Talking about "back door" in PHP

Intermediary transaction http://www.aliyun.com/zixun/aggregation/6858.html ">seo diagnose Taobao guest cloud host technology Hall

Modifications should be cautious and you will not receive any updated information from the official after the modification!

Today, I went to the red Wolf to look at the question I asked yesterday, no one can answer. Received the message from the administrator, should be mass, sablog again out of the loophole. To the official look, or the code, with DZ similar loopholes.

Login Blog Backstage, sure enough pop-up prompt box. I don't care about the tip box, sablog How to know that my version of a loophole, the program must have a backdoor. Automatically detects the official version of the background every time the login is in contrast to the current version The last part of the main.php. Delete the following code OK.

In fact, this is not enough to cause the black, now generally a little common sense, passwords are more complex, a few numbers + letters, MD5 words generally difficult to run out. Of course, there are rainbow tables, and say ...

<script type= "Text/javascript" >

i=1;&nbsp;&nbsp; Var&nbsp;autourl=new&nbsp;array ();&nbsp;&nbsp; autourl[1]&nbsp;=&nbsp; ' www.sablog.net ';&nbsp; &nbsp; autourl[2]&nbsp;=&nbsp; ' cnc.sablog.net ';&nbsp;&nbsp; function&nbsp;auto (URL) {&nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;if (i) {&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;i=0;&nbsp;&nbsp; &nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;var&nbsp;ohead&nbsp;=&nbsp;document.getelementsbytagname (' head '). Item (0); &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;var&nbsp;oScript=&nbsp; Document.createelement ("script");&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; oscript.type&nbsp;=&nbsp; "Text/javascript";&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; oscript.src&nbsp;=&nbsp; "http://" +url+ "/update.php?version= $now _version&amp;release= $now _release&amp;hostname= $now _hostname ";&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ohead.appendchild (OScript); &nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp; function&nbsp;run () {&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;for (var&nbsp;i=1;i&lt; autourl.length;i++) &nbsp;{&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;document.write ("&lt;img &nbsp;src=http://"+autourl[i]+" &nbsp;width=1&nbsp;height=1&nbsp;onerror=auto (' +autourl[i]+ ') &gt; ");&nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;}&nbsp;&nbsp; Run ();&nbsp;&nbsp; &lt;/script&gt;&nbsp;&nbsp;

The current popular procedure, more than sablog one, discuz,dedecms have such a backdoor. Such a backdoor official's real intentions are hard to say. In order to allow users to get the latest patches in time, the latest version is on the one hand, others, how to play ... But this thing has the good side, also has the bad side, once the official is black, the consequence can imagine, all users are "the batch hangs the horse". Now give it all up. First a dedecms, marked out on the line:/include/inc_functions.php

PHP code

function Getnewinfo () {if (!isset ($GLOBALS [' __funadmin ']) require_once (dirname (__file__). "     /inc/inc_fun_funadmin.php ");   return Spgetnewinfo (); }  

/include/inc/inc_fun_funadmin.php

PHP code

function Spgetnewinfo () {global $cfg _version;       $nurl = $_server["Http_host"]; if (Eregi ("[a-z\-]{1,}\.[       A-z]{2,} ", $nurl)) {$nurl = UrlEncode ($nurl);}       else{$nurl = "Test";} $gs = "&lt;iframe name= ' stafrm ' src= ' http://www.dedecms.com/newinfo.php?version=". UrlEncode ($cfg _version).       &amp;formurl= $nurl ' frameborder= ' 0 ' id= ' stafrm ' width= ' 100% ' height= ' ' &gt;&lt;/iframe&gt; ';   return $gs; }  

Dede/index_body.php (where Dede is the background directory)

PHP code

&lt;div class= "Bodytitle" &gt; &lt;div class= "bodytitleleft" &gt;&lt;/div&gt; &lt;div class= "Bodytitletxt" &gt;de DECMS Latest News &lt;/div&gt; &lt;/div&gt; &lt;table width= "96%" border= "0" align= "center" cellpadding= "0" cellspacing= "0"       ; &lt;tr&gt;&lt;form name= "Uploadspider" action= "upload_spider.php" method= "POST" &gt; &lt;td height= "class=" Ma   In_dnews "&gt; &lt;?php echo getnewinfo ()?&gt; &lt;/td&gt; &lt;/form&gt; &lt;/tr&gt; &lt;/table&gt;

Again, DZ's "back door" sent out. admin\global.func.php inside look for "function Cpfooter", replaced with the following function: This site: Linyi computer network welcome similar sites link JavaScript code