ND's Hack Detector
Copy & paste or download this script to find out if you have been hit by an
IFRAME injection attack that is going around the internet. You can also find
out if you have dangerous permissions on your shared hosting site. It does
only three things, show you bad permissions, finds iframe code or other hack
snippets that you put inside, or lists the extensions in your site directory.

There is a md5 password encrypter in the zip file. Put them on the same site
to make a quick password for using with the hack detector.

If you copy and paste, use the name hacdet.php or you will get mad when it fails.

<?php

/* 
	Thank you for looking into ND's Hack Detector. 
		
		To use this script you must put in the proper variables in the
	next section. Then you can hit the url on your server and 
	look for problems. 
		Right now it is corny, so use at your own risk, and it is slow, 
	but it shows some things that we know are problematic.
		If you have suggestions or ideas or a better way to do this please
	modify this and post the script to your blog so everyone can get it.
	
	Trust Jesus.

//Variables to set:

/************************************************************************
  	fileExtensions
   These are the type of files you want to look inside of while seeking 
   for iframes or other hacked in codes. 
   You can select the extension function from the form to show all 
   the different types on your site.  
    Example: 
	 $iframeExts = Array('php','htm','html','HTM','HTML');
************************************************************************/
$iframeExts = Array('Please','set','file','extensions'); 
 
/************************************************************************
   URL
   This is the url to this page on the website that you are looking in.
   It will show up a link to the infected pages when you run the 
   iframe selection so that you can check the code or find it with 
   your ftp client.
    Example: 
    $website = "http://your.website.url";
************************************************************************/
$website = "http://your.website.url";

/************************************************************************
   Sub Folder
   you might want to search only in some folder below the script. Or you
   can leave this blank to search every thing from the top level down.
    Example: 
    $folder = "some/folder" 
************************************************************************/
$folder = "";

/************************************************************************
  Search pattern
  These are things you have seen injected in your pages. Shorter is better.
   Example: 
	$content_patterns = Array('iframe','jaframe','googleadseance.com');
************************************************************************/
$content_patterns = Array('tags','urls','etc',);

/************************************************************************
  Password Protection;	 
  Set $UsePass to 0 if you will remove the script after using it.
  If you want to enter a password each time you run the script
  set $UserPass to 1 and encrypt a password with the md5.php script.
	Example:
	$UsePass = 1;
	$userPassVert = '885db025g9rd272xe74n1b#0)%fca4e';
************************************************************************/
$UsePass = 1;
$userPassVert = 'some_MD5_encrypted_string_you_make';

// maybe you don't need to edit below this part;
// but if you can make it better , please do!

// This was inspired by:
// http://www.diovo.com/2009/03/hidden-iframe-injection-attacks/

/************************************************************************
Issues:
	Security may not be so good on this script.
	Blank Password script invites someone to find your weakensses.
	Injection attack might be possible through the password box.
	Running on a big site may take a long time.
	Not standards compliant to WC3.	
/************************************************************************/
ini_set('display_errors',1);
error_reporting(E_ALL|E_STRICT);
session_start();

//check for the password
if ($UsePass == 1){
$needLogin = 1;
$message = '';

//see if they logged out
	if (isset($_POST['logout']) ){
		if ( $_POST['logout'] == 'Logout') {
			if (isset($_SESSION['passVert']) ){ 
				session_unset($_SESSION['passVert']);
			} 
		}
	}

//check for session var 
	if(!isset($_SESSION['passVert']) ){
		//see if they submitted the passVert<br /> ";
		if (isset($_POST['scriptPassVert']) ){

//encrypt the posted password and see if it matches<br />"; 
			$testPass = md5($_POST['scriptPassVert']);
			 
			if ($testPass == $userPassVert){
				//the password is good, set the var and run the script;
				$_SESSION['passVert'] = $testPass;
				$needLogin = 0;
			} else {
				//prepare a message, kill session, show form
				$message = "bad password<br />";
			}//test post password

}//isset post password 
		
	} else {
		//the session password exits, so we can run the script
		$needLogin = 0;
	}//isset session password

//if there is no posted password 
	//or bad posted password and no session password 
	//kill session give them a form 
	if ($needLogin == 1){
		session_destroy();
		// maybe they messed up the password;
   	echo $message.
		"<form method=post action=hacdet.php>
		<input type=password name=scriptPassVert /><input type=submit value=run name=submit />
		</form>";
		die('');
	}//form if
		
	
} //use password section

//password is cleared or in the session so run the script
$perms = 0;
$ext = 0;
$frame = 0;
$imin = getcwd();
$imin .= '/';

if (isset($_REQUEST['chkfr'])) {
	
	$e = $_REQUEST['chkfr'];
	if ($e == 'perms'){$perms = 1;}
	else if ($e == 'ext'){$ext = 1;}
	else if ($e == 'frms'){$frame = 1;}
}

// ------------ lixlpixel recursive PHP functions -------------
// http://lixlpixel.org/recursive_function/php/
// scan_directory_recursively( directory to scan, filter )
// expects path to directory and optional an extension to filter
// of course PHP has to have the permissions to read the directory
// you specify and all files and folders inside this directory
// ------------------------------------------------------------

// to use this function to get all files and directories in an array, write:
// $filestructure = scan_directory_recursively('path/to/directory');

// to use this function to scan a directory and filter the results, write:
// $fileselection = scan_directory_recursively('directory', 'extension');

$exts = Array(); //array of all extensions 
$bad = '';  // the list of directories or files with global write perm
$iframeFiles = Array();
$contentHack = Array();
$j = 0;

function scan_directory_recursively($directory, $filter=FALSE)
{
	global $imin, $iframeExts, $content_patterns, $contentHack, $bad, $exts, $iframeFiles, $perms, $ext, $frame, $j;
	
	// if the path has a slash at the end we remove it here
	if(substr($directory,-1) == '/')
	{
		$directory = substr($directory,0,-1);
	}

// if the path is not valid or is not a directory ...
	if(!file_exists($directory) || !is_dir($directory))
	{
		// ... we return false and exit the function
		return FALSE;

// ... else if the path is readable
	}elseif(is_readable($directory))
	{
		// we open the directory
		$directory_list = opendir($directory);

// and scan through the items inside
		while (FALSE !== ($file = readdir($directory_list)))
		{
			// if the filepointer is not the current directory
			// or the parent directory
			if($file != '.' && $file != '..')
			{
				// we build the new path to scan
				$path = $directory.'/'.$file;

// if the path is readable
				if(is_readable($path))
				{
					// we split the new path by directories
					$subdirectories = explode('/',$path);

// if the new path is a directory
					if(is_dir($path))
					{
						/*if (substr(sprintf('%o', fileperms($path)), -3) == '777'){
							echo $path . '<br />';
						}*/
						$dperms = fileperms($path);
						$stat = stat($path);
						if ((($dperms & 0x0002) ? 'w' : '-') == 'w'){
						/*	echo '   World Write : '. $path . '<br />';
							echo '   modified : '.date("F d Y H:i:s.",$stat['ctime']).' <br />';
							echo '   CurPerm: '.substr(sprintf('%o', fileperms($path)), -4). '<br />' ;
						*/
							$bad  = $bad.'World Write : '. $path . '<br />';
							$bad  = $bad.'   Directory Modified: '.date("F d Y H:i:s.",$stat['ctime']).' <br />';
							$bad  = $bad.'   Current Permission: '.substr(sprintf('%o', fileperms($path)), -4). '<br />' ;

}
						// add the directory details to the file list
						$directory_tree[] = array(
							'path'    => $path,
							'name'    => end($subdirectories),
							'kind'    => 'directory',

// we scan the new path by calling this function
							'content' => scan_directory_recursively($path, $filter));

// if the new path is a file
					}elseif(is_file($path))
					{

// get the file extension by taking everything after the last dot
						$tmp = end($subdirectories);
						$tmp1 = explode('.',$tmp);
						$extension = end($tmp1);
						
						//looking for iframes
											
						if ($frame == 1 && in_array($extension, $iframeExts) 
								&& !stristr($path,'hacdet.php') && !in_array($path,$iframeFiles) ) {
							$handle = @fopen($path, "r");
							if ($handle) {

while (!feof($handle)) {
						   	$content = fgets($handle);
						   	foreach($content_patterns as $content_pattern){
							   	if (stristr($content, $content_pattern) ){
							   		//if we already know about that page and pattern we don't want to
							   		//add it again.
							   		$dude = substr_replace($path, '', 0, strlen($imin));
							   		$isin = array_search($dude,$iframeFiles);  
							   		if (! ($isin && ($contentHack[$isin] == $content_pattern)) ){
							   			//skip it
							   		//} else {
							   			//if it is not found, then just add it
							   			$iframeFiles[$j] = $dude; 
								   	  	$contentHack[$j] = $content_pattern; 
									     	$j++;
							   		} 
								   }
								 }
						     }
						   }
						   fclose($handle);
						}

//in_array  ( mixed $needle  , array $haystack  [, bool $strict  ] )
						//check for the extension in the array. if missing, add it
						if (!in_array($extension."<br />", $exts)){
							$exts[] = $extension."<br />";
						}						
						
						// if there is no filter set or the filter is set and matches
						if( ($filter === FALSE || $filter == $extension) && ($perms == 1 || $ext == 1) ) 
						{
							// add the file details to the file list
							$directory_tree[] = array(
								'path'      => $path,
								'name'      => end($subdirectories),
								'extension' => $extension,
								'size'      => filesize($path),
								'kind'      => 'file');
							/*if (substr(sprintf('%o', fileperms($path)), -3) == '777'){
								echo $path .'/ trouble<br />' ;
							}*/
							$fperms = fileperms($path);
							$stat = stat($path);
							if ((($fperms & 0x0002) ? 'w' : '-') == 'w'){
							/*	echo 'World Write : '. $path . '<br />';
								echo '   ModDate: '.date ("F d Y H:i:s.", filemtime($path)).' <br />';
								echo '   CurPerm: '.substr(sprintf('%o', fileperms($path)), -4). '<br />' ;
							*/
								// try to make it read and write for owner, read for everybody else
								$bad  = $bad.'World Write : '. $path . '<br />';
								$bad  = $bad.'   File Accessed: '.date("F d Y H:i:s.",$stat['atime']).' <br />';
								$bad  = $bad.'   File Modified: '.date("F d Y H:i:s.",$stat['mtime']).' <br />';
								$bad  = $bad.'   Permission Changed: '.date("F d Y H:i:s.",$stat['ctime']).' <br />';
								$bad  = $bad.'   Current Permission: '.substr(sprintf('%o', fileperms($path)), -4). '<br />' ;
							}
						}

}
				}
			}
		}
		// close the directory
		closedir($directory_list); 
		
		// return file list
		return 1;

// if the path is not readable ...
	}else{
		// ... we return false
		return FALSE;	
	}
}
// ------------------------------------------------------------
/* from http://www.gerd-riesselmann.net/archives/2006/01/dont-trust-php-self
*  * Static returns the recent URL.  
*  * @param Boolean Indicated if query string (?...) 
       should be included or not  * @returns String  */ 
function recentURL($includeParams) {   
   $http = "";   
	if ($includeParams)   {     
		$http = $_SERVER["REQUEST_URI"];   
	}   else   {     
		$http = $_SERVER["PHP_SELF"];         
	}   
	return toSafeURL($http); 
} 
/*from http://www.gerd-riesselmann.net/archives/2006/01/dont-trust-php-self
*  * Static. Processes an URL to strip of possible injection code
*  * @param String The URL to process
 	    @return String The cleaned URL  */ 
function toSafeURL($url){   
	return htmlentities(strip_tags($url)); 
}
echo "<h3>ND's hack detector.</h3>";

//remind the user to set the vars
if ($iframeExts[0] == 'Please' || $website == "http://your.website.url" || $content_patterns[0] == 'tags') {
	$me = recentURL('');
	die("Instructions:<br />Please open this script in your favorite editor. <br />Set the required variables. <br >Then <a href='".$me."' />Click here</a>");
}

$dir   = getcwd();
$dir .= '/'.$folder;

echo "Now operating in $dir<br />";

if ($perms == 1 || $ext == 1 || $frame == 1){
	$thelist = scan_directory_recursively($dir);
}

if ($perms == 1){
	if ($bad !== ''){
		echo "<br />Files or folders with world write permission:<br />".$bad."<br /><br />";
	} else {
		echo "<br />No world writeable files or folders.<br /><br />";
	}
}

if ($ext == 1){
	//show the extensions
	echo "<br />Following extensions found<br />";
	foreach ($exts as $val){
		echo "-.$val";
	}
}

if ($frame == 1){

if (count($iframeFiles) > 0){
	 echo "<br />Following files have been flagged<br />Open links with caution!<br />";
	 for ($i = 0; $i < count($iframeFiles); $i++) {
		$x = $website."/".str_replace('./','',$iframeFiles[$i]);
		$p = $contentHack[$i];
		echo "<br />".$p." in <a href='$x'>$x</a>";
	 } 
	} else {
		echo "<br />None of your search terms has been found.";
	}	 
}//iframe seek

?>
<br /><br />What to check?<br />
<form method=post name=testcondition action=hacdet.php>
<input type=radio name=chkfr value=perms />World Executable Permissions<br />
<input type=radio name=chkfr value=ext />Various extensions<br />
<input type=radio name=chkfr value=frms />Iframes or urls<br />
<input type=submit name=submit value="Run Test" />

<?php

if($UsePass == 1){
  echo '<input type=submit name=logout value="Logout" /><br />';
}
echo "</form>";

//thanks for reading this far.
//please reply if you like this script to deals at netdiskounts (you know what ) com 
?>