/usr/local/bin/filescan.sh


# BSM ALLAH
#!/bin/bash

upfile="$1"

nice in -20 clamscan -i --no-summary $upfile

if [ $? -eq 1 ]
then
echo "An infected file was found"
exit
fi

interpr=`egrep -w '^#!/.*python|^#!/.*bash|^#!/.*sh|^#!/.*perl' $upfile|wc -l`

if [ $interpr -gt 0 ]
then
echo "script file was found"
exit
fi

uplst=`egrep "move_uploaded_file" $upfile | wc -l`
if [ $uplst -gt 0 ]
then
echo "An upload script was found"
exit
fi

upcontent=`egrep "eval\(gzinflate\(base64_decode|eval\(base64_decode|rot13" $upfile|wc -l`
if [ $upcontent -gt 0 ]
then
shst=`php $upfile | egrep -w "c99shell|r57shell|Biz Shell|WebRoot|GrayHatz|Symlink Sa|h4cker.tr|xB1N4RYx|PHP-Shell|Back Connect|webadmin|public_html|Locus7Shell|b374k|Connect Back|CWShell|CW Exploiter|KingDefacer|Safe Mode Bypass|Saudi Sh3ll|SimAttacker|tRyaG|Hell ZoNe|ViRuS_HiMa|milw0rm|h4cker|kernel"|wc -l`
if [ $shst -gt 0 ]
then
echo "Encrypted Webshell was found"
fi
fi

mup=`egrep -w "move_uploaded_file|assert|system|create_function|eval|stripslashes|gzuncompress|str_rot13|rot13|gzinflate|preg_replace|base64|base64_decode|str_replace|chmod|uname|unlink|exec|shell_exec|c99shell|r57shell|Biz Shell|WebRoot|GrayHatz|Symlink Sa|h4cker.tr|xB1N4RYx|PHP-Shell|Back Connect|webadmin|public_html|Locus7Shell|b374k|Connect Back|CWShell|CW Exploiter|KingDefacer|Safe Mode Bypass|Saudi Sh3ll|SimAttacker|tRyaG|Hell ZoNe|ViRuS_HiMa|milw0rm|h4cker|kernel|fopen" $upfile|wc -l`
if [ $mup -gt 0 ]
then
echo "Suspicious Webshell was found"
exit
fi

htup=`egrep -wi "SecRuleEngine|SecFilterScanPOST|FollowSymLinks|ExecCGI|AddType|AddHandler|Options|AllowOverride" $upfile|wc -l`
if [ $htup -gt 0 ]
then
echo "Suspicious Htaccess was found"
exit
fi