{"id":501,"date":"2013-07-23T22:32:34","date_gmt":"2013-07-23T14:32:34","guid":{"rendered":"http:\/\/www.kiccleaf.com\/?p=501"},"modified":"2013-07-23T22:32:34","modified_gmt":"2013-07-23T14:32:34","slug":"%e5%88%a9%e7%94%a8linux%e5%91%bd%e4%bb%a4find%e6%9f%a5%e6%89%bephp%e6%9c%a8%e9%a9%ac","status":"publish","type":"post","link":"http:\/\/www.kiccleaf.com\/?p=501","title":{"rendered":"\u5229\u7528Linux\u547d\u4ee4find\u67e5\u627ePHP\u6728\u9a6c"},"content":{"rendered":"

Linux\u672c\u8eab\u76f8\u5bf9Win\u6765\u8bb2\u5b89\u5168\u70b9\uff0c\u56e0\u4e3a\u597d\u591a\u4eba\u4e0d\u4f1a\u547d\u4ee4\uff0c\u8fd9\u5c31\u662f\u4f18\u70b9\u554a\uff01\u4f46\u7f51\u7ad9\u73b0\u5728\u5f00\u6e90\u7684\u8fd9\u4e48\u591a\uff0c\u6240\u4ee5\u6f0f\u6d1e\u4e5f\u76f8\u5bf9\u8f83\u591a\uff0c\u4e00\u4e0d\u5c0f\u5fc3\u7f51\u7ad9\u88ab\u4e0a\u4f20\u6728\u9a6c\u4e5f\u662f\u5e38\u6709\u7684\u4e8b\u60c5\u3002
\n\u6536\u96c6\u548c\u6574\u7406\u4e86\u4e00\u4e0b\u5229\u7528find\u547d\u4ee4\u6765\u67e5\u627e\u4e00\u4e0b\u662f\u5426\u7f51\u7ad9\u88ab\u79cd\u6728\u9a6c\u4e86\uff0c\u65e0\u975e\u662f\u6839\u636e\u6728\u9a6c\u7684\u7279\u5f81\u4ee3\u7801\u6765\u914d\u5bf9\u3002<\/p>\n

\r\nfind .\/ -name "*.php" |xargs egrep "phpspy|c99sh|milw0rm|eval\\(gunerpress|eval\\(base64_decode|spider_bc"> \/tmp\/php.txt\r\n\r\ngrep -r \u2013include=*.php  '[^a-z]eval($_POST' . > \/tmp\/eval.txt\r\n\r\ngrep -r \u2013include=*.php  'file_put_contents(.*$_POST\\[.*\\]);' . > \/tmp\/file_put_contents.txt\r\n\r\nfind .\/ -name "*.php" -type f -print0 | xargs -0 egrep "(phpspy|c99sh|milw0rm|eval\\(gzuncompress\\(base64_decode|eval\\(base64_decode|spider_bc|gzinflate)" | awk -F: '{print $1}' | sort | uniq\r\n<\/pre>\n
\u67e5\u627e\u6700\u8fd1\u4e00\u5929\u88ab\u4fee\u6539\u7684PHP\u6587\u4ef6<\/p>\n
\r\nfind -mtime -1 -type f -name \\*.php\r\n<\/pre>\n
\u4fee\u6539\u7f51\u7ad9php\u6587\u4ef6\u6743\u9650\uff0c\u53ea\u8bfb<\/p>\n
\r\nfind -type f -name \\*.php -exec chmod 444 {} \\;\r\n<\/pre>\n
\u4fee\u6539\u7f51\u7ad9\u76ee\u5f55\u6743\u9650<\/p>\n
\r\nfind .\/ -type d -exec chmod 555{} \\;\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"
Linux\u672c\u8eab\u76f8\u5bf9Win\u6765\u8bb2\u5b89\u5168\u70b9\uff0c\u56e0\u4e3a\u597d\u591a\u4eba\u4e0d\u4f1a…<\/p>\n
Continue reading\u5229\u7528Linux\u547d\u4ee4find\u67e5\u627ePHP\u6728\u9a6c<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"iawp_total_views":0,"footnotes":""},"categories":[6,4],"tags":[112,8,13],"class_list":["post-501","post","type-post","status-publish","format-standard","hentry","category-freebsd","category-linux-","tag-find","tag-freebsd","tag-linux","entry"],"views":7428,"_links":{"self":[{"href":"http:\/\/www.kiccleaf.com\/index.php?rest_route=\/wp\/v2\/posts\/501","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.kiccleaf.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.kiccleaf.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.kiccleaf.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.kiccleaf.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=501"}],"version-history":[{"count":0,"href":"http:\/\/www.kiccleaf.com\/index.php?rest_route=\/wp\/v2\/posts\/501\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.kiccleaf.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=501"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.kiccleaf.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=501"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.kiccleaf.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=501"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}