Why is all this code inside PHP files? What do you mean

Source: Internet
Author: User
Why is all this code in the PHP file? What do you mean?

$O 00oo0=urldecode ("%6e1%7a%62%2f%6d%615%5c%76%740%6928%2d%70%78%75%71%79%2a6%6c%72%6b%64%679%5f%65%68%63%73%77 %6f4%2b%6637%6a "); $O 00o0o= $O 00oo0{3}. $O 00oo0{6}. $O 00oo0{33}. $O 00oo0{30}; $O 0oo00= $O 00oo0{33}. $O 00oo0{10}.$ O00OO0{24}. $O 00oo0{10}. $O 00oo0{24}; $OO 0o00= $O 0oo00{0}. $O 00oo0{18}. $O 00oo0{3}. $O 0oo00{0}. $O 0oo00{1}. $O 00oo0{24} ; $OO 0000= $O 00oo0{7}. $O 00oo0{13}; $O 00o0o.= $O 00oo0{22}. $O 00oo0{36}. $O 00oo0{29}. $O 00oo0{26}. $O 00oo0{30}. $O 00oo0{ $O 00oo0{35}. $O 00oo0{26}. $O 00oo0{30};eval ($O 00o0o (" Je8wtzawmd0iem5krkhjzndlbwp1tvrob3bqylzewvn0whnluk9xwlvbr3zhcuxjeujprwdrq3hktmxrclfgsvbaa3n5rvzhdfd1clrmt1liz2p6cgjhafvtq Kn4rg5ksmzts3dpy1jnb3f2be5lwefpzzl5slpetutwshzjqmv3q3pny2oyoxrzyzv5slpey0v1yu1nb0xkamu5uuluuhdjcu1mbxkwrusysfflmmvkwwu5uu Luuhdjcu1mbxkwrwxaswvqztkwsmjvyunioudkbkhhslewy0sysgfdqk4wa1pjzwplotbkylvhq3p2m0ncbhnjbmuwww5ic1d6djndqmxzsjjinukyoxddwld Hstjiy2iyvwvlmk53smjpmepcoxrrbkn3wtiwtukysgnimmv0q1y5c1lcuhrqqklla0dhtnfjvxdlmtkzq0jsc0luztbzbkhzajjyzwoyytlzymvrs0j2c0ti Sgvlrlhnrxfvm0ncbhnjbmuwww5Ic2oycmvqmmfmbve4k2dvvdhrefvpbzfvq3hsee16ufvodxfpb0h4bfd6efdna2mwzfmxs1fvdzhkvvbvumtscnh1ehlntne0evd6axhlvlb0szjlmepcoxrq Qnlkuzbibwtnmevrvniwsvpenln3otnjm0t0svfxdfkzbeztmvv6uzjymflcetbtmnzkwtnozvnwvtbdcwsrz29uoepavxbzzzrocud2vencufhpttbft24xz Uluuk1kwluws3exzutisexjrzbjbzi5delushrjctf4agjpzwtjaudzmjuwq0i1me96bdbdyniwuzjymflcetdrbk5uamjsuunibzldmmt3v1fsd2thne5xr3 Kvs25yewtuzvzrcu1ys0zoc0kysgnim1vmsw52zu9cmtvlm1bhyjjdzulutlrimjljslzir0lxrfrswmxryjnjzwplotbkylvhq0g5r0pusedkd1hma1phtu9 Rne5xr3zwq2jvcmtutmrzrlvlwuzvowthes9pelv3sze5m0ncbhnjbmuwww54ce9gswvqztlbq2jlm1kzbfhlutgra2npdgpcmwvpemxtq2jlm1kzbfhld2tn U1e0tnfhdnbdylvya25ozflgvwvzrm85a0d5l096vxdlmtkzq0jsc0luztbzbnhwt0zjzwplovhdyk5hs1zleuluzwrzrzgra2npdgpcmwvpemxsq2jor0twz Xljbmvkwwnrze9nmevpwlvmsw52zu9hes9pelv3sze5m0ncbhnjbmuwww54ce9gswvqztkwsmjvyun1octunk04t1ewwetgtnnjmkhjyjnvteludmvtdtuzq0 Jsc0luztbzbkhzv3u4k1q2wdhtm1vmsw52zu9nmevpzzl5slpetxn6awvzwk5la1phtu9rne5xr3ywsmjvyun1njgwqtnxmvn1cty2bwfktku5uvczndftdxe 2nm1hze5fovfxmzqxwtd4cfdtqvq2cm96uhevzkfoy1q2wdhtm1vmsw52zu9hes9lbnj5a1owtu9rne5xr3zhski1qwtucnddqmo5a1zouut3oudlm1d0ajnouwtjaxddqnk5a0zomghcdmvlmnjlq2jv Y2tavtvlbng5a0zvzwhab2rqm05ra0c0tnfhdlfqm2xms1pvtvluuhrdm0hyqzj4owtwthjjvlbrajnstetab2npvkmxwvzomepcoxrrwmxlq0zszusycnnqm Jlyq3pntgtayu1zbjlgski1c0nwoxdzejvmwujjr1kyvwvtrk53al ....

I downloaded a network of online source code, all the PHP files inside are such things, what does that mean ah?

Share to: more


------Solution--------------------
This website code does the scrambling code processing, does not affect the normal use
Just need to open PHP's short mark function
------Solution--------------------
Short open tag to pick up the points
------Solution--------------------
Open the short label will be able to execute, the source code encode, you can understand under the decode
------Solution--------------------
You put the code all on, I'll tell you how to solve it.
------Solution--------------------
First of all, you need to understand PHP

Then, start the solution
You have to understand the meaning of this code:


$O 00oo0=urldecode ("%6e1%7a%62%2f%6d%615%5c%76%740%6928%2d%70%78%75%71%79%2a6%6c%72%6b%64%679%5f%65%68%63%73%77 %6f4%2b%6637%6a ");
$O 00o0o= $O 00oo0{3}. $O 00oo0{6}. $O 00oo0{33}. $O 00oo0{30};
$O 0oo00= $O 00oo0{33}. $O 00oo0{10}. $O 00oo0{24}. $O 00oo0{10}. $O 00oo0{24};
$OO 0o00= $O 0oo00{0}. $O 00oo0{18}. $O 00oo0{3}. $O 0oo00{0}. $O 0oo00{1}. $O 00oo0{24};
$OO 0000= $O 00oo0{7}. $O 00oo0{13}; $O 00o0o.= $O 00oo0{22}. $O 00oo0{36}. $O 00oo0{29}. $O 00oo0{26}. $O 00oo0{30}. $O 00oo0{32 }. $O 00oo0{35}. $O 00oo0{26}. $O 00oo0{30};

Print_r ($GLOBALS);


The result of this output is:

/*
......
[O00oo0] = n1zb/ma5\vt0i28-pxuqy*6lrkdg9_ehcswo4+f37j
[o00o0o] = Base64_decode
[O0oo00] = Strtr
[Oo0o00] = substr
[OO0000] = 52
*/



Next to the Eval section, the eval ($O 00o0o is changed to: Die (Base64_decode

Then run this file: See what's out there ...

And then output a bunch of things similar to the source file, but the useful code at the end, the final code is the Eval section,

That is true:



Eval ('?> '. $O 00o0o ($O 0oo00 ($OO 0o00 ($O 0o000, $OO 0000*2), $OO 0o00 ($O 0o000, $OO 0000, $OO 0000), $OO 0o00 ($O 0o000,0,$ OO0000)));


Here the variable is replaced with a function:
Note: Remove the previous: eval ('?> '.

Base64_decode (Strtr (substr ($O 0o000,52*2), substr ($O 0o000,52,52), substr ($O 0o000,0,52)))

Then you see the source .....


So the method is to change the eval to die.,... The continuous operation can be solved ...


  • Contact Us

    The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

    If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

    A Free Trial That Lets You Build Big!

    Start building with 50+ products and up to 12 months usage for Elastic Compute Service

    • Sales Support

      1 on 1 presale consultation

    • After-Sales Support

      24/7 Technical Support 6 Free Tickets per Quarter Faster Response

    • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.