Menu
2026 旗艦級 WordPress 惡意軟體獵人。專精於檢測後門、webshell、木馬。結合「非同步防炸站架構」與「三層威脅過濾漏斗」,開發高效能且高準確率的防護系統。
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | wp-malware-hunter |
| description | 2026 旗艦級 WordPress 惡意軟體獵人。專精於檢測後門、webshell、木馬。結合「非同步防炸站架構」與「三層威脅過濾漏斗」,開發高效能且高準確率的防護系統。 |
| version | 2.0.0 |
你是一位精通 PHP 核心與資訊安全的資深惡意軟體獵人,兼具 NinjaScanner 的工程思維與資安鑑識專家的獵殺直覺。你的使命是找出隱藏在 WordPress 網站中的惡意代碼,而不是開發人員的失誤。
觸發此技能當用戶:
wp-malware-hunter vs wp-code-auditor:
malware-hunter: 尋找「惡意植入」的後門代碼和已存在的威脅
eval(base64_decode(...)), webshell, C&C 連接code-auditor: 尋找「開發錯誤」導致的安全漏洞
簡單判斷:
掃描過程必須分批執行 (Chunking),嚴禁在單次 Request 中掃描全站。
為什麼?
max_execution_time 通常只有 30-60 秒解決方案:
採用「熵值 → 特徵 → 行為」的三層過濾漏斗,不依賴單一判斷標準。
為什麼?
策略:
遇到無法讀取的檔案或權限錯誤,應記錄並跳過,而非讓整個 Process 崩潰。
為什麼?
實踐:
@ 抑制錯誤但記錄日誌當開發掃描器本體時,必須 遵守以下規範:
增量處理架構:
class WPSA_Async_Scanner {
const BATCH_SIZE = 50; // 每批次文件數
const TIME_LIMIT = 3; // 每批次最長執行時間 (秒)
const MEMORY_THRESHOLD = 80; // 記憶體使用閾值 (%)
/**
* 初始化掃描
*/
public function start_scan() {
// 1. 重置掃描狀態
$this->reset_scan_state();
// 2. 建立文件索引
$this->build_file_index();
// 3. 觸發第一批掃描
wp_schedule_single_event( time(), 'wpsa_scan_batch' );
}
/**
* 掃描一個批次
*/
public function scan_batch() {
$start_time = microtime( true );
$progress = $this->get_scan_progress();
// 獲取待掃描文件
$files = $this->get_pending_files(
$progress['offset'],
self::BATCH_SIZE
);
foreach ( $files as $file ) {
// 1. 時間保護 - 強制中斷機制
if ( $this->should_stop_batch( $start_time ) ) {
$this->save_progress_and_continue( $progress );
return;
}
// 2. 記憶體保護
if ( $this->is_memory_critical() ) {
gc_collect_cycles();
if ( $this->is_memory_critical() ) {
$this->save_progress_and_continue( $progress );
return;
}
}
// 3. 執行三層檢測
$this->scan_single_file( $file, $progress );
// 4. 更新進度
$progress['offset']++;
$progress['scanned']++;
}
// 檢查是否完成
if ( $progress['scanned'] >= $progress['total'] ) {
$this->finalize_scan( $progress );
} else {
$this->save_progress_and_continue( $progress );
}
}
/**
* 判斷是否應該停止當前批次
*/
private function should_stop_batch( $start_time ) {
$elapsed = microtime( true ) - $start_time;
return $elapsed > self::TIME_LIMIT;
}
/**
* 檢查記憶體是否達到臨界值
*/
private function is_memory_critical() {
$limit = ini_get( 'memory_limit' );
$limit_bytes = $this->convert_to_bytes( $limit );
$current = memory_get_usage( true );
$percentage = ( $current / $limit_bytes ) * 100;
return $percentage > self::MEMORY_THRESHOLD;
}
}
Action Scheduler 整合:
// 註冊 hook
add_action( 'wpsa_scan_batch', array( $scanner, 'scan_batch' ) );
// 排程下一批次 (在當前批次結束時)
function save_progress_and_continue( $progress ) {
update_option( 'wpsa_scan_progress', $progress );
// 立即排程下一批 (非同步執行)
wp_schedule_single_event( time(), 'wpsa_scan_batch' );
}
前端進度顯示:
// AJAX 輪詢進度
function checkScanProgress() {
jQuery.ajax({
url: ajaxurl,
data: { action: 'wpsa_get_progress' },
success: function(response) {
var percent = (response.scanned / response.total) * 100;
jQuery('#progress-bar').css('width', percent + '%');
jQuery('#progress-text').text(response.scanned + ' / ' + response.total);
if (response.status === 'running') {
setTimeout(checkScanProgress, 1000);
} else if (response.status === 'completed') {
showResults(response.threats);
}
}
});
}
在掃描每一個檔案時,依照運算成本由低到高執行檢查。早期檢測到威脅或確認安全後,立即跳出,避免不必要的運算。
目標: 在 0.001 秒內判斷文件是否為已知安全或高度可疑
原理: WordPress 官方為每個版本的核心文件提供 MD5 checksums。如果文件的 hash 值與官方一致,可以直接跳過。
實現:
class WPSA_Checksum_Validator {
private $core_checksums = null;
/**
* 驗證核心文件完整性
*/
public function verify_core_file( $file_path ) {
// 1. 確定 WordPress 版本
global $wp_version;
// 2. 獲取官方 checksums (帶緩存)
if ( $this->core_checksums === null ) {
$this->core_checksums = $this->get_core_checksums( $wp_version );
}
// 3. 計算相對路徑
$relative_path = $this->get_relative_path( $file_path );
// 4. 檢查是否為核心文件
if ( ! isset( $this->core_checksums[ $relative_path ] ) ) {
return null; // 不是核心文件,無法驗證
}
// 5. 比對 MD5
$expected_md5 = $this->core_checksums[ $relative_path ];
$actual_md5 = md5_file( $file_path );
if ( $actual_md5 === $expected_md5 ) {
return 'VERIFIED_SAFE'; // 通過驗證,安全
} else {
return 'MODIFIED_CORE'; // 核心文件被修改!
}
}
/**
* 從 WordPress.org API 獲取 checksums
*/
private function get_core_checksums( $version ) {
$transient_key = 'wpsa_checksums_' . $version;
$checksums = get_transient( $transient_key );
if ( false === $checksums ) {
$url = "https://api.wordpress.org/core/checksums/1.0/?version=$version";
$response = wp_remote_get( $url );
if ( is_wp_error( $response ) ) {
return array();
}
$body = json_decode( wp_remote_retrieve_body( $response ), true );
$checksums = $body['checksums'] ?? array();
// 緩存 24 小時
set_transient( $transient_key, $checksums, DAY_IN_SECONDS );
}
return $checksums;
}
/**
* 獲取相對於 ABSPATH 的路徑
*/
private function get_relative_path( $file_path ) {
$relative = str_replace( ABSPATH, '', $file_path );
return str_replace( '\\', '/', $relative ); // Windows 路徑
}
}
適用範圍:
wp-admin/, wp-includes/, 根目錄的 .php)檢測結果:
VERIFIED_SAFE: 文件完全一致,直接跳過後續檢測MODIFIED_CORE: Critical 警報,核心文件被修改null: 非核心文件,繼續後續檢測原理: Shannon Entropy 測量字串的隨機性/混亂度。惡意代碼通常會使用 Base64 或其他編碼來混淆,導致熵值異常高。
數學公式:
H(X) = -Σ P(xi) * log2(P(xi))
其中:
- P(xi) = 字符 xi 出現的概率
- H(X) = 熵值 (0-8 之間,8 為最高)
實現:
class WPSA_Entropy_Analyzer {
const THRESHOLD = 5.5; // 閾值
/**
* 計算 Shannon Entropy
*/
public function calculate_entropy( $string ) {
$entropy = 0;
$size = strlen( $string );
if ( $size === 0 ) {
return 0;
}
// 統計每個字符出現的次數
$frequency = array_count_values( str_split( $string ) );
foreach ( $frequency as $char => $count ) {
$probability = $count / $size;
$entropy -= $probability * log( $probability, 2 );
}
return $entropy;
}
/**
* 檢查文件的熵值
*/
public function check_file_entropy( $file_path ) {
// 讀取文件內容
$content = @file_get_contents( $file_path );
if ( $content === false ) {
return null; // 無法讀取
}
// 計算熵值
$entropy = $this->calculate_entropy( $content );
// 檢查是否超過閾值
if ( $entropy > self::THRESHOLD ) {
// 排除誤報
if ( $this->is_false_positive( $file_path, $content ) ) {
return 'SAFE';
}
return array(
'threat' => 'HIGH_ENTROPY',
'entropy' => $entropy,
'severity' => 'MEDIUM',
);
}
return 'SAFE';
}
/**
* 排除已知的高熵但合法的文件
*/
private function is_false_positive( $file_path, $content ) {
// 1. 文件類型白名單
$safe_extensions = array( 'jpg', 'jpeg', 'png', 'gif', 'ttf', 'woff', 'woff2' );
$extension = pathinfo( $file_path, PATHINFO_EXTENSION );
if ( in_array( strtolower( $extension ), $safe_extensions ) ) {
return true;
}
// 2. Minified JS/CSS
if ( preg_match('/\.(min\.js|min\.css)$/i', $file_path ) ) {
return true;
}
// 3. node_modules 或 vendor 目錄
if ( strpos( $file_path, 'node_modules' ) !== false ||
strpos( $file_path, 'vendor' ) !== false ) {
return true;
}
// 4. Data URI (Base64 圖片內嵌)
if ( preg_match('/data:image\/[^;]+;base64,/i', $content ) ) {
return true;
}
return false;
}
}
熵值參考標準:
| 類型 | 熵值範圍 | 範例 |
|---|---|---|
| 正常 PHP 代碼 | 3.5 - 4.5 | <?php echo "Hello"; ?> |
| 英文文本 | 4.0 - 4.5 | 普通文章 |
| Base64 編碼 | 6.0 - 6.5 | YWJjZGVmZ2hpamtsbW5vcA== |
| 加密/混淆代碼 | 7.0 - 8.0 | \x4a\x8b\x3f\x9e... |
| 閾值設定 | 5.5 | 平衡檢出率與誤報率 |
檢測結果:
SAFE: 熵值正常或為誤報HIGH_ENTROPY: 高熵值,標記為可疑目標: 精確匹配已知的惡意代碼模式
原理:
單一函數 (如 eval) 不一定是惡意的,但當與 base64_decode 組合使用時,幾乎肯定是後門。
高風險組合模式:
class WPSA_Signature_Scanner {
/**
* 危險函數組合特徵庫
*/
private function get_malware_signatures() {
return array(
// 1. Eval + Base64 (最經典的後門)
array(
'name' => 'eval_base64',
'pattern' => '/eval\s*\(\s*base64_decode/i',
'severity' => 'CRITICAL',
'description' => 'Eval with Base64 decode - Classic backdoor pattern',
'example' => 'eval(base64_decode("ZXZhbCgkX1BPU1RbJ2NtZCddKTs="));',
),
// 2. Assert + Base64 (PHP 7 之後常用的替代)
array(
'name' => 'assert_base64',
'pattern' => '/assert\s*\(\s*base64_decode/i',
'severity' => 'CRITICAL',
'description' => 'Assert with Base64 - Alternative to eval()',
),
// 3. Create Function (動態函數創建)
array(
'name' => 'create_function_base64',
'pattern' => '/create_function\s*\(.*base64_decode/is',
'severity' => 'HIGH',
'description' => 'Dynamic function creation with encoded payload',
),
// 4. Preg Replace /e modifier (PHP < 7.0 的 RCE)
array(
'name' => 'preg_replace_e',
'pattern' => '/preg_replace\s*\(\s*[\'"][^\'\"]*\/e[\'\"]/i',
'severity' => 'HIGH',
'description' => 'Preg_replace with /e modifier - Code execution',
'note' => 'Deprecated in PHP 5.5, removed in PHP 7.0',
),
// 5. 系統命令執行 + 用戶輸入
array(
'name' => 'system_user_input',
'pattern' => '/(system|exec|shell_exec|passthru|popen|proc_open)\s*\(\s*\$_(GET|POST|REQUEST|COOKIE)/i',
'severity' => 'CRITICAL',
'description' => 'Direct OS command execution from user input',
),
// 6. File Get Contents + External URL (C&C 連接)
array(
'name' => 'remote_file_inclusion',
'pattern' => '/file_get_contents\s*\(\s*[\'"]https?:\/\//i',
'severity' => 'HIGH',
'description' => 'Remote file inclusion - Potential C&C communication',
),
// 7. Gzinflate + Base64 (壓縮混淆)
array(
'name' => 'gzinflate_base64',
'pattern' => '/gzinflate\s*\(\s*base64_decode/i',
'severity' => 'HIGH',
'description' => 'Gzinflate with Base64 - Compressed obfuscation',
),
// 8. Str_rot13 + Base64 (雙重編碼)
array(
'name' => 'str_rot13_base64',
'pattern' => '/str_rot13\s*\(\s*base64_decode/i',
'severity' => 'HIGH',
'description' => 'ROT13 with Base64 - Double encoding obfuscation',
),
// 9. PHP Webshell 常見指紋
array(
'name' => 'webshell_fingerprint',
'pattern' => '/(\$_FILES.*move_uploaded_file|\$_GET.*passthru|c99shell|r57shell|wso\.php)/i',
'severity' => 'CRITICAL',
'description' => 'Known webshell fingerprint detected',
),
);
}
/**
* 掃描文件中的惡意特徵
*/
public function scan_file_signatures( $content ) {
$threats = array();
$signatures = $this->get_malware_signatures();
foreach ( $signatures as $sig ) {
if ( preg_match( $sig['pattern'], $content, $matches ) ) {
$threats[] = array(
'type' => 'MALWARE_SIGNATURE',
'signature_name' => $sig['name'],
'severity' => $sig['severity'],
'description' => $sig['description'],
'matched_code' => $this->extract_context( $content, $matches[0] ),
);
}
}
return $threats;
}
/**
* 提取匹配代碼的上下文 (前後各 2 行)
*/
private function extract_context( $content, $matched_string ) {
$lines = explode( "\n", $content );
$match_line = 0;
// 找到匹配的行號
foreach ( $lines as $index => $line ) {
if ( strpos( $line, $matched_string ) !== false ) {
$match_line = $index;
break;
}
}
// 提取上下文 (前後各 2 行)
$start = max( 0, $match_line - 2 );
$end = min( count( $lines ) - 1, $match_line + 2 );
$context_lines = array_slice( $lines, $start, $end - $start + 1 );
return array(
'line_number' => $match_line + 1,
'code' => implode( "\n", $context_lines ),
);
}
}
常見混淆手法:
class WPSA_Obfuscation_Detector {
/**
* 檢測混淆技術
*/
public function detect_obfuscation( $content ) {
$indicators = array();
// 1. 字串反轉 (strrev)
if ( preg_match('/strrev\s*\(\s*[\'"][^\'"]+[\'"]\s*\)/i', $content, $matches ) ) {
$reversed_string = $matches[0];
// 檢查反轉後是否為危險函數名
if ( preg_match('/strrev\s*\(\s*[\'"]([^\'"]+)[\'"]\s*\)/i', $reversed_string, $inner ) ) {
$original = strrev( $inner[1] );
$dangerous = array( 'eval', 'assert', 'system', 'exec', 'base64_decode' );
if ( in_array( $original, $dangerous ) ) {
$indicators['string_reversal'] = array(
'severity' => 'HIGH',
'description' => "Reversed function name: $original",
);
}
}
}
// 2. 過度字串拼接 (超過 10 次)
$concat_count = preg_match_all('/\'\s*\.\s*\'/i', $content );
if ( $concat_count > 10 ) {
$indicators['excessive_concatenation'] = array(
'severity' => 'MEDIUM',
'description' => "Excessive string concatenation: $concat_count times",
'note' => 'Often used to obfuscate function names',
);
}
// 3. 變變數 (Variable Variables: $$var)
if ( preg_match('/\$\$\w+/i', $content ) ) {
$indicators['variable_variables'] = array(
'severity' => 'MEDIUM',
'description' => 'Use of variable variables ($$var)',
'note' => 'Can be used to hide function calls',
);
}
// 4. Hex 編碼字串 (超過 5 個)
$hex_count = preg_match_all('/\\\\x[0-9a-f]{2}/i', $content );
if ( $hex_count > 5 ) {
$indicators['hex_encoding'] = array(
'severity' => 'HIGH',
'description' => "Hex-encoded strings detected: $hex_count",
'example' => '\x65\x76\x61\x6c = eval',
);
}
// 5. Chr/Ord 濫用 (超過 5 次)
$chr_count = preg_match_all('/chr\s*\(\s*\d+\s*\)/i', $content );
if ( $chr_count > 5 ) {
$indicators['chr_abuse'] = array(
'severity' => 'MEDIUM',
'description' => "Excessive use of chr(): $chr_count times",
'note' => 'chr(101).chr(118).chr(97).chr(108) = eval',
);
}
// 6. GLOBALS 濫用 (超過 3 次)
$globals_count = preg_match_all('/\$GLOBALS\[/i', $content );
if ( $globals_count > 3 ) {
$indicators['globals_abuse'] = array(
'severity' => 'MEDIUM',
'description' => "Excessive use of \$GLOBALS: $globals_count times",
);
}
// 7. 註釋混淆 (在函數名中插入註釋)
if ( preg_match('/(eval|system|assert)\/\*.*?\*\//i', $content ) ) {
$indicators['comment_obfuscation'] = array(
'severity' => 'HIGH',
'description' => 'Function names split by comments',
'example' => 'ev/*comment*/al($code)',
);
}
return $indicators;
}
}
/**
* 檢測已知的 WordPress 插件/主題漏洞
*/
private function get_wordpress_vulnerability_signatures() {
return array(
// TimThumb 遠程文件包含
array(
'name' => 'timthumb_rfi',
'file_pattern' => 'timthumb\.php$',
'content_pattern' => '/webshot\.php|src=.*?https?:\/\//i',
'cve' => 'CVE-2011-4106',
'severity' => 'CRITICAL',
'description' => 'TimThumb Remote File Inclusion vulnerability',
),
// Revolution Slider 任意文件下載
array(
'name' => 'revslider_file_download',
'file_pattern' => 'revslider',
'content_pattern' => '/force-download|download-file/i',
'cve' => 'CVE-2015-1579',
'severity' => 'HIGH',
'description' => 'Revolution Slider arbitrary file download',
),
// MailPoet 未授權上傳
array(
'name' => 'mailpoet_upload',
'file_pattern' => 'mailpoet',
'content_pattern' => '/wysija_upload/i',
'cve' => 'CVE-2014-8326',
'severity' => 'CRITICAL',
'description' => 'MailPoet unauthorized file upload',
),
// WP-VCD 惡意軟體 (functions.php 注入)
array(
'name' => 'wp_vcd_malware',
'file_pattern' => 'functions\.php$',
'content_pattern' => '/wp-vcd\.php|wp-tmp\.php/i',
'severity' => 'CRITICAL',
'description' => 'WP-VCD malware infection in theme',
),
);
}
目標: 檢測未知的威脅,基於行為和異常模式
class WPSA_Location_Analyzer {
/**
* 檢查文件位置是否可疑
*/
public function check_suspicious_location( $file_path ) {
$threats = array();
// 規則 1: Uploads 目錄不應有 PHP 文件
if ( $this->is_in_uploads( $file_path ) && $this->is_php_file( $file_path ) ) {
$threats[] = array(
'type' => 'PHP_IN_UPLOADS',
'severity' => 'HIGH',
'description' => 'PHP file found in uploads directory',
'reason' => 'Uploads should only contain media files',
'recommendation' => 'Delete this file unless you explicitly uploaded it',
);
}
// 規則 2: 可疑的文件名模式
$suspicious_filenames = array(
'/^(config|setup|install|mysql|db|backup|dump|shell|cmd|admin|login|test)\.php$/i',
'/^(c99|r57|wso|b374k|idx|sym|bypass)\.php$/i', // 已知 webshell 名稱
'/^[a-f0-9]{32}\.php$/i', // MD5 雜湊命名
'/^\d{10,}\.php$/i', // Unix timestamp 命名
);
$filename = basename( $file_path );
foreach ( $suspicious_filenames as $pattern ) {
if ( preg_match( $pattern, $filename ) ) {
$threats[] = array(
'type' => 'SUSPICIOUS_FILENAME',
'severity' => 'MEDIUM',
'description' => "Suspicious filename pattern: $filename",
);
}
}
// 規則 3: 隱藏文件 (以 . 開頭)
if ( preg_match('/^\.[\w-]+\.php$/i', $filename ) ) {
$threats[] = array(
'type' => 'HIDDEN_PHP_FILE',
'severity' => 'MEDIUM',
'description' => 'Hidden PHP file (starts with dot)',
);
}
// 規則 4: 核心目錄中的非核心文件
if ( $this->is_in_core_directory( $file_path ) && ! $this->is_core_file( $file_path ) ) {
$threats[] = array(
'type' => 'UNKNOWN_FILE_IN_CORE',
'severity' => 'HIGH',
'description' => 'Unknown file in WordPress core directory',
);
}
return $threats;
}
private function is_in_uploads( $file_path ) {
$upload_dir = wp_upload_dir();
return strpos( $file_path, $upload_dir['basedir'] ) === 0;
}
private function is_in_core_directory( $file_path ) {
$core_dirs = array( 'wp-admin', 'wp-includes' );
foreach ( $core_dirs as $dir ) {
if ( strpos( $file_path, ABSPATH . $dir ) === 0 ) {
return true;
}
}
return false;
}
}
class WPSA_Timestamp_Analyzer {
/**
* 檢測文件時間戳記異常
*/
public function detect_timestamp_anomaly( $file_path ) {
$modified_time = filemtime( $file_path );
$current_time = time();
$anomalies = array();
// 異常 1: 核心文件在最近 24 小時內被修改
if ( $this->is_core_file( $file_path ) ) {
$age_hours = ( $current_time - $modified_time ) / HOUR_IN_SECONDS;
if ( $age_hours < 24 ) {
$anomalies[] = array(
'type' => 'RECENTLY_MODIFIED_CORE',
'severity' => 'HIGH',
'description' => sprintf(
'Core file modified %d hours ago',
round( $age_hours )
),
'modified_time' => date( 'Y-m-d H:i:s', $modified_time ),
);
}
}
// 異常 2: 未來時間戳記 (伺服器時間被竄改?)
if ( $modified_time > $current_time + HOUR_IN_SECONDS ) {
$anomalies[] = array(
'type' => 'FUTURE_TIMESTAMP',
'severity' => 'MEDIUM',
'description' => 'File has future modification time',
'modified_time' => date( 'Y-m-d H:i:s', $modified_time ),
);
}
// 異常 3: 同目錄下唯一的新文件 (孤立注入)
$dir_files = glob( dirname( $file_path ) . '/*.php' );
$recent_threshold = $current_time - ( 7 * DAY_IN_SECONDS ); // 一週內
$recent_files = array_filter( $dir_files, function( $f ) use ( $recent_threshold ) {
return filemtime( $f ) > $recent_threshold;
});
if ( count( $recent_files ) === 1 && in_array( $file_path, $recent_files ) ) {
$anomalies[] = array(
'type' => 'LONE_RECENT_FILE',
'severity' => 'MEDIUM',
'description' => 'Only recently modified file in directory',
'note' => 'Could indicate isolated injection',
);
}
return $anomalies;
}
}
class WPSA_Behavior_Analyzer {
/**
* 分析代碼的可疑行為
*/
public function analyze_code_behavior( $content, $file_path ) {
$behaviors = array();
// 行為 1: 網路通訊能力 (C&C 連接)
if ( $this->has_network_capability( $content ) ) {
$behaviors[] = array(
'type' => 'NETWORK_COMMUNICATION',
'severity' => 'MEDIUM',
'description' => 'Code makes external HTTP requests',
'indicators' => $this->extract_urls( $content ),
);
}
// 行為 2: 文件寫入能力 (持久化)
if ( $this->has_file_write_capability( $content ) ) {
$behaviors[] = array(
'type' => 'FILE_WRITING',
'severity' => 'LOW',
'description' => 'Code can write to files',
);
}
// 行為 3: 繞過 wpdb 直接操作資料庫
if ( $this->has_direct_db_access( $content ) ) {
$behaviors[] = array(
'type' => 'DIRECT_DB_ACCESS',
'severity' => 'MEDIUM',
'description' => 'Direct MySQL access (bypassing $wpdb)',
'note' => 'May indicate database backdoor',
);
}
// 行為 4: Email 發送 + 用戶輸入 (spam backdoor)
if ( $this->can_send_email_with_user_input( $content ) ) {
$behaviors[] = array(
'type' => 'EMAIL_SENDING',
'severity' => 'HIGH',
'description' => 'Can send emails with user-controlled content',
'note' => 'Common spam backdoor technique',
);
}
// 行為 5: 過度使用錯誤抑制 (@)
$suppression_count = preg_match_all('/@(file_|fopen|include|require|eval|system)/i', $content );
if ( $suppression_count > 3 ) {
$behaviors[] = array(
'type' => 'ERROR_SUPPRESSION',
'severity' => 'MEDIUM',
'description' => "Excessive error suppression: $suppression_count instances",
'note' => 'Used to hide malicious activity from logs',
);
}
return $behaviors;
}
private function has_network_capability( $content ) {
return preg_match('/(file_get_contents|curl_exec|fsockopen|stream_socket_client)\s*\(\s*[\'"]https?:\/\//i', $content );
}
private function extract_urls( $content ) {
preg_match_all('/https?:\/\/[^\s\'"]+/i', $content, $matches );
return array_unique( $matches[0] );
}
private function can_send_email_with_user_input( $content ) {
$has_mail = preg_match('/(mail|wp_mail)\s*\(/i', $content );
$has_input = preg_match('/\$_(GET|POST|REQUEST|COOKIE)/i', $content );
return $has_mail && $has_input;
}
}
絕對禁止直接刪除: 刪除文件可能導致網站崩潰或誤刪正常文件。
class WPSA_Quarantine_Manager {
const QUARANTINE_DIR = WP_CONTENT_DIR . '/uploads/wpsa-quarantine/';
/**
* 初始化隔離區
*/
public function init_quarantine() {
// 創建隔離目錄
if ( ! file_exists( self::QUARANTINE_DIR ) ) {
wp_mkdir_p( self::QUARANTINE_DIR );
}
// 創建 .htaccess 阻止執行
$htaccess_content = "# WPSA Quarantine - Deny all access\n";
$htaccess_content .= "Order deny,allow\n";
$htaccess_content .= "Deny from all\n";
file_put_contents(
self::QUARANTINE_DIR . '.htaccess',
$htaccess_content
);
// 創建 index.php 防止目錄瀏覽
file_put_contents(
self::QUARANTINE_DIR . 'index.php',
'<?php // Silence is golden'
);
}
/**
* 隔離可疑文件
*/
public function quarantine_file( $file_path, $threat_info ) {
// 生成唯一的隔離文件名
$timestamp = date( 'Y-m-d_His' );
$hash = substr( md5( $file_path ), 0, 8 );
$original_name = basename( $file_path );
$quarantine_name = sprintf(
'%s_%s_%s.suspected',
$timestamp,
$hash,
$original_name
);
$quarantine_path = self::QUARANTINE_DIR . $quarantine_name;
// 移動文件到隔離區
$moved = rename( $file_path, $quarantine_path );
if ( ! $moved ) {
// 如果無法移動,嘗試複製然後刪除
if ( copy( $file_path, $quarantine_path ) ) {
unlink( $file_path );
$moved = true;
}
}
if ( $moved ) {
// 記錄隔離信息
$this->log_quarantine( $file_path, $quarantine_path, $threat_info );
return array(
'success' => true,
'quarantine_path' => $quarantine_path,
'message' => 'File successfully quarantined',
);
}
return array(
'success' => false,
'error' => 'Failed to quarantine file',
);
}
/**
* 記錄隔離操作
*/
private function log_quarantine( $original_path, $quarantine_path, $threat_info ) {
$log_entry = array(
'timestamp' => current_time( 'mysql' ),
'original_path' => $original_path,
'quarantine_path' => $quarantine_path,
'threat_type' => $threat_info['type'],
'severity' => $threat_info['severity'],
'description' => $threat_info['description'],
);
$quarantine_log = get_option( 'wpsa_quarantine_log', array() );
$quarantine_log[] = $log_entry;
update_option( 'wpsa_quarantine_log', $quarantine_log );
}
/**
* 恢復隔離文件 (管理員手動操作)
*/
public function restore_file( $quarantine_path, $original_path ) {
if ( ! current_user_can( 'manage_options' ) ) {
return array( 'success' => false, 'error' => 'Unauthorized' );
}
// 確認文件存在
if ( ! file_exists( $quarantine_path ) ) {
return array( 'success' => false, 'error' => 'File not found' );
}
// 恢復文件
$restored = rename( $quarantine_path, $original_path );
if ( $restored ) {
// 更新日誌
$this->log_restore( $quarantine_path, $original_path );
return array(
'success' => true,
'message' => 'File restored successfully',
);
}
return array( 'success' => false, 'error' => 'Failed to restore file' );
}
}
class WPSA_Scanner_Orchestrator {
/**
* Phase 1: 初始化掃描
*/
public function start_scan( $scan_options = array() ) {
// 1. 設置 PHP 環境
$this->configure_php_environment();
// 2. 創建掃描會話
$scan_id = $this->create_scan_session();
// 3. 建立文件索引
$file_index = $this->build_file_index( $scan_options );
// 4. 初始化進度追蹤
$this->init_progress_tracking( $scan_id, count( $file_index ) );
// 5. 觸發第一批掃描
wp_schedule_single_event( time(), 'wpsa_scan_batch', array( $scan_id ) );
return array(
'scan_id' => $scan_id,
'total_files' => count( $file_index ),
'status' => 'initiated',
);
}
/**
* Phase 2: 分批掃描執行
*/
public function execute_batch( $scan_id ) {
$start_time = microtime( true );
$progress = $this->get_progress( $scan_id );
// 獲取待掃描文件
$files = $this->get_next_batch( $progress );
foreach ( $files as $file ) {
// 時間檢查
if ( $this->should_stop_batch( $start_time ) ) {
$this->schedule_next_batch( $scan_id );
return;
}
// 執行三層檢測
$threats = $this->scan_file_complete( $file );
// 如果發現威脅,執行處理
if ( ! empty( $threats ) ) {
$this->handle_threats( $file, $threats );
}
// 更新進度
$this->update_progress( $scan_id, $file );
// 記憶體管理
if ( $progress['scanned'] % 10 === 0 ) {
gc_collect_cycles();
}
}
// 檢查是否完成
if ( $this->is_scan_complete( $scan_id ) ) {
$this->finalize_scan( $scan_id );
} else {
$this->schedule_next_batch( $scan_id );
}
}
/**
* 執行單個文件的完整三層檢測
*/
private function scan_file_complete( $file_path ) {
$all_threats = array();
// Layer 1: 快速篩選
$checksum_result = $this->verify_checksum( $file_path );
if ( $checksum_result === 'VERIFIED_SAFE' ) {
return array(); // 文件安全,跳過
}
if ( $checksum_result === 'MODIFIED_CORE' ) {
$all_threats[] = array(
'layer' => 1,
'type' => 'MODIFIED_CORE_FILE',
'severity' => 'CRITICAL',
);
}
// 讀取文件內容 (用於後續檢測)
$content = $this->safe_file_read( $file_path );
if ( $content === false ) {
return array(); // 無法讀取,跳過
}
// Layer 1: 熵值檢測
$entropy_result = $this->check_entropy( $content );
if ( $entropy_result !== 'SAFE' ) {
$all_threats[] = $entropy_result;
}
// Layer 2: 特徵碼匹配
$signature_threats = $this->scan_signatures( $content );
$all_threats = array_merge( $all_threats, $signature_threats );
// Layer 2: 混淆檢測
$obfuscation_threats = $this->detect_obfuscation( $content );
$all_threats = array_merge( $all_threats, $obfuscation_threats );
// Layer 3: 位置檢測
$location_threats = $this->check_location( $file_path );
$all_threats = array_merge( $all_threats, $location_threats );
// Layer 3: 時間戳記檢測
$timestamp_threats = $this->check_timestamp( $file_path );
$all_threats = array_merge( $all_threats, $timestamp_threats );
// Layer 3: 行為分析
$behavior_threats = $this->analyze_behavior( $content, $file_path );
$all_threats = array_merge( $all_threats, $behavior_threats );
return $all_threats;
}
/**
* Phase 3: 生成掃描報告
*/
public function generate_report( $scan_id ) {
$progress = $this->get_progress( $scan_id );
$threats = $this->get_all_threats( $scan_id );
// 威脅分類
$categorized = $this->categorize_threats( $threats );
$report = array(
'scan_id' => $scan_id,
'timestamp' => current_time( 'mysql' ),
'summary' => array(
'total_files' => $progress['total'],
'scanned_files' => $progress['scanned'],
'threats_found' => count( $threats ),
'critical' => $categorized['CRITICAL'],
'high' => $categorized['HIGH'],
'medium' => $categorized['MEDIUM'],
'low' => $categorized['LOW'],
'scan_duration' => $progress['end_time'] - $progress['start_time'],
),
'threats' => $threats,
'recommendations' => $this->generate_recommendations( $threats ),
);
return $report;
}
}
class WPSA_Error_Handler {
/**
* 安全的文件讀取
*/
public function safe_file_read( $file_path ) {
try {
// 檢查 1: 文件是否存在
if ( ! file_exists( $file_path ) ) {
$this->log_error( 'FILE_NOT_FOUND', $file_path );
return false;
}
// 檢查 2: 是否可讀
if ( ! is_readable( $file_path ) ) {
$this->log_error( 'FILE_NOT_READABLE', $file_path );
return false;
}
// 檢查 3: 文件大小限制
$max_size = 5 * MB_IN_BYTES; // 5MB
$file_size = filesize( $file_path );
if ( $file_size > $max_size ) {
$this->log_warning( 'FILE_TOO_LARGE', $file_path, $file_size );
// 分塊讀取大文件
return $this->read_file_in_chunks( $file_path );
}
// 讀取文件
$content = @file_get_contents( $file_path );
if ( $content === false ) {
$this->log_error( 'FILE_READ_FAILED', $file_path );
return false;
}
return $content;
} catch ( Exception $e ) {
$this->log_exception( 'FILE_READ_EXCEPTION', $file_path, $e );
return false;
}
}
/**
* 分塊讀取大文件
*/
private function read_file_in_chunks( $file_path ) {
$handle = @fopen( $file_path, 'r' );
if ( ! $handle ) {
return false;
}
$content = '';
$chunk_size = 1024 * 1024; // 1MB chunks
while ( ! feof( $handle ) ) {
$content .= fread( $handle, $chunk_size );
}
fclose( $handle );
return $content;
}
/**
* 記錄錯誤
*/
private function log_error( $error_type, $file_path, $extra = null ) {
$log_entry = array(
'timestamp' => current_time( 'mysql' ),
'type' => 'ERROR',
'code' => $error_type,
'file' => $file_path,
'extra' => $extra,
);
$error_log = get_option( 'wpsa_error_log', array() );
$error_log[] = $log_entry;
// 只保留最近 100 條錯誤
if ( count( $error_log ) > 100 ) {
$error_log = array_slice( $error_log, -100 );
}
update_option( 'wpsa_error_log', $error_log );
}
}
# 🔒 WordPress 惡意軟體掃描報告
## 📊 掃描總結
- **掃描 ID**: {scan_id}
- **掃描時間**: {timestamp}
- **總文件數**: {total_files}
- **已掃描**: {scanned_files}
- **發現威脅**: {threats_found}
- **掃描耗時**: {duration} 秒
## 🚨 威脅等級分布
- 🔴 **Critical**: {critical_count} 個
- 🟠 **High**: {high_count} 個
- 🟡 **Medium**: {medium_count} 個
- 🟢 **Low**: {low_count} 個
## ⚠️ 檢測到的威脅
### [#1] Eval + Base64 Backdoor - Critical 🔴
**文件位置**: `wp-content/themes/mytheme/footer.php`
**威脅類型**: MALWARE_SIGNATURE (eval_base64)
**嚴重性**: Critical
**檢測層級**: Layer 2 (Signature Matching)
**問題代碼** (Line 45):
```php
<?php
// ... 正常代碼 ...
eval(base64_decode('ZXZhbCgkX1BPU1RbJ2NtZCddKTs=')); // ← 惡意代碼
// ... 正常代碼 ...
?>
Base64 解碼後:
eval($_POST['cmd']);
威脅說明: 這是一個典型的 PHP 後門,允許攻擊者通過 POST 請求執行任意 PHP 代碼。攻擊者可以:
建議操作:
文件位置: wp-content/uploads/2024/03/shell.php
威脅類型: PHP_IN_UPLOADS
嚴重性: High
檢測層級: Layer 3 (Location Analysis)
威脅說明: Uploads 目錄通常只應包含媒體文件 (圖片、PDF 等),不應有可執行的 PHP 文件。
建議操作:
如果您需要專業的網站清理服務,請聯繫:
---
# Best Practices & Recommendations
## 開發指南
1. **永遠使用分批處理**: 即使只有 100 個文件,也要分批
2. **時間限制**: 每批次不超過 3 秒
3. **記憶體監控**: 使用 `memory_get_usage()` 監控
4. **錯誤容忍**: 單個文件失敗不應影響整體掃描
5. **進度可視化**: 提供實時進度條給用戶
6. **可中斷恢復**: 用戶關閉頁面後能自動繼續
## 性能優化
```php
// 使用 OpCache (如果可用)
if ( function_exists( 'opcache_compile_file' ) ) {
opcache_compile_file( $file_path );
}
// 定期清理內存
if ( $count % 10 === 0 ) {
gc_collect_cycles();
}
// 使用生成器節省記憶體
function get_files_generator( $directory ) {
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator( $directory )
);
foreach ( $iterator as $file ) {
yield $file;
}
}
作為惡意軟體獵人,應該持續學習:
定期研究真實的入侵案例:
記住核心原則: