$minute = 15;$limit = (60 * $minute); // 60 (seconds) = 1 Minutesini_set(&#039;memory_limit&#039;, &#039;-1&#039;);ini_set(&#039;max_execution_time&#039;, $limit);set_time_limit($limit);function recursiveScan($directory, &amp;$entries_array = array()){    // link can cause endless loop    $handle = @opendir($directory);    if ($handle) {        while (($entry = readdir($handle)) !== false) {            if ($entry == &#039;.&#039; || $entry == &#039;..&#039;) {                continue;            }            $entry = $directory . DIRECTORY_SEPARATOR . $entry;            if (is_dir($entry) &amp;&amp; is_readable($directory) &amp;&amp; !is_link($directory)) {                $entries_array = recursiveScan($entry, $entries_array);            } elseif (is_file($entry) &amp;&amp; is_readable($entry)) {                $entries_array[&#039;file_writable&#039;][] = $entry;            } else {                $entries_array[&#039;file_not_writable&#039;][] = $entry;            }        }        closedir($handle);    }    return $entries_array;}/** * * Sort array of list file by lastest modified time * * @param array  $files Array of files * * @return array * */function sortByLastModified($files){    @array_multisort(array_map(&#039;filemtime&#039;, $files), SORT_DESC, $files);    return $files;}/** * * Recurisively list a file by descending modified time * * @param string $path * * @return array * */function getSortedByTime($path){    $result = recursiveScan($path);    $fileWritable = $result[&#039;file_writable&#039;];    $fileNotWritable = isset($result[&#039;file_not_writable&#039;]) ? !$result[&#039;file_not_writable&#039;] : false;    $fileWritable = sortByLastModified($fileWritable);    return array(        &#039;file_writable&#039; =&gt; $fileWritable,        &#039;file_not_writable&#039; =&gt; $fileNotWritable    );}/** * Recurisively list a file by array of extension * * @param string $path * @param array $ext * @return array of files */function getSortedByExtension($path, $ext){    $result = getSortedByTime($path);    $fileWritable = $result[&#039;file_writable&#039;];    isset($result[&#039;file_not_writable&#039;]) ? $result[&#039;file_not_writable&#039;] : false;    foreach ($fileWritable as $entry) {        $pathinfo = pathinfo($entry, PATHINFO_EXTENSION);        $pathinfo = strtolower($pathinfo);        if (in_array($pathinfo, $ext)) {            $sortedWritableFile[] = $entry;        }    }    if (isset($fileNotWritable)) {        foreach ($fileNotWritable as $entry) {            $pathinfo = pathinfo($entry, PATHINFO_EXTENSION);            $pathinfo = strtolower($pathinfo);            if (in_array($pathinfo, $ext)) {                $sortedNotWritableFile[] = $entry;            }        }    } else {        $sortedNotWritableFile = false;    }    return array(        &#039;file_writable&#039; =&gt; $sortedWritableFile,        &#039;file_not_writable&#039; =&gt; $sortedNotWritableFile    );}/** * Get lowercase Array of tokens in a file * * @param string $filename * @return array */function getFileTokens($filename){    /*    token_get_all() This function not support :    - Old notation :  &quot;  &quot; and &quot;&lt;% %&gt;&quot;    - heredoc syntax    - nowdoc syntax (since PHP 5.3.0)    */    $fileContent = file_get_contents($filename);    $fileContent = preg_replace(&#039;/&lt;\?([^p=\w])/m&#039;, &#039; &#039;, $fileContent); // replace old php tags    $token = token_get_all($fileContent);    $output = array();    $tokenCount = count($token);    if ($token &gt; 0) {        for ($i = 0; $i &lt; $tokenCount; $i++) {            if (isset($token[$i][1])) {                $output[] .= strtolower($token[$i][1]);            }        }    }    $output = array_values(        array_unique(array_filter(array_map(&quot;trim&quot;, $output)))    );    return $output;}/** * Compare tokens and return array of matched tokens * * @param array $tokenNeedles * @param array $tokenHaystack * @return array */function compareTokens($tokenNeedles, $tokenHaystack){    $output = array();    foreach ($tokenNeedles as $tokenNeedle) {        if (in_array($tokenNeedle, $tokenHaystack)) {            $output[] = $tokenNeedle;        }    }    return $output;}$ext = array(    &#039;php&#039;,    &#039;phps&#039;,    &#039;pht&#039;,    &#039;phpt&#039;,    &#039;phtml&#039;,    &#039;phar&#039;,    &#039;php3&#039;,    &#039;php4&#039;,    &#039;php5&#039;,    &#039;php7&#039;,    &#039;suspected&#039;);$tokenNeedles = array(    // Obfuscation    &#039;base64_decode&#039;,    &#039;rawurldecode&#039;,    &#039;urldecode&#039;,    &#039;gzinflate&#039;,    &#039;gzuncompress&#039;,    &#039;str_rot13&#039;,    &#039;convert_uu&#039;,    &#039;htmlspecialchars_decode&#039;,    &#039;bin2hex&#039;,    &#039;hex2bin&#039;,    &#039;hexdec&#039;,    &#039;chr&#039;,    &#039;strrev&#039;,    &#039;goto&#039;,    &#039;implode&#039;,    &#039;strtr&#039;,    &#039;extract&#039;,    &#039;parse_str&#039;, //works like extract if only one argument is given.    &#039;substr&#039;,    &#039;mb_substr&#039;,    &#039;str_replace&#039;,    &#039;substr_replace&#039;,    &#039;preg_replace&#039;, // able to do eval on match    &#039;exif_read_data&#039;,    &#039;readgzfile&#039;,    // Shell / Process    &#039;eval&#039;,    &#039;exec&#039;,    &#039;shell_exec&#039;,    &#039;system&#039;,    &#039;passthru&#039;,    &#039;pcntl_fork&#039;,    &#039;fsockopen&#039;,    &#039;proc_open&#039;,    &#039;popen &#039;,    &#039;assert&#039;, // identical to eval    &#039;posix_kill&#039;,    &#039;posix_setpgid&#039;,    &#039;posix_setsid&#039;,    &#039;posix_setuid&#039;,    &#039;proc_nice&#039;,    &#039;proc_close&#039;,    &#039;proc_terminate&#039;,    &#039;apache_child_terminate&#039;,    // Server Information    &#039;posix_getuid&#039;,    &#039;posix_geteuid&#039;,    &#039;posix_getegid&#039;,    &#039;posix_getpwuid&#039;,    &#039;posix_getgrgid&#039;,    &#039;posix_mkfifo&#039;,    &#039;posix_getlogin&#039;,    &#039;posix_ttyname&#039;,    &#039;getenv&#039;,    &#039;proc_get_status&#039;,    &#039;get_cfg_var&#039;,    &#039;disk_free_space&#039;,    &#039;disk_total_space&#039;,    &#039;diskfreespace&#039;,    &#039;getlastmo&#039;,    &#039;getmyinode&#039;,    &#039;getmypid&#039;,    &#039;getmyuid&#039;,    &#039;getmygid&#039;,    &#039;fileowner&#039;,    &#039;filegroup&#039;,    &#039;get_current_user&#039;,    &#039;pathinfo&#039;,    &#039;getcwd&#039;,    &#039;sys_get_temp_dir&#039;,    &#039;basename&#039;,    &#039;phpinfo&#039;,    // Database    &#039;mysql_connect&#039;,    &#039;mysqli_connect&#039;,    &#039;mysqli_query&#039;,    &#039;mysql_query&#039;,    // I/O    &#039;fopen&#039;,    &#039;fsockopen&#039;,    &#039;file_put_contents&#039;,    &#039;file_get_contents&#039;,    &#039;url_get_contents&#039;,    &#039;stream_get_meta_data&#039;,    &#039;move_uploaded_file&#039;,    &#039;$_files&#039;,    &#039;copy&#039;,    &#039;include&#039;,    &#039;include_once&#039;,    &#039;require&#039;,    &#039;require_once&#039;,    &#039;__file__&#039;,    // Miscellaneous    &#039;mail&#039;,    &#039;putenv&#039;,    &#039;curl_init&#039;,    &#039;tmpfile&#039;,    &#039;allow_url_fopen&#039;,    &#039;ini_set&#039;,    &#039;set_time_limit&#039;,    &#039;session_start&#039;,    &#039;symlink&#039;,    &#039;__halt_compiler&#039;,    &#039;__compiler_halt_offset__&#039;,    &#039;error_reporting&#039;,    &#039;create_function&#039;,    &#039;get_magic_quotes_gpc&#039;,    &#039;$auth_pass&#039;,    &#039;$password&#039;,);&lt;!DOCTYPE html&gt;&lt;html lang=&quot;en-us&quot;&gt;<head><title>Shell Backdoor Scanner</title>    &lt;title&gt;Shell Backdoor Scanner&lt;/title&gt;    &lt;style type=&quot;text/css&quot;&gt;        @import url(&#039;https://fonts.googleapis.com/css?family=Ubuntu+Mono&amp;display=swap&#039;);        body {            font-family: &#039;Ubuntu Mono&#039;, monospace;            color: #8a8a8a;        }        table {            border-spacing: 0;            padding: 10px;            border-radius: 7px;            border: 3px solid #d6d6d6;        }        tr,        td {            padding: 7px;        }        th {            color: #8a8a8a;            padding: 7px;            font-size: 25px;        }        input[type=submit]:focus {            background: #ff9999;            color: #fff;            border: 3px solid #ff9999;        }        input[type=submit]:hover {            border: 3px solid #ff9999;            cursor: pointer;        }        input[type=text]:hover {            border: 3px solid #ff9999;        }        input {            font-family: &#039;Ubuntu Mono&#039;, monospace;        }        input[type=text] {            border: 3px solid #d6d6d6;            outline: none;            padding: 7px;            color: #8a8a8a;            width: 100%;            border-radius: 7px;        }        input[type=submit] {            color: #8a8a8a;            border: 3px solid #d6d6d6;            outline: none;            background: none;            padding: 7px;            width: 100%;            border-radius: 7px;        }    &lt;/style&gt;</head><body>    &lt;script type=&quot;text/javascript&quot;&gt;        function copytable(el) {var urlField = document.getElementById(el)            var range = document.createRange()            range.selectNode(urlField)            window.getSelection().addRange(range)            document.execCommand(&#039;copy&#039;)        }    &lt;/script&gt;    <form>        &lt;table align=&quot;center&quot; width=&quot;30%&quot;&gt;            <tr>                &lt;th&gt;                    Shell Backdoor Finder                &lt;/th&gt;            </tr>            <tr>                <td>                    <input type=text>                </td>            </tr>            <tr>                <td>                    <input type=submit>                </td>            </tr>             if (isset($_POST[&#039;submit&#039;])) {                 <tr>                    <td>                        &lt;span style=&quot;font-weight:bold;font-size:25px;&quot;&gt;RESULT&lt;/span&gt;                        &lt;input type=button value=&quot;Copy to Clipboard&quot; onClick=&quot;copytable(&#039;result&#039;)&quot;&gt;                    </td>                </tr>            </table>            &lt;table id=&quot;result&quot; align=&quot;center&quot; width=&quot;30%&quot;&gt;                                $path = $_POST[&#039;dir&#039;];                $result = getSortedByExtension($path, $ext);                $fileWritable = $result[&#039;file_writable&#039;];                $fileNotWritable = $result[&#039;file_not_writable&#039;];                $fileWritable = sortByLastModified($fileWritable);                foreach ($fileWritable as $file) {                    $filePath = str_replace(&#039;\\&#039;, &#039;/&#039;, $file);                    $tokens = getFileTokens($filePath);                    $cmp = compareTokens($tokenNeedles, $tokens);                    $cmp = implode(&#039;, &#039;, $cmp);                    if (!empty($cmp)) {                        echo sprintf(&#039;<tr><td>&lt;span style=&quot;color:red;&quot;&gt;%s (%s)&lt;/span&gt;</td></tr>&#039;, $filePath, $cmp);                        //unlink($filePath);                    }                }            }