dongzhi8487 2015-11-16 13:08
浏览 94
已采纳

这个PHP代码做了什么? 我认为这是崩溃PHP服务器[关闭]

Trying to help a friend with a website and I came across this code in one of his files:

eval(gzinflate(base64_decode(rawurldecode('XVe3zsawEXucJPDg3hBkcO%2B9ewncey%2Bf7afPP0ebIAEHkUceVd3Z%2BM88OyoC%2B29ZFUtZ%2FbP5rrlYpnWvjuP%2Fjv5Rqb9wpBBv%2Bd6vlSi1qYZEnOoH6Zjfebms%2FcYOv3Lg87dPPvPCrM1Oh0MItF2rem30aAheEYLoweyWz9pabTXt4z5eblWb6Vnrf7l50fAA1GBm1JqiGBSSiAfZzBR%2BpjTHp3Q21QgBOusN2sgW1sU46MPDqtOvinm4CEmotPiRRnPYoVUDtpazOjRHg82MXwQTYBzxRXrFAJiY1Sn1uEDuwab0boAzNgizZxb4bIqT2qQoyH4NDzEpFq05E3wRN5oaeF2zFsApoLXXe%2FlMWJRmM2m0%2FA1pLsxo3oq9yx2tA%2FQPg3sAHOsABK44L%2FeAoXHs9gGLDN2J1lziCan7XnoNiCutN8jZIsr2IrD4uzK0eGwG%2FROBx2Clq7zY0Yij0W5aXUqn7keKqWJrJhw9MllLCV1rNJpkEEHt0AT%2B8OEecY%2Fu8Uy%2BBpCbCnERcj7rGCJPoqz%2FudROlXbMqigRnDbBpSYH4FIPMpqGj7PNsOgz2tYutIYxpbUXuYpR3I3FU3BrTWbwRgEq6a3H6%2FMvNTWzetwOwFhJzJoeTj0AcXYulg%2BOI7RmQ%2FKAVSAR%2FrALFMYlS1d32qMyPdILD1QnPIaQiNAnk%2FcpwrwXxQM2aNFJKy%2BTVUv5cYlguhRquu8uySYKDzXDMnUN13oJM0BkYiBCGTHfgwumguK8JAL3KDyWvAcFuaHpqH7mlG31vbCdqSKa6abMzKoDqunaE2Cu0lwXaXI3jELCH8Ezlfd%2B0s6VsdPRD932Kmj1wV9keySOEWLnivHaMNFqzaA7Wvjp2oBfL%2Fxl3zWQ%2FKUQtg8zgVHONMGwP%2BHps3VEQ%2Bwc9l09%2BWsmht8WpJQqX9NY%2BuXrqBXU3Ei1sWi5s%2FK02NaaXASDvwOoGakJwn1ZAeQ0K3DA2IYBJ36Q%2BIUMLT15X7vHPCHvlTB4O5W3R1IwGxuUg%2FWfogyXRVaeJGBGpppIxMWiNQuCKyWruq0eq1fm%2Fc7r4cYhEz1zIp07dxdDuL35jdB11WH62p638Ams5qptkzatBnxlaWl6heraZrv%2B%2BH3pc1XKCHbAbwltndqCnGR8CoQqP26hm0zrFdlwgQ59rSY6J9socVA13verVhzt1OesdmUUYCLF5C2ZEEvByvyhS334WX%2BS0vOHrx8zbqmo9peufjod83Ai%2FvhYcNC9g2h5B2CLdb%2FExYP7RRWpgJ2UuAUEuUBV97bTx9nneVaBK8GsIDI7RbJQqs03fDI%2B3bvuTv6EsFlBXfb6xNDYBQ3GElkZ3x5y9NnM%2FplkH00RtYX31ECg3kkZue%2BfwEd226dsj9wO81oq4rqIPgbx91Aou%2BUeRPXarL1nXzNs4THtxTSXIEye%2FXpqb%2BhnS8viwbGp7OfZ%2B32wUPd8IO1GWia0A116Y%2F2bAfkRAGo93tgaRw7yDdvdsyRJScXi%2BAiHC3gW6WEagRMigR2nbYgeOIaq7x%2FayZfG%2BfuHQluznsWKbsp%2Bbm%2FQ6Ho3YuAVRTpnda2%2FFn8Nv4rV7O4ydDUNQnb3%2BBuP0xHyRnMG8hyVRLKO3zt0l7hiN8g5VxoBfYrSGbst89njYC1OSJRnTczvMEzEWeOtnBNIQOwup7mwfPWJqxR7F3KG%2B5zTse0kOqLDoi9FJEuaiHkBEZvv8w7yF4kBvMD5lDvHBIHowCbCPvTIt7wcVIgMu56Nf88mL7tmbVfkENY0esB8%2F7jpo%2FfDwbO0SvyASoFa9v0pZYnfN2qsaGTwA8S7ich%2B1uXe2hZgtrqdshjC65cJuFqIaIUWQ6qCi8Y7XhRrtudOGn62nWOgD4v2e2sV6tqaIO8I5EQRjfTPWT06QqaLrHPAyOb%2BD8lj79NwqQDbvV6Zn02cdsuSVyWMo%2F8MdVujIefVV7vVewYXT7rnkrAZ8bigDQAesNVTQWYPjqqsx%2Bnf7AbXp9BS1QBorxLNBwAZOH4vgZzgrUI33Ob6B%2FFAFZBZwFMREHG5aZmh3AxWu5CGHHACvgwwi6aaerLIIQBClFq%2FTF43IDLSX5jc2AandiBnqb372LHP3B8ker10BE1eSBpNg%2FngMFvZeEal1pVR1TTLQJQwswil5u%2F%2B8LL9s6QQkasrfWkOxto2GozyiESBfBW%2BmfxEndlNLG41EbudH7R0EUMS3W7pGYCoQE31EqkW721DMDviefRxAI%2FnJubzRD3iDbyi%2BUwS8ltqs5WzlZPwbkPHHSwOdD45GbmzL%2BsFOLkJsNJUf6htkwekq%2BvcTWPMWYN0c3RhibLgBCNZq3Ii9p6BclC%2BhppO8tr5nLVqY8iSt8gjrEhCdVGvtwh0Qf7o57JiiqIsRCIDXkyiQFcwKxeQlMQITfmxqi3Q8ecV7Zldtf48Ix3xuMeJbQmOwgfByl8l4e8eQ9TumgJXMvrleqnHQ7Uz440Sm19zLnwMmY6nJMjIb647aiVR%2F7BMGJBdglYeKt9jBaQaBqc%2F3nulIh68mGK%2BGTYAGEPCtrzhfMzwSwZiGLaXyQ3BcxHpwJESrpxVElOOdtsc20x9fD34h9vYHfIp71JH%2B7EguvbzBUEmY5f8u2qnH3gpf%2FbU3Zg1nZ2LQm3%2Fg6cCaUiI5wZ%2FQkKBsOu%2FSvtcsxFj4lUtRb13ZhMjF4m%2BsW%2F9SAzwo4p6JCl%2Fb9MpS2eEjseflSavU862WpDvJtjoi%2FpkidpoJcavuzJUf%2BTP7LA%2F9DgcYSIXsz2BJ9G2uU5114oe%2FlVlDxgJk6QHF72SZGt9Wnw9rHPzfevD7KGwfgW4lcrLYyDxra1AS13zbe41vUe%2Bgd6GMP4TMejFq9QXh8n8TebWPT0%2FbjabP%2FD97crvES70V4XvWutB%2BNgOxGqXyZ8iqqRJZvef9Rd07wJ6T%2BjYk9f%2BPegy5SvQPQjWn5fzEpgf3%2B5CAxYPWIicrtxrMUWCEyicVeqbh%2FScV2wCEmZZbmMPJgAdQ3CmMBOxCgIAHheuHRjug3F8J35WWQAfWEfIjB%2FwEupWKEeKP7Y83TpAmvUGlNqF055udHp6uNt%2BhpzFRTOkwEbWYQ%2B%2BH8ltndIlLxLx6SI7TKWWVLyy%2F1Ft7EleYXT6CmFsQE5sjM5tbaRF4aUMlX%2BSCewSAr%2Bx6Akeul8c6J1w4Q8Upt0RHsqQmA0Y%2BZuiL34rxFE%2B%2BKQ3lfROlmcAZ1vVyhZHbiVeId68UaVB9PFX%2BjN%2Bul5LR4Nixb7Z95dciSonZJf%2BNUNhaNIHdjacWABo5cvYr2SN2HKWoXgq9MDTgjz7MDBiWvZxHYi2XftjOn70l84u9e8jwZKOnxykIGZd0SMd%2F%2BS7nliMWms6vBOWSrSU8OxdW7BdxohgZSNZi76SrmlPVK2qt3uH5l71ZVMGrKl9RqKWvuoWBW8NRjSYQTqQ6sWyhNvqY%2FcLrMPt7k4Ppsvfd8CwJZIXWYQhVWYtHX%2FqueunvE2yiSDe86QoAavxXRnXgB1wl8rtB35qaEe2DGgcoeS%2BYpqZ%2F9NhQf58rHEk2OkLrIfWCatjXSByXSIWI5vyd043kl1XftKXs1d6wYqzJENtWsBCa3y2v5TYnMaMAvhtI7m9JrpW0O2dAvQFOk5fjjeR9qNlu2FnuP283%2FHlPDji2oNtGyOcUXENeTfQ%2BuItu2mtc%2Fj7o8FQ0%2Bd1%2FeQNB0ACeqUzUON6WRGtQkf2tlYgrmviQWt5p5CBI8FXiiTbp4N3CtDcoKGpDY8bzLUT8%2FtbzlHZqmkhjajZo6mJAzswBkGeBgSw%2B%2F3nH%2F%2F6W%2F%2F%2BHw%3D%3D'))));

Can anyone tell me what it's supposed to do?? My instincts say it's just to crash / slow a server.. am I right?

Thanks!

  • 写回答

1条回答 默认 最新

  • doushishi2415 2015-11-16 13:20
    关注

    It's obfuscated the following code :

    $settings = mysql_query ('select * from settings');
    $settingrecord = mysql_fetch_array($settings);
    while ($settingrecord = mysql_fetch_array($settings)) {
        $setting[$settingrecord["name"]] = $settingrecord["setting"];
    }
    $setting['pay_with'] = unserialize($setting['pay_with']);
    extract($setting);
    
    function valid_license($license) {
        $domain = str_replace("www.", "", $_SERVER['SERVER_NAME']);
        $salt = "u3yQjZ14bDKy";
        $hash = substr(base64_encode(sha1($domain.$salt)),0,20);
        return $license == $hash;
    }
    
    
    if(strpos($_SERVER['SCRIPT_NAME'], "admin/") AND session_is_registered("alogin")) {
        if(!valid_license($license_key)) {
    
            $_POST['license'] = trim($_POST['license']);
    
            if($_POST['license'] AND valid_license($_POST['license'])) {
                mysql_query("UPDATE settings SET setting='".$_POST['license']."' WHERE name='license_key'");
            } else {
                include "../header.php";
                include "../style.php";
    
                echo "<br /><br />";
                if($_POST['license']!="") echo "<font color=red><b>Please enter a valid license to access the admin area</b></font><br />";
                else echo "Please enter a valid license to access the admin area<br />";
    
                echo "<form method=post><input type=text name=license size=30 /><br /><input type=submit value=Submit /></form><br />";
                include "../footer.php";
                exit;
            }
        }
    }
    

    Doesn't look malicious at first glance. Looks like it's trying to enforce some kind of licensing or something.

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论

报告相同问题?

悬赏问题

  • ¥15 素材场景中光线烘焙后灯光失效
  • ¥15 请教一下各位,为什么我这个没有实现模拟点击
  • ¥15 执行 virtuoso 命令后,界面没有,cadence 启动不起来
  • ¥50 comfyui下连接animatediff节点生成视频质量非常差的原因
  • ¥20 有关区间dp的问题求解
  • ¥15 多电路系统共用电源的串扰问题
  • ¥15 slam rangenet++配置
  • ¥15 有没有研究水声通信方面的帮我改俩matlab代码
  • ¥15 ubuntu子系统密码忘记
  • ¥15 保护模式-系统加载-段寄存器