好消息:胡歌网摘新面貌迎接2015~!

eval(base64_decode的php加密文件解密方法

网络技术 胡歌 1027浏览 0评论

下载了一个*ZhePHP的值得买模式的海淘网站程序,出于对网上代码的不信任,检测一下,发现3个文件可能留有后门。

分别是:

app/Lib/Action/baseAction.class.php
app/Lib/Action/admin/indexAction.class.php
app/Lib/Action/mobile/searchAction.class.php

加密模式都基本一样,是eval+base64_decode的。

其他不讲,说说这种加密php文件的解码方式吧。

拿app/Lib/Action/admin/indexAction.class.php来举例,加密的源代码如下:

<?php $_F=__FILE__;$_X='Pz48P3BocCANCi8qKg0KKiBaaDVQSFAgJiNhMGl1MDsmI2F1dTc2OyYjYTAwODA7JiNhNzZlOTsmI2F1b29pOyYjbzBvdTA7JiNhODBhbzsmI2E4NmEwOyYjb2FpOW87JiNvNnV1OTsmI282YXVvOyYjYXVhMDc7DQoqID09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09DQoqIHd3dy4xZG00bm4uY24NCiogPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0NCiovDQpjbDFzcyA0bmQ1eEFjdDQybiA1eHQ1bmRzIGIxY2s1bmRBY3Q0Mm4gew0KICAgIHAzYmw0YyBmM25jdDQybiBfNG40dDQxbDR6NSgpIHsNCiAgICAgICAgcDFyNW50OjpfNG40dDQxbDR6NSgpOw0KICAgICAgICAkdGg0cy0+X20yZCA9IEQoJ201bjMnKTsNCiAgICB9DQogICAgcDNibDRjIGYzbmN0NDJuIDRuZDV4KCkgeyAgICAgICAgDQogICAgICAgICR0MnBfbTVuM3MgPSAkdGg0cy0+X20yZC0+MWRtNG5fbTVuMygwKTsNCiAgICAgICAgJHRoNHMtPjFzczRnbigndDJwX201bjNzJywgJHQycF9tNW4zcyk7ICAgICAgICANCiAgICAgICAgJG15XzFkbTRuID0gMXJyMXkoJzNzNXJuMW01Jz0+JF9TRVNTSU9OWycxZG00biddWyczczVybjFtNSddLCAncjJsNW4xbTUnPT4kX1NFU1NJT05bJzFkbTRuJ11bJ3IybDVfbjFtNSddKTsNCiAgICAgICAgJHRoNHMtPjFzczRnbignbXlfMWRtNG4nLCAkbXlfMWRtNG4pOyAgICAgICAgICAgICAgICAgICANCiAgICAgICAgJHRoNHMtPjFzczRnbignbTVuM19kMXQxJyxqczJuXzVuYzJkNSgkdGg0cy0+X20yZC0+ZzV0X201bjNfZDF0MSgpKSk7ICAgICANCiAgICAgICAgJHRoNHMtPmQ0c3BsMXkoKTsNCiAgICB9DQogICAgcDNibDRjIGYzbmN0NDJuIHAxbjVsKCkgew0KICAgICAgICAkbTVzczFnNSA9IDFycjF5KCk7DQogICAgICAgIDRmICg0c19kNHIoJy4vNG5zdDFsbCcpKSB7DQogICAgICAgICAgICAkbTVzczFnNVtdID0gMXJyMXkoDQogICAgICAgICAgICAgICAgJ3R5cDUnID0+ICc1cnIycicsDQogICAgICAgICAgICAgICAgJ2MybnQ1bnQnID0+ICImI2F1N3V1OyYjb2U4YXU7JiNhNzgwOTsmI2Flbzc3OyYjYTYwYXU7JiNvOGkwMDsgNG5zdDFsbCAmI2FpOTk2OyYjYTBhNnU7JiNhYTh1NjsmI2VpYTlhOyYjYTA5OGU7JiNhMDY2MDsmI2FvdW9vOyYjYTA4dTA7JiNvMG91MDsmI29hNzc2OyYjb3VvOGk7JiNlaWE5YTsmI2FpNjBpOyYjYTBhMHU7JiNhdW82dTsmI29pN2k4OyYjYXU3dXU7JiNhNjBhdTsmI284aTAwOyA0bnN0MWxsICYjYWk5OTY7JiNhMGE2dTsmI2FhOHU2OyYjNmFhOTA7IiwNCiAgICAgICAgICAgICk7DQogICAgICAgIH0NCiAgICAgICAgNGYgKEFQUF9ERUJVRyA9PSB0cjM1KSB7DQogICAgICAgICAgICAkbTVzczFnNVtdID0gMXJyMXkoDQogICAgICAgICAgICAgICAgJ3R5cDUnID0+ICc1cnIycicsDQogICAgICAgICAgICAgICAgJ2MybnQ1bnQnID0+ICImI2F1N3V1OyYjb2FpOW87JiNvNnV1OTsmI28wb3UwOyBERUJVRyAmI2E3ODA5OyYjYWVvNzc7JiNhMDhpNjsmI284bzg2OyYjZWlhOWE7JiNhMDk4ZTsmI2EwNjYwOyYjYW91b287JiNhMDh1MDsmI29hNzc2OyYjb3VvOGk7JiNlaWE5YTsmI2FpNjBpOyYjYTBhMHU7JiNhdW82dTsmI29pN2k4OyYjYXU3dXU7JiNhMDhpNjsmI284bzg2OyYjbzZhdW87JiNhdWEwNzsgREVCVUcmIzZhYTkwOyIsDQogICAgICAgICAgICApOw0KICAgICAgICB9DQogICAgICAgIDRmICghZjNuY3Q0Mm5fNXg0c3RzKCJjM3JsX2c1dDRuZjIiKSkgew0KICAgICAgICAgICAgJG01c3MxZzVbXSA9IDFycjF5KA0KICAgICAgICAgICAgICAgICd0eXA1JyA9PiAnNXJyMnInLA0KICAgICAgICAgICAgICAgICdjMm50NW50JyA9PiAiJiNvNjk5aTsmI29hdTc5OyYjNjk5ODY7JiNhaTkwbzsmI2Fpb3VpOyBDVVJMICwmI2FvaWk4OyYjYWUwODA7JiNhNzhlNjsmI283bzY5OyYjbzhpOTg7JiNhNjhvMDsmI2E2ZTk3OyYjYWk5ZTg7JiNhaXVpdTsmIzZhYTkwOyIsDQogICAgICAgICAgICApOw0KICAgICAgICB9DQogICAgICAgICR0aDRzLT4xc3M0Z24oJ201c3MxZzUnLCAkbTVzczFnNSk7DQogICAgICAgICRzeXN0NW1fNG5mMiA9IDFycjF5KA0KICAgICAgICAgICAgJ1poNFBIUF92NXJzNDJuJyA9PiBaSElfVkVSU0lPTiAuICcgUkVMRUFTRSAnLiBaSElfUkVMRUFTRSAuJyBbPDEgaHI1Zj0iaHR0cDovL3d3dy4xZG00bm4uY24vIiBjbDFzcz0iYmwzNSIgdDFyZzV0PSJfYmwxbmsiPiYjYWVpOTc7JiNvMHU3aTsmI2Flb2U4OyYjYWUwb2E7JiNhOWFpZTsmI2FldTZhOzwvMT5dJywNCiAgICAgICAgICAgICdzNXJ2NXJfZDJtMTRuJyA9PiAkX1NFUlZFUlsnU0VSVkVSX05BTUUnXSAuICcgWyAnIC4gZzV0aDJzdGJ5bjFtNSgkX1NFUlZFUlsnU0VSVkVSX05BTUUnXSkgLiAnIF0nLA0KICAgICAgICAgICAgJ3M1cnY1cl8ycycgPT4gUEhQX09TLA0KICAgICAgICAgICAgJ3c1Yl9zNXJ2NXInID0+ICRfU0VSVkVSWyJTRVJWRVJfU09GVFdBUkUiXSwNCiAgICAgICAgICAgICdwaHBfdjVyczQybicgPT4gUEhQX1ZFUlNJT04sDQogICAgICAgICAgICAnbXlzcWxfdjVyczQybicgPT4gbXlzcWxfZzV0X3M1cnY1cl80bmYyKCksDQogICAgICAgICAgICAnM3BsMjFkX20xeF9mNGw1czR6NScgPT4gNG40X2c1dCgnM3BsMjFkX20xeF9mNGw1czR6NScpLA0KICAgICAgICAgICAgJ20xeF81eDVjM3Q0Mm5fdDRtNScgPT4gNG40X2c1dCgnbTF4XzV4NWMzdDQybl90NG01JykgLiAnJiNvNjY4ZTsnLA0KICAgICAgICAgICAgJ3MxZjVfbTJkNScgPT4gKGIyMmw1MW4pIDRuNF9nNXQoJ3MxZjVfbTJkNScpID8gIEwoJ3k1cycpIDogTCgnbjInKSwNCiAgICAgICAgICAgICd6bDRiJyA9PiBmM25jdDQybl81eDRzdHMoJ2d6Y2wyczUnKSA/ICBMKCd5NXMnKSA6IEwoJ24yJyksDQogICAgICAgICAgICAnYzNybCcgPT4gZjNuY3Q0Mm5fNXg0c3RzKCJjM3JsX2c1dDRuZjIiKSA/IEwoJ3k1cycpIDogTCgnbjInKSwNCiAgICAgICAgICAgICd0NG01ejJuNScgPT4gZjNuY3Q0Mm5fNXg0c3RzKCJkMXQ1X2Q1ZjEzbHRfdDRtNXoybjVfZzV0IikgPyBkMXQ1X2Q1ZjEzbHRfdDRtNXoybjVfZzV0KCkgOiBMKCduMicpDQogICAgICAgICk7DQogICAgICAgICR0aDRzLT4xc3M0Z24oJ3N5c3Q1bV80bmYyJywgJHN5c3Q1bV80bmYyKTsNCiAgICAgICAgJHRoNHMtPmQ0c3BsMXkoKTsNCiAgICB9DQogICAgcDNibDRjIGYzbmN0NDJuIGwyZzRuKCkgew0KICAgICAgICA0ZiAoSVNfUE9TVCkgeyAgICAgICAgICAgIA0KICAgICAgICAgICAgJDNzNXJuMW01ID0gJHRoNHMtPl9wMnN0KCczczVybjFtNScsICd0cjRtJyk7DQogICAgICAgICAgICAkcDFzc3cycmQgPSAkdGg0cy0+X3Ayc3QoJ3Axc3N3MnJkJywgJ3RyNG0nKTsNCiAgICAgICAgICAgICR2NXI0ZnlfYzJkNSA9ICR0aDRzLT5fcDJzdCgndjVyNGZ5X2MyZDUnLCAndHI0bScpOw0KICAgICAgICAgICAgNGYoczVzczQybigndjVyNGZ5JykgIT0gbWRpKCR2NXI0ZnlfYzJkNSkmJkMoJ3A0bl9jMXB0Y2gxX3N0MXQzcycpKXsNCiAgICAgICAgICAgICAgICAkdGg0cy0+NXJyMnIoTCgndjVyNGZ5X2MyZDVfNXJyMnInKSk7DQogICAgICAgICAgICB9DQogICAgICAgICAgICAkMWRtNG4gPSBEKCcxZG00bicpLT53aDVyNSgxcnIxeSgnM3M1cm4xbTUnPT4kM3M1cm4xbTUsICdzdDF0M3MnPT42KSktPmY0bmQoKTsNCiAgICAgICAgICAgIDRmICghJDFkbTRuKSB7DQogICAgICAgICAgICAgICAgJHRoNHMtPjVycjJyKEwoJzFkbTRuX24ydF81eDRzdCcpKTsNCiAgICAgICAgICAgIH0NCiAgICAgICAgICAgIDRmICgkMWRtNG5bJ3Axc3N3MnJkJ10gIT0gbWRpKCRwMXNzdzJyZCkpIHsNCiAgICAgICAgICAgICAgICAkdGg0cy0+NXJyMnIoTCgncDFzc3cycmRfNXJyMnInKSk7DQogICAgICAgICAgICB9DQogICAgICAgICAgICAkZDF0MT0xcnIxeSgNCiAgICAgICAgICAgICAgICAnNGQnID0+ICQxZG00blsnNGQnXSwNCiAgICAgICAgICAgICAgICAncjJsNV80ZCc9PiQxZG00blsncjJsNV80ZCddLA0KICAgICAgICAgICAgICAgICdyMmw1X24xbTUnID0+IEQoJzFkbTRuX3IybDUnKS0+d2g1cjUoIjRkPSQxZG00bltyMmw1XzRkXSIpLT5nNXRGNDVsZCgibjFtNSIpLA0KICAgICAgICAgICAgICAgICczczVybjFtNScgPT4gJDFkbTRuWyczczVybjFtNSddLA0KICAgICAgICAgICAgICAgICd0Mms1bic9Pm1kaSgkM3M1cm4xbTUubWRpKCRwMXNzdzJyZCkpLA0KICAgICAgICAgICAgKTsNCiAgICAgICAgICAgIGMyMms0NSgnMWRtNG4nLCRkMXQxLDFycjF5KCc1eHA0cjUnPT5vZTAwKmF1KjYwKSk7DQogICAgICAgICAgICBzNXNzNDJuKCcxZG00bicsICRkMXQxKTsNCiAgICAgICAgICAgIEQoJzFkbTRuJyktPndoNXI1KDFycjF5KCc0ZCc9PiQxZG00blsnNGQnXSkpLT5zMXY1KDFycjF5KCdsMXN0X3Q0bTUnPT50NG01KCksICdsMXN0XzRwJz0+ZzV0X2NsNDVudF80cCgpKSk7DQogICAgICAgICAgICAkcjV0XzNybD0kdGg0cy0+X3I1cTM1c3QoJ3I1dF8zcmwnLCczcmxfZDVjMmQ1JyxVKCc0bmQ1eC80bmQ1eCcpKTsNCiAgICAgICAgICAgICRyNXRfM3JsXzRuZjI9cDFyczVfM3JsKCRyNXRfM3JsKTsNCiAgICAgICAgICAgICR0aDRzLT5zM2NjNXNzKEwoJ2wyZzRuX3MzY2M1c3MnKSxVKCc0bmQ1eC80bmQ1eCcpLiIjIi4zcmxkNWMyZDUoJHI1dF8zcmxfNG5mMlsnZnIxZ201bnQnXSkpOw0KICAgICAgICB9IDVsczUgew0KICAgICAgICAgICAgJHRoNHMtPmQ0c3BsMXkoKTsNCiAgICAgICAgfQ0KICAgIH0NCiAgICBwM2JsNGMgZjNuY3Q0Mm4gbDJnMjN0KCkgew0KICAgICAgICBzNXNzNDJuKCcxZG00bicsIG4zbGwpOw0KICAgICAgICBjMjJrNDUoJzFkbTRuJyxuM2xsKTsNCiAgICAgICAgJHRoNHMtPnMzY2M1c3MoTCgnbDJnMjN0X3MzY2M1c3MnKSwgVSgnNG5kNXgvbDJnNG4nKSk7DQogICAgICAgIDV4NHQ7DQogICAgfQ0KICAgIHAzYmw0YyBmM25jdDQybiB2NXI0ZnlfYzJkNSgpIHsNCiAgICAgICAgSW0xZzU6OmIzNGxkSW0xZzVWNXI0ZnkodSw2LCdnNGYnLCdpMCcsJ2F1Jyk7DQogICAgfQ0KICAgIHAzYmw0YyBmM25jdDQybiBsNWZ0KCkgew0KICAgICAgICAkbTVuMzRkID0gJHRoNHMtPl9yNXEzNXN0KCdtNW4zNGQnLCAnNG50djFsJywwKTsNCiAgICAgICAgNGYgKCRtNW4zNGQpIHsNCiAgICAgICAgICAgICRsNWZ0X201bjMgPSAkdGg0cy0+X20yZC0+MWRtNG5fbTVuMygkbTVuMzRkKTsNCiAgICAgICAgICAgIGYycjUxY2ggKCRsNWZ0X201bjMgMXMgJGs1eT0+JHYxbCkgew0KICAgICAgICAgICAgICAgICRsNWZ0X201bjNbJGs1eV1bJ3MzYiddID0gJHRoNHMtPl9tMmQtPjFkbTRuX201bjMoJHYxbFsnNGQnXSk7DQogICAgICAgICAgICB9DQogICAgICAgIH0gNWxzNSB7DQogICAgICAgICAgICAkbDVmdF9tNW4zWzBdID0gMXJyMXkoJzRkJz0+MCwnbjFtNSc9PkwoJ2MybW0ybl9tNW4zJykpOw0KICAgICAgICAgICAgJGw1ZnRfbTVuM1swXVsnczNiJ10gPSAxcnIxeSgpOw0KICAgICAgICAgICAgNGYgKCRyID0gJHRoNHMtPl9tMmQtPndoNXI1KDFycjF5KCcyZnQ1bic9PjYpKS0+czVsNWN0KCkpIHsNCiAgICAgICAgICAgICAgICAkbDVmdF9tNW4zWzBdWydzM2InXSA9ICRyOw0KICAgICAgICAgICAgfQ0KICAgICAgICAgICAgMXJyMXlfM25zaDRmdCgkbDVmdF9tNW4zWzBdWydzM2InXSwgMXJyMXkoJzRkJz0+MCwnbjFtNSc9PicmI2E2aTY4OyYjYTZ1ODg7JiNvOW82ODsmI285MGE5OycpKTsNCiAgICAgICAgfQ0KICAgICAgICAkdGg0cy0+MXNzNGduKCd0MnA0ZCcsICRtNW4zNGQpOw0KICAgICAgICAkdGg0cy0+MXNzNGduKCdsNWZ0X201bjMnLCAkbDVmdF9tNW4zKTsNCiAgICAgICAgJHRoNHMtPmQ0c3BsMXkoKTsNCiAgICB9DQogICAgcDNibDRjIGYzbmN0NDJuIDJmdDVuKCkgew0KICAgICAgICA0ZiAoNHNzNXQoJF9QT1NUWydkMiddKSkgew0KICAgICAgICAgICAgJDRkXzFyciA9IDRzczV0KCRfUE9TVFsnNGQnXSkgJiYgNHNfMXJyMXkoJF9QT1NUWyc0ZCddKSA/ICRfUE9TVFsnNGQnXSA6ICcnOw0KICAgICAgICAgICAgJHRoNHMtPl9tMmQtPndoNXI1KDFycjF5KCcyZjVuJz0+NikpLT5zMXY1KDFycjF5KCcyZnQ1bic9PjApKTsNCiAgICAgICAgICAgICQ0ZF9zdHIgPSA0bXBsMmQ1KCcsJywgJDRkXzFycik7DQogICAgICAgICAgICAkdGg0cy0+X20yZC0+d2g1cjUoJzRkIElOKCcuJDRkX3N0ci4nKScpLT5zMXY1KDFycjF5KCcyZnQ1bic9PjYpKTsNCiAgICAgICAgICAgICR0aDRzLT5zM2NjNXNzKEwoJzJwNXIxdDQybl9zM2NjNXNzJykpOw0KICAgICAgICB9IDVsczUgew0KICAgICAgICAgICAgJHIgPSAkdGg0cy0+X20yZC0+MWRtNG5fbTVuMygwKTsNCiAgICAgICAgICAgICRsNHN0ID0gMXJyMXkoKTsNCiAgICAgICAgICAgIGYycjUxY2ggKCRyIDFzICR2KSB7DQogICAgICAgICAgICAgICAgJHZbJ3MzYiddID0gJHRoNHMtPl9tMmQtPjFkbTRuX201bjMoJHZbJzRkJ10pOw0KICAgICAgICAgICAgICAgIGYycjUxY2ggKCR2WydzM2InXSAxcyAkazV5PT4kc3YpIHsNCiAgICAgICAgICAgICAgICAgICAgJHZbJ3MzYiddWyRrNXldWydzM2InXSA9ICR0aDRzLT5fbTJkLT4xZG00bl9tNW4zKCRzdlsnNGQnXSk7DQogICAgICAgICAgICAgICAgfQ0KICAgICAgICAgICAgICAgICRsNHN0W10gPSAkdjsNCiAgICAgICAgICAgIH0NCiAgICAgICAgICAgICR0aDRzLT4xc3M0Z24oJ2w0c3QnLCAkbDRzdCk7DQogICAgICAgICAgICAkdGg0cy0+ZDRzcGwxeSgpOw0KICAgICAgICB9DQogICAgfQ0KICAgIHAzYmw0YyBmM25jdDQybiBtMXAoKSB7DQogICAgICAgICRyID0gJHRoNHMtPl9tMmQtPjFkbTRuX201bjMoMCk7DQogICAgICAgICRsNHN0ID0gMXJyMXkoKTsNCiAgICAgICAgZjJyNTFjaCAoJHIgMXMgJHYpIHsNCiAgICAgICAgICAgICR2WydzM2InXSA9ICR0aDRzLT5fbTJkLT4xZG00bl9tNW4zKCR2Wyc0ZCddKTsNCiAgICAgICAgICAgIGYycjUxY2ggKCR2WydzM2InXSAxcyAkazV5PT4kc3YpIHsNCiAgICAgICAgICAgICAgICAkdlsnczNiJ11bJGs1eV1bJ3MzYiddID0gJHRoNHMtPl9tMmQtPjFkbTRuX201bjMoJHN2Wyc0ZCddKTsNCiAgICAgICAgICAgIH0NCiAgICAgICAgICAgICRsNHN0W10gPSAkdjsNCiAgICAgICAgfQ0KICAgICAgICAkdGg0cy0+MXNzNGduKCdsNHN0JywgJGw0c3QpOw0KICAgICAgICAkdGg0cy0+ZDRzcGwxeSgpOw0KICAgIH0NCn0=';eval(base64_decode('JF9YPWJhc2U2NF9kZWNvZGUoJF9YKTskX1g9c3RydHIoJF9YLCcxMjM0NTZhb3VpZScsJ2FvdWllMTIzNDU2Jyk7JF9SPWVyZWdfcmVwbGFjZSgnX19GSUxFX18nLCInIi4kX0YuIiciLCRfWCk7ZXZhbCgkX1IpOyRfUj0wOyRfWD0wOw=='));?>

注意到代码的后面有个eval(base64_decode(…………
直接将eval改为echo,就能输出后面加密的原始内容为:

$_X=base64_decode($_X);$_X=strtr($_X,'123456aouie','aouie123456');$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);eval($_R);$_R=0;$_X=0;

整理下,即为

$_X=base64_decode($_X);
$_X=strtr($_X,'123456aouie','aouie123456');
$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);
eval($_R);
$_R=0;
$_X=0;

一步一步来:
$_X=base64_decode($_X);
echo出$_X的值为:

<?php 
/**
* Zh5PHP &#a0iu0;&#auu76;&#a0080;&#a76e9;&#auooi;&#o0ou0;&#a80ao;&#a86a0;&#oai9o;&#o6uu9;&#o6auo;&#aua07;
* ====================================================================
*/
cl1ss 4nd5xAct42n 5xt5nds b1ck5ndAct42n {
    p3bl4c f3nct42n _4n4t41l4z5() {
        p1r5nt::_4n4t41l4z5();
        $th4s->_m2d = D('m5n3');
    }
    p3bl4c f3nct42n 4nd5x() {        
        $t2p_m5n3s = $th4s->_m2d->1dm4n_m5n3(0);
        $th4s->1ss4gn('t2p_m5n3s', $t2p_m5n3s);        
        $my_1dm4n = 1rr1y('3s5rn1m5'=>$_SESSION['1dm4n']['3s5rn1m5'], 'r2l5n1m5'=>$_SESSION['1dm4n']['r2l5_n1m5']);
        $th4s->1ss4gn('my_1dm4n', $my_1dm4n);                   
        $th4s->1ss4gn('m5n3_d1t1',js2n_5nc2d5($th4s->_m2d->g5t_m5n3_d1t1()));     
        $th4s->d4spl1y();
    }
    p3bl4c f3nct42n p1n5l() {
        $m5ss1g5 = 1rr1y();
        4f (4s_d4r('./4nst1ll')) {
            $m5ss1g5[] = 1rr1y(
                'typ5' => '5rr2r',
                'c2nt5nt' => "&#au7uu;&#oe8au;&#a7809;&#aeo77;&#a60au;&#o8i00; 4nst1ll &#ai996;&#a0a6u;&#aa8u6;&#eia9a;&#a098e;&#a0660;&#aouoo;&#a08u0;&#o0ou0;&#oa776;&#ouo8i;&#eia9a;&#ai60i;&#a0a0u;&#auo6u;&#oi7i8;&#au7uu;&#a60au;&#o8i00; 4nst1ll &#ai996;&#a0a6u;&#aa8u6;&#6aa90;",
            );
        }
        4f (APP_DEBUG == tr35) {
            $m5ss1g5[] = 1rr1y(
                'typ5' => '5rr2r',
                'c2nt5nt' => "&#au7uu;&#oai9o;&#o6uu9;&#o0ou0; DEBUG &#a7809;&#aeo77;&#a08i6;&#o8o86;&#eia9a;&#a098e;&#a0660;&#aouoo;&#a08u0;&#oa776;&#ouo8i;&#eia9a;&#ai60i;&#a0a0u;&#auo6u;&#oi7i8;&#au7uu;&#a08i6;&#o8o86;&#o6auo;&#aua07; DEBUG&#6aa90;",
            );
        }
        4f (!f3nct42n_5x4sts("c3rl_g5t4nf2")) {
            $m5ss1g5[] = 1rr1y(
                'typ5' => '5rr2r',
                'c2nt5nt' => "&#o699i;&#oau79;&#69986;&#ai90o;&#aioui; CURL ,&#aoii8;&#ae080;&#a78e6;&#o7o69;&#o8i98;&#a68o0;&#a6e97;&#ai9e8;&#aiuiu;&#6aa90;",
            );
        }
        $th4s->1ss4gn('m5ss1g5', $m5ss1g5);
        $syst5m_4nf2 = 1rr1y(
            'Zh4PHP_v5rs42n' => ZHI_VERSION . ' RELEASE '. ZHI_RELEASE .' [<1 hr5f="http://www.1dm4nn.cn/" cl1ss="bl35" t1rg5t="_bl1nk">&#aei97;&#o0u7i;&#aeoe8;&#ae0oa;&#a9aie;&#aeu6a;</1>]',
            's5rv5r_d2m14n' => $_SERVER['SERVER_NAME'] . ' [ ' . g5th2stbyn1m5($_SERVER['SERVER_NAME']) . ' ]',
            's5rv5r_2s' => PHP_OS,
            'w5b_s5rv5r' => $_SERVER["SERVER_SOFTWARE"],
            'php_v5rs42n' => PHP_VERSION,
            'mysql_v5rs42n' => mysql_g5t_s5rv5r_4nf2(),
            '3pl21d_m1x_f4l5s4z5' => 4n4_g5t('3pl21d_m1x_f4l5s4z5'),
            'm1x_5x5c3t42n_t4m5' => 4n4_g5t('m1x_5x5c3t42n_t4m5') . '&#o668e;',
            's1f5_m2d5' => (b22l51n) 4n4_g5t('s1f5_m2d5') ?  L('y5s') : L('n2'),
            'zl4b' => f3nct42n_5x4sts('gzcl2s5') ?  L('y5s') : L('n2'),
            'c3rl' => f3nct42n_5x4sts("c3rl_g5t4nf2") ? L('y5s') : L('n2'),
            't4m5z2n5' => f3nct42n_5x4sts("d1t5_d5f13lt_t4m5z2n5_g5t") ? d1t5_d5f13lt_t4m5z2n5_g5t() : L('n2')
        );
        $th4s->1ss4gn('syst5m_4nf2', $syst5m_4nf2);
        $th4s->d4spl1y();
    }
    p3bl4c f3nct42n l2g4n() {
        4f (IS_POST) {            
            $3s5rn1m5 = $th4s->_p2st('3s5rn1m5', 'tr4m');
            $p1ssw2rd = $th4s->_p2st('p1ssw2rd', 'tr4m');
            $v5r4fy_c2d5 = $th4s->_p2st('v5r4fy_c2d5', 'tr4m');
            4f(s5ss42n('v5r4fy') != mdi($v5r4fy_c2d5)&&C('p4n_c1ptch1_st1t3s')){
                $th4s->5rr2r(L('v5r4fy_c2d5_5rr2r'));
            }
            $1dm4n = D('1dm4n')->wh5r5(1rr1y('3s5rn1m5'=>$3s5rn1m5, 'st1t3s'=>6))->f4nd();
            4f (!$1dm4n) {
                $th4s->5rr2r(L('1dm4n_n2t_5x4st'));
            }
            4f ($1dm4n['p1ssw2rd'] != mdi($p1ssw2rd)) {
                $th4s->5rr2r(L('p1ssw2rd_5rr2r'));
            }
            $d1t1=1rr1y(
                '4d' => $1dm4n['4d'],
                'r2l5_4d'=>$1dm4n['r2l5_4d'],
                'r2l5_n1m5' => D('1dm4n_r2l5')->wh5r5("4d=$1dm4n[r2l5_4d]")->g5tF45ld("n1m5"),
                '3s5rn1m5' => $1dm4n['3s5rn1m5'],
                't2k5n'=>mdi($3s5rn1m5.mdi($p1ssw2rd)),
            );
            c22k45('1dm4n',$d1t1,1rr1y('5xp4r5'=>oe00*au*60));
            s5ss42n('1dm4n', $d1t1);
            D('1dm4n')->wh5r5(1rr1y('4d'=>$1dm4n['4d']))->s1v5(1rr1y('l1st_t4m5'=>t4m5(), 'l1st_4p'=>g5t_cl45nt_4p()));
            $r5t_3rl=$th4s->_r5q35st('r5t_3rl','3rl_d5c2d5',U('4nd5x/4nd5x'));
            $r5t_3rl_4nf2=p1rs5_3rl($r5t_3rl);
            $th4s->s3cc5ss(L('l2g4n_s3cc5ss'),U('4nd5x/4nd5x')."#".3rld5c2d5($r5t_3rl_4nf2['fr1gm5nt']));
        } 5ls5 {
            $th4s->d4spl1y();
        }
    }
    p3bl4c f3nct42n l2g23t() {
        s5ss42n('1dm4n', n3ll);
        c22k45('1dm4n',n3ll);
        $th4s->s3cc5ss(L('l2g23t_s3cc5ss'), U('4nd5x/l2g4n'));
        5x4t;
    }
    p3bl4c f3nct42n v5r4fy_c2d5() {
        Im1g5::b34ldIm1g5V5r4fy(u,6,'g4f','i0','au');
    }
    p3bl4c f3nct42n l5ft() {
        $m5n34d = $th4s->_r5q35st('m5n34d', '4ntv1l',0);
        4f ($m5n34d) {
            $l5ft_m5n3 = $th4s->_m2d->1dm4n_m5n3($m5n34d);
            f2r51ch ($l5ft_m5n3 1s $k5y=>$v1l) {
                $l5ft_m5n3[$k5y]['s3b'] = $th4s->_m2d->1dm4n_m5n3($v1l['4d']);
            }
        } 5ls5 {
            $l5ft_m5n3[0] = 1rr1y('4d'=>0,'n1m5'=>L('c2mm2n_m5n3'));
            $l5ft_m5n3[0]['s3b'] = 1rr1y();
            4f ($r = $th4s->_m2d->wh5r5(1rr1y('2ft5n'=>6))->s5l5ct()) {
                $l5ft_m5n3[0]['s3b'] = $r;
            }
            1rr1y_3nsh4ft($l5ft_m5n3[0]['s3b'], 1rr1y('4d'=>0,'n1m5'=>'&#a6i68;&#a6u88;&#o9o68;&#o90a9;'));
        }
        $th4s->1ss4gn('t2p4d', $m5n34d);
        $th4s->1ss4gn('l5ft_m5n3', $l5ft_m5n3);
        $th4s->d4spl1y();
    }
    p3bl4c f3nct42n 2ft5n() {
        4f (4ss5t($_POST['d2'])) {
            $4d_1rr = 4ss5t($_POST['4d']) && 4s_1rr1y($_POST['4d']) ? $_POST['4d'] : '';
            $th4s->_m2d->wh5r5(1rr1y('2f5n'=>6))->s1v5(1rr1y('2ft5n'=>0));
            $4d_str = 4mpl2d5(',', $4d_1rr);
            $th4s->_m2d->wh5r5('4d IN('.$4d_str.')')->s1v5(1rr1y('2ft5n'=>6));
            $th4s->s3cc5ss(L('2p5r1t42n_s3cc5ss'));
        } 5ls5 {
            $r = $th4s->_m2d->1dm4n_m5n3(0);
            $l4st = 1rr1y();
            f2r51ch ($r 1s $v) {
                $v['s3b'] = $th4s->_m2d->1dm4n_m5n3($v['4d']);
                f2r51ch ($v['s3b'] 1s $k5y=>$sv) {
                    $v['s3b'][$k5y]['s3b'] = $th4s->_m2d->1dm4n_m5n3($sv['4d']);
                }
                $l4st[] = $v;
            }
            $th4s->1ss4gn('l4st', $l4st);
            $th4s->d4spl1y();
        }
    }
    p3bl4c f3nct42n m1p() {
        $r = $th4s->_m2d->1dm4n_m5n3(0);
        $l4st = 1rr1y();
        f2r51ch ($r 1s $v) {
            $v['s3b'] = $th4s->_m2d->1dm4n_m5n3($v['4d']);
            f2r51ch ($v['s3b'] 1s $k5y=>$sv) {
                $v['s3b'][$k5y]['s3b'] = $th4s->_m2d->1dm4n_m5n3($sv['4d']);
            }
            $l4st[] = $v;
        }
        $th4s->1ss4gn('l4st', $l4st);
        $th4s->d4spl1y();
    }
}
?>

然后再用strtr一一替换下字符。$_X=strtr($_X,’123456aouie’,’aouie123456′); 再输出,得到如下代码:

<?php 
/**
* ZhePHP &#20540;&#24471;&#20080;&#27169;&#24335;&#30340;&#28023;&#28120;&#32593;&#31449;&#31243;&#24207;
* ====================================================================
*/
class indexAction extends backendAction {
    public function _initialize() {
        parent::_initialize();
        $this->_mod = D('menu');
    }
    public function index() {        
        $top_menus = $this->_mod->admin_menu(0);
        $this->assign('top_menus', $top_menus);        
        $my_admin = array('username'=>$_SESSION['admin']['username'], 'rolename'=>$_SESSION['admin']['role_name']);
        $this->assign('my_admin', $my_admin);                   
        $this->assign('menu_data',json_encode($this->_mod->get_menu_data()));     
        $this->display();
    }
    public function panel() {
        $message = array();
        if (is_dir('./install')) {
            $message[] = array(
                'type' => 'error',
                'content' => "&#24744;&#36824;&#27809;&#26377;&#21024;&#38500; install &#25991;&#20214;&#22841;&#65292;&#20986;&#20110;&#23433;&#20840;&#30340;&#32771;&#34385;&#65292;&#25105;&#20204;&#24314;&#35758;&#24744;&#21024;&#38500; install &#25991;&#20214;&#22841;&#12290;",
            );
        }
        if (APP_DEBUG == true) {
            $message[] = array(
                'type' => 'error',
                'content' => "&#24744;&#32593;&#31449;&#30340; DEBUG &#27809;&#26377;&#20851;&#38381;&#65292;&#20986;&#20110;&#23433;&#20840;&#32771;&#34385;&#65292;&#25105;&#20204;&#24314;&#35758;&#24744;&#20851;&#38381;&#31243;&#24207; DEBUG&#12290;",
            );
        }
        if (!function_exists("curl_getinfo")) {
            $message[] = array(
                'type' => 'error',
                'content' => "&#31995;&#32479;&#19981;&#25903;&#25345; CURL ,&#23558;&#26080;&#27861;&#37319;&#38598;&#21830;&#21697;&#25968;&#25454;&#12290;",
            );
        }
        $this->assign('message', $message);
        $system_info = array(
            'ZhiPHP_version' => ZHI_VERSION . ' RELEASE '. ZHI_RELEASE .' [<a href="http://www.ptent.net/" class="blue" target="_blank">&#26597;&#30475;&#26368;&#26032;&#29256;&#26412;</a>]',
            'server_domain' => $_SERVER['SERVER_NAME'] . ' [ ' . gethostbyname($_SERVER['SERVER_NAME']) . ' ]',
            'server_os' => PHP_OS,
            'web_server' => $_SERVER["SERVER_SOFTWARE"],
            'php_version' => PHP_VERSION,
            'mysql_version' => mysql_get_server_info(),
            'upload_max_filesize' => ini_get('upload_max_filesize'),
            'max_execution_time' => ini_get('max_execution_time') . '&#31186;',
            'safe_mode' => (boolean) ini_get('safe_mode') ?  L('yes') : L('no'),
            'zlib' => function_exists('gzclose') ?  L('yes') : L('no'),
            'curl' => function_exists("curl_getinfo") ? L('yes') : L('no'),
            'timezone' => function_exists("date_default_timezone_get") ? date_default_timezone_get() : L('no')
        );
        $this->assign('system_info', $system_info);
        $this->display();
    }
    public function login() {
        if (IS_POST) {            
            $username = $this->_post('username', 'trim');
            $password = $this->_post('password', 'trim');
            $verify_code = $this->_post('verify_code', 'trim');
            if(session('verify') != md5($verify_code)&&C('pin_captcha_status')){
                $this->error(L('verify_code_error'));
            }
            $admin = D('admin')->where(array('username'=>$username, 'status'=>1))->find();
            if (!$admin) {
                $this->error(L('admin_not_exist'));
            }
            if ($admin['password'] != md5($password)) {
                $this->error(L('password_error'));
            }
            $data=array(
                'id' => $admin['id'],
                'role_id'=>$admin['role_id'],
                'role_name' => D('admin_role')->where("id=$admin[role_id]")->getField("name"),
                'username' => $admin['username'],
                'token'=>md5($username.md5($password)),
            );
            cookie('admin',$data,array('expire'=>3600*24*10));
            session('admin', $data);
            D('admin')->where(array('id'=>$admin['id']))->save(array('last_time'=>time(), 'last_ip'=>get_client_ip()));
            $ret_url=$this->_request('ret_url','url_decode',U('index/index'));
            $ret_url_info=parse_url($ret_url);
            $this->success(L('login_success'),U('index/index')."#".urldecode($ret_url_info['fragment']));
        } else {
            $this->display();
        }
    }
    public function logout() {
        session('admin', null);
        cookie('admin',null);
        $this->success(L('logout_success'), U('index/login'));
        exit;
    }
    public function verify_code() {
        Image::buildImageVerify(4,1,'gif','50','24');
    }
    public function left() {
        $menuid = $this->_request('menuid', 'intval',0);
        if ($menuid) {
            $left_menu = $this->_mod->admin_menu($menuid);
            foreach ($left_menu as $key=>$val) {
                $left_menu[$key]['sub'] = $this->_mod->admin_menu($val['id']);
            }
        } else {
            $left_menu[0] = array('id'=>0,'name'=>L('common_menu'));
            $left_menu[0]['sub'] = array();
            if ($r = $this->_mod->where(array('often'=>1))->select()) {
                $left_menu[0]['sub'] = $r;
            }
            array_unshift($left_menu[0]['sub'], array('id'=>0,'name'=>'&#21518;&#21488;&#39318;&#39029;'));
        }
        $this->assign('topid', $menuid);
        $this->assign('left_menu', $left_menu);
        $this->display();
    }
    public function often() {
        if (isset($_POST['do'])) {
            $id_arr = isset($_POST['id']) && is_array($_POST['id']) ? $_POST['id'] : '';
            $this->_mod->where(array('ofen'=>1))->save(array('often'=>0));
            $id_str = implode(',', $id_arr);
            $this->_mod->where('id IN('.$id_str.')')->save(array('often'=>1));
            $this->success(L('operation_success'));
        } else {
            $r = $this->_mod->admin_menu(0);
            $list = array();
            foreach ($r as $v) {
                $v['sub'] = $this->_mod->admin_menu($v['id']);
                foreach ($v['sub'] as $key=>$sv) {
                    $v['sub'][$key]['sub'] = $this->_mod->admin_menu($sv['id']);
                }
                $list[] = $v;
            }
            $this->assign('list', $list);
            $this->display();
        }
    }
    public function map() {
        $r = $this->_mod->admin_menu(0);
        $list = array();
        foreach ($r as $v) {
            $v['sub'] = $this->_mod->admin_menu($v['id']);
            foreach ($v['sub'] as $key=>$sv) {
                $v['sub'][$key]['sub'] = $this->_mod->admin_menu($sv['id']);
            }
            $list[] = $v;
        }
        $this->assign('list', $list);
        $this->display();
    }
}
?>

接下来就是$_R=ereg_replace(‘__FILE__’,”‘”.$_F.”‘”,$_X); 将$_X中的字符串__FILE__替换为当前文件的路径,并用单引号引起来,因为原字符串并无可替换内容,所以代码内容没变化

然后eval($_R);将上述替换后的内容执行。

源代码部分就已经破解完了,接着到这个页面 http://tool.chinaz.com/tools/unicode.aspx 将被转码的Unicode还原为中文就可以了。

总结起来,就两部,第一步将eval后面的解码出来,第二步就是一步一步的顺序执行输出就行了。

$_X=base64_decode($_X);
$_X=strtr($_X,'123456aouie','aouie123456');
$_R=ereg_replace('__FILE__',"'".$_F."'",$_X);
echo $_R;
die;

就是这么简单。

多说一句,有些网站拿着别的的代码,加个自己的网址,真是呵呵了。。。

转载请注明:胡歌网摘 » eval(base64_decode的php加密文件解密方法

发表我的评论
取消评论
表情

Hi,您需要填写昵称和邮箱!

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址