yanwen
V2EX  ›  问与答

帮我看看这段 PHP 代码是木马后门么?

  •  
  •   yanwen · Dec 30, 2017 · 3279 views
    This topic created in 3232 days ago, the information mentioned may be changed or developed.

    早上就收到阿里云的警告,说这个是木马....

    求帮忙看看..金币致谢 感谢了

    
    
    <?php
    
    include "./common.php";
    
    if (!isset($_GET['name'])) {
    	die("missing name");
    }
    
    // trigger auth
    $vcnt = xcache_count(XC_TYPE_VAR);
    xcache_admin_namespace();
    
    $name = $_GET['name'];
    if (!empty($config['enable_eval'])) {
    	eval('$name = ' . $name . ';');
    }
    
    if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    	if (!empty($config['enable_eval'])) {
    		eval('$value = ' . $_POST['value'] . ';');
    	}
    	else {
    		$value = $_POST['value'];
    	}
    	xcache_set($name, $value);
    	header("Location: ./?do=listvar");
    	exit;
    }
    $value = xcache_get($name);
    if (!empty($config['enable_eval'])) {
    	$value = var_export($value, true);
    	$editable = true;
    }
    else {
    	if (is_string($value)) {
    		$editable = true;
    	}
    	else {
    		$editable = false;
    		$value = var_export($value, true);
    	}
    }
    
    include "edit.tpl.php";
    
    
    
    
    7 replies  •  2017-12-30 13:28:35 +08:00
    mht
    mht
    Dec 30, 2017 via iPhone❤️1
    1
    往这个页面 post 东西就能执行代码了,你说呢?木马可能说不上,但是肯定是漏洞,eval 这种函数不应该用。
    Arnie97
    Arnie97
    Dec 30, 2017 via Android❤️1
    3
    木马不会这么大摇大摆的,估计作者水平不行…
    dangyuluo
    dangyuluo
    Dec 30, 2017❤️1
    4
    估计不是后门,是编写人员技术不行,居然光明正大 eval get 来的参数
    sdpfoue
    sdpfoue
    Dec 30, 2017❤️1
    5
    现在有些码畜真的要逆天 素质差的一比
    WordTian
    WordTian
    Dec 30, 2017 via iPhone❤️1
    6
    只能说开发人员没安全意识
    hcymk2
    hcymk2
    Dec 30, 2017❤️1
    7
    代码安全意识其实就和行人过马路是否看红绿灯一样。
    About   ·   Help   ·   Advertise   ·   Blog   ·   API   ·   FAQ   ·   Privacy   ·   Solana   ·   2513 Online   Highest 6679   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 38ms · UTC 14:45 · PVG 22:45 · LAX 06:45 · JFK 09:45
    ♥ Do have faith in what you're doing.