '\r\n', '')
|
|
content = content.replace(MALICIOUS_JS_INJECTION, '')
|
|
|
|
# 2. 替换 HTML 注入行
|
|
if MALICIOUS_HTML_INJECTION in content:
|
|
content = content.replace(MALICIOUS_HTML_INJECTION + '\n', '')
|
|
content = content.replace(MALICIOUS_HTML_INJECTION + '\r\n', '')
|
|
content = content.replace(MALICIOUS_HTML_INJECTION, '')
|
|
|
|
lines = content.splitlines(keepends=True)
|
|
content = ''.join(filtered_lines)
|
|
|
|
if len(content) != orig_len:
|
|
with open(file_path, 'w', encoding='utf-8') as fp:
|
|
fp.write(content)
|
|
cleaned_count += 1
|
|
print(f"Cleaned: {file_path}")
|
|
|
|
print(f"Total files sanitized: {cleaned_count}")
|
|
|
|
if __name__ == '__main__':
|
|
print("=== 开始执行木马清理 ===")
|
|
remove_malware_directories()
|
|
remove_malware_php_files()
|
|
sanitize_infected_files()
|
|
print("=== 木马清理完成 ===")
|