<?php
// Set timezone
date_default_timezone_set('UTC');

// Basic Configuration
$minute = 15;
$limit = (60 * $minute);  // 60 (seconds) = 1 Minutes
ini_set('memory_limit', '-1');
ini_set('max_execution_time', $limit);
set_time_limit($limit);

// Utility Functions
function validatePath($path) {
    $realPath = realpath($path);
    if ($realPath === false || !is_dir($realPath)) {
        die("Invalid directory path");
    }
    return $realPath;
}

function formatBytes($bytes, $precision = 2) {
    $units = array('B', 'KB', 'MB', 'GB', 'TB');
    $bytes = max($bytes, 0);
    $pow = floor(($bytes ? log($bytes) : 0) / log(1024));
    $pow = min($pow, count($units) - 1);
    return round($bytes / pow(1024, $pow), $precision) . ' ' . $units[$pow];
}

function getFileSizeAndAge($file) {
    return array(
        'size' => filesize($file),
        'modified' => filemtime($file),
        'created' => filectime($file)
    );
}

// Core Scanner Functions
function recursiveScan($directory, &$entries_array = array()) {
    $handle = @opendir($directory);
    if ($handle) {
        while (($entry = readdir($handle)) !== false) {
            if ($entry == '.' || $entry == '..') {
                continue;
            }
            
            $entry = $directory . DIRECTORY_SEPARATOR . $entry;
            
            if (is_dir($entry) && is_readable($directory) && !is_link($directory)) {
                $entries_array = recursiveScan($entry, $entries_array);
            } elseif (is_file($entry) && is_readable($entry)) {
                $entries_array['file_writable'][] = $entry;
            } else {
                $entries_array['file_not_writable'][] = $entry;
            }
        }
        closedir($handle);
    }
    return $entries_array;
}

function sortByLastModified($files) {
    @array_multisort(array_map('filemtime', $files), SORT_DESC, $files);
    return $files;
}

function getSortedByTime($path) {
    $result = recursiveScan($path);
    $fileWritable = $result['file_writable'];
    $fileNotWritable = isset($result['file_not_writable']) ? !$result['file_not_writable'] : false;
    $fileWritable = sortByLastModified($fileWritable);

    return array(
        'file_writable' => $fileWritable,
        'file_not_writable' => $fileNotWritable
    );
}

function getSortedByExtension($path, $ext) {
    $result = getSortedByTime($path);
    $fileWritable = $result['file_writable'];
    $fileNotWritable = isset($result['file_not_writable']) ? $result['file_not_writable'] : false;
    $sortedWritableFile = array();
    $sortedNotWritableFile = array();

    foreach ($fileWritable as $entry) {
        $pathinfo = pathinfo($entry, PATHINFO_EXTENSION);
        $pathinfo = strtolower($pathinfo);

        if (in_array($pathinfo, $ext)) {
            $sortedWritableFile[] = $entry;
        }
    }

    if (isset($fileNotWritable) && is_array($fileNotWritable)) {
        foreach ($fileNotWritable as $entry) {
            $pathinfo = pathinfo($entry, PATHINFO_EXTENSION);
            $pathinfo = strtolower($pathinfo);

            if (in_array($pathinfo, $ext)) {
                $sortedNotWritableFile[] = $entry;
            }
        }
    }

    return array(
        'file_writable' => $sortedWritableFile,
        'file_not_writable' => $sortedNotWritableFile
    );
}

function getFileTokens($filename) {
    try {
        if (filesize($filename) > 5242880) { // Skip files larger than 5MB
            return array('file_too_large');
        }

        $fileContent = file_get_contents($filename);
        if ($fileContent === false) {
            return array();
        }
        
        $output = array();
        
        // Check timestamps
        if (detectSuspiciousTimestamp($filename)) {
            $output[] = 'suspicious_timestamp';
        }
        
        // Check file size
        if (detectSuspiciousSize($filename)) {
            $output[] = 'suspicious_size';
        }
        
        // Check permissions
        if (detectSuspiciousPermissions($filename)) {
            $output[] = 'suspicious_permissions';
        }

        // Check for suspicious patterns
        $suspicious_patterns = array(
            '/\b(eval|assert|system|shell_exec|exec)\s*\(\s*(\$_\w+|\$\{\w+\}|\$\w+)\s*\)/',
            '/\b(base64_decode|gzinflate|str_rot13)\s*\(\s*[\'"](.*?)[\'"]\s*\)/',
            '/\$[a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*\s*\(\s*\$/',
            '/\b(preg_replace|create_function)\s*\(\s*([\'"])/.*\2\s*,\s*([\'"]).*\3\s*\)/',
            '/\$_(GET|POST|REQUEST|COOKIE|SERVER|FILES)\s*\[[\'"].*?[\'"]\]/',
            '/\b(file_get_contents|fopen|readfile)\s*\(\s*\$_(GET|POST|REQUEST|COOKIE)\s*\[/',
            '/\$[a-z0-9_]+\s*\(\s*\$[a-z0-9_]+\s*\)/',
            '/(?:chr|chr\(|\\\\x[0-9A-Fa-f]{2}|\\\\[0-7]{3})/',
            '/\b(move_uploaded_file|copy|unlink|file_put_contents)\s*\(\s*\$/',
            '/(\$[a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*\s*=\s*str_replace\s*\([^)]+\)\s*;\s*)+\$[a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*\s*\(\s*/',
            '/\$[a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*\s*\(\s*base64_decode\s*\([^)]+\)\s*\)/',
            '/\b(ftp_connect|ftp_login|ftp_put|ftp_get)\b/',
            '/\b(mail|error_log|ini_set|ini_get|chmod|mkdir|rmdir)\b/'
        );

        // Check untuk konten yang di-encode
        if (preg_match('/^[a-zA-Z0-9\/\r\n+]*={0,2}$/', $fileContent)) {
            $output[] = 'possible_base64';
        }

        // Check untuk hidden characters
        if (preg_match('/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/', $fileContent)) {
            $output[] = 'hidden_chars';
        }
        
        foreach ($suspicious_patterns as $pattern) {
            if (preg_match($pattern, $fileContent)) {
                $output[] = 'suspicious_pattern_detected';
                break;
            }
        }

        $fileContent = preg_replace('/<\?([^p=\w])/m', '<?php ', $fileContent);
        $tokens = token_get_all($fileContent);

        foreach ($tokens as $token) {
            if (is_array($token)) {
                $output[] = strtolower($token[1]);
            }
        }

        return array_values(array_unique(array_filter($output)));
    } catch (Exception $e) {
        return array('error_reading_file');
    }
}

function compareTokens($tokenNeedles, $tokenHaystack) {
    $output = array();
    foreach ($tokenNeedles as $tokenNeedle) {
        if (in_array($tokenNeedle, $tokenHaystack)) {
            $output[] = $tokenNeedle;
        }
    }
    return $output;
}

function detectSuspiciousTimestamp($file) {
    $fileInfo = getFileSizeAndAge($file);
    $currentTime = time();
    $timeThreshold = 30 * 24 * 60 * 60; // 30 hari
    
    $suspiciousTime = false;
    
    // File dimodifikasi di luar jam kerja (23:00 - 05:00)
    $modifiedHour = (int)date('H', $fileInfo['modified']);
    if ($modifiedHour >= 23 || $modifiedHour <= 5) {
        $suspiciousTime = true;
    }
    
    // File yang baru dimodifikasi dalam 24 jam terakhir
    if (($currentTime - $fileInfo['modified']) < 86400) {
        $suspiciousTime = true;
    }
    
    return $suspiciousTime;
}

function detectSuspiciousSize($file) {
    $size = filesize($file);
    
    // File PHP terlalu kecil (mungkin hidden)
    if (pathinfo($file, PATHINFO_EXTENSION) == 'php' && $size < 100) {
        return true;
    }
    
    // File gambar tapi ukurannya mencurigakan
    $imageExtensions = ['jpg', 'jpeg', 'png', 'gif'];
    if (in_array(strtolower(pathinfo($file, PATHINFO_EXTENSION)), $imageExtensions)) {
        if ($size < 1024) { // Kurang dari 1KB
            return true;
        }
    }
    
    return false;
}

function detectSuspiciousPermissions($file) {
    $perms = fileperms($file);
    
    // Check world-writable permissions
    if (($perms & 0x0002) || ($perms & 0x0004)) {
        return true;
    }
    
    return false;
}

// Configuration Arrays
$ext = array(
    'php', 'phps', 'pht', 'phpt', 'phtml', 'phar',
    'php3', 'php4', 'php5', 'php7', 'suspected',
    'txt', 'log', 'json', 'jpg', 'jpeg', 'png', 'gif', 
    'htaccess', 'html', 'htm', 'js', 'cgi', 'pl', 'py'
);

$tokenNeedles = array(
    // Obfuscation
    'base64_decode', 'rawurldecode', 'urldecode', 'gzinflate',
    'gzuncompress', 'str_rot13', 'convert_uu', 'htmlspecialchars_decode',
    'bin2hex', 'hex2bin', 'hexdec', 'chr', 'strrev', 'goto', 'implode',
    'strtr', 'extract', 'parse_str', 'substr', 'mb_substr', 'str_replace',
    'substr_replace', 'preg_replace', 'exif_read_data', 'readgzfile',

    // Shell / Process
    'eval', 'exec', 'shell_exec', 'system', 'passthru', 'pcntl_fork',
    'fsockopen', 'proc_open', 'popen', 'assert', 'posix_kill',
    'posix_setpgid', 'posix_setsid', 'posix_setuid', 'proc_nice',
    'proc_close', 'proc_terminate', 'apache_child_terminate',

    // Server Information
    'posix_getuid', 'posix_geteuid', 'posix_getegid', 'posix_getpwuid',
    'posix_getgrgid', 'posix_mkfifo', 'posix_getlogin', 'posix_ttyname',
    'getenv', 'proc_get_status', 'get_cfg_var', 'disk_free_space',
    'disk_total_space', 'diskfreespace', 'getlastmo', 'getmyinode',
    'getmypid', 'getmyuid', 'getmygid', 'fileowner', 'filegroup',
    'get_current_user', 'pathinfo', 'getcwd', 'sys_get_temp_dir',
    'basename', 'phpinfo',

    // Database
    'mysql_connect', 'mysqli_connect', 'mysqli_query', 'mysql_query',

    // I/O
    'fopen', 'fsockopen', 'file_put_contents', 'file_get_contents',
    'url_get_contents', 'stream_get_meta_data', 'move_uploaded_file',
    '$_files', 'copy', 'include', 'include_once', 'require', 'require_once',
    '__file__',

    // Miscellaneous
    'mail', 'putenv', 'curl_init', 'tmpfile', 'allow_url_fopen',
    'ini_set', 'set_time_limit', 'session_start', 'symlink',
    '__halt_compiler', '__compiler_halt_offset__', 'error_reporting',
    'create_function', 'get_magic_quotes_gpc', '$auth_pass', '$password',
    
    // Additional dangerous functions
    'preg_replace_callback', 'ob_start', 'call_user_func',
    'call_user_func_array', 'bzdecompress', 'gzdecode',
    'unserialize', 'filter_var', 'filter_input'
);

?>
<!DOCTYPE html>
<html lang="en-us">
<head>
    <title>Malware Scanner</title>
    <style type="text/css">
        @import url('https://fonts.googleapis.com/css?family=Ubuntu+Mono&display=swap');

        body {
            font-family: 'Ubuntu Mono', monospace;
            color: #8a8a8a;
        }

        table {
            border-spacing: 0;
            padding: 10px;
            border-radius: 7px;
            border: 3px solid #d6d6d6;
            width: 80%;
            margin: auto;
        }

        tr, td {
            padding: 7px;
        }

        th {
            color: #8a8a8a;
            padding: 7px;
            font-size: 25px;
        }

        input[type=submit]:focus {
            background: #ff9999;
            color: #fff;
            border: 3px solid #ff9999;
        }

        input[type=submit]:hover {
            border: 3px solid #ff9999;
            cursor: pointer;
        }

        input[type=text]:hover {
            border: 3px solid #ff9999;
        }

        input {
            font-family: 'Ubuntu Mono', monospace;
        }

        input[type=text] {
            border: 3px solid #d6d6d6;
            outline: none;
            padding: 7px;
            color: #8a8a8a;
            width: 100%;
            border-radius: 7px;
        }

        input[type=submit], input[type=button] {
            color: #8a8a8a;
            border: 3px solid #d6d6d6;
            outline: none;
            background: none;
            padding: 7px;
            width: 100%;
            border-radius: 7px;
        }

        .issue {
            margin: 5px 0;
            padding: 5px;
            background: #fff1f1;
            border-radius: 3px;
        }

        .summary {
            margin-top: 20px;
            padding: 10px;
            background: #f5f5f5;
            border-radius: 7px;
        }
    </style>
    <script type="text/javascript">
        function copyTable() {
            var resultTable = document.getElementById('result');
            var rows = resultTable.getElementsByTagName('tr');
            var paths = [];
            
            // Start from index 1 to skip header row
            for (var i = 1; i < rows.length; i++) {
                // Only get the first cell (file path)
                paths.push(rows[i].cells[0].innerText);
            }
            
            // Join paths with newline and copy to clipboard
            navigator.clipboard.writeText(paths.join('\n')).then(function() {
                alert('File paths copied to clipboard');
            }, function(err) {
                alert('Failed to copy paths: ' + err);
            });
        }
    </script>
</head>
<body>
    <form method="post">
        <table>
            <tr>
                <th>Malware File Scanner</th>
            </tr>
            <tr>
                <td>
                    Current Date and Time (UTC): <?php echo date('Y-m-d H:i:s'); ?>
                    <br>
                    Current User's Login: <?php echo get_current_user(); ?>
                </td>
            </tr>
            <tr>
                <td><input type="text" name="dir" value="<?= getcwd() ?>"></td>
            </tr>
            <tr>
                <td><input type="submit" name="submit" value="SCAN FILES"></td>
            </tr>

            <?php if (isset($_POST['submit'])) { ?>
                <tr>
                    <td>
                        <span style="font-weight:bold;font-size:25px;">SCAN RESULTS</span>
                        <input type="button" value="Copy File Paths" onClick="copyTable()">
                    </td>
                </tr>
        </table>
        <table id="result">
            <tr>
                <th>File Path</th>
                <th>Issues Found</th>
            </tr>
            <?php
            $path = $_POST['dir'];
            $result = getSortedByExtension($path, $ext);

            $fileWritable = $result['file_writable'];
            $fileNotWritable = $result['file_not_writable'];
            $totalIssues = 0;

            foreach ($fileWritable as $file) {
                $filePath = str_replace('\\', '/', $file);
                $tokens = getFileTokens($filePath);
                $cmp = compareTokens($tokenNeedles, $tokens);

                if (!empty($cmp)) {
                    $totalIssues++;
                    echo '<tr>';
                    echo '<td>' . htmlspecialchars($filePath) . '</td>';
                    echo '<td>';
                    foreach ($cmp as $issue) {
                        echo '<div class="issue">';
                        switch ($issue) {
                            case 'suspicious_timestamp':
                                echo '⚠️ File modified at suspicious time';
                                break;
                            case 'suspicious_size':
                                echo '⚠️ Suspicious file size';
                                break;
                            case 'suspicious_permissions':
                                echo '⚠️ Unsafe file permissions';
                                break;
                            case 'possible_base64':
                                echo '⚠️ Possible base64 encoded content';
                                break;
                            case 'hidden_chars':
                                echo '⚠️ Hidden characters detected';
                                break;
                            case 'suspicious_pattern_detected':
                                echo '🚨 Malicious code pattern detected';
                                break;
                            default:
                                echo '⚠️ ' . htmlspecialchars($issue);
                        }
                        echo '</div>';
                    }
                    echo '</td></tr>';
                }
            }
            ?>
            <tr>
                <td colspan="2" class="summary">
                    Total files scanned: <?php echo count($fileWritable); ?><br>
                    Files with issues: <?php echo $totalIssues; ?>
                </td>
            </tr>
        </table>
        <?php } ?>
    </form>
</body>
</html>