一些PHP管理系统程序中的后门_php技巧

 
 
目前流行的程序里,不止SABLOG一个,Discuz,DEDECMS都是有这样的后门的.这样的后门官方的真正用意很难说. 
为了让用户及时得到最新的补丁,最新的版本是一方面,其他的,随便人家怎么发挥了... 
但是这个东西有好的一面,也有坏的一面,一旦官方被黑,后果可想而知,所有的用户就被"批量挂马"了. 
现在干脆都给发出来吧.先来个DEDECMS的,标示出来的删掉就行: 
 代码如下:

/include/inc_functions.php 
function GetNewInfo(){ 
if(!isset($GLOBALS['__funAdmin'])) require_once(dirname(__FILE__)."/inc/inc_fun_funAdmin.php"); 
return SpGetNewInfo(); 
} 
/include/inc/inc_fun_funAdmin.php 
function SpGetNewInfo(){ 
global $cfg_version; 
$nurl = $_SERVER["HTTP_HOST"]; 
if( eregi("[a-z\-]{1,}\.[a-z]{2,}",$nurl) ){ $nurl = urlencode($nurl); } 
else{ $nurl = "test"; } 
$gs = ""; 
return $gs; 
} 
dede/index_body.php(其中dede为后台目录) 
 
 
DedeCms最新消息 
 



 
 
再把DZ的"后门"发出来吧.admin\global.func.php里面查找"function cpfooter",替换成如下的function: 
 代码如下:

function cpfooter() { 
global $version, $adminid, $db, $tablepre, $action, $bbname, $charset, $timestamp, $isfounder, $insenz; 
global $_COOKIE, $_SESSION, $_DCOOKIE, $_DCACHE, $_DSESSION, $_DCACHE, $_DPLUGIN, $sqldebug, $debuginfo; 
$infmessage = ''; 
?> 
 
 
 
 
 
updatesession(); 
} 
 
这个文件中还有一个function,没必要的,可以去掉: 
 代码如下:

function bbsinformation() { 
global $db, $timestamp, $tablepre, $charset, $bbname, $_SERVER, $siteuniqueid, $save_mastermobile; 
$update = array('uniqueid' => $siteuniqueid, 'version' => DISCUZ_VERSION, 'release' => DISCUZ_RELEASE, 'php' => PHP_VERSION, 'mysql' => $db->version(), 'charset' => $charset, 'bbname' => $bbname, 'mastermobile' => $save_mastermobile); 
$updatetime = @filemtime(DISCUZ_ROOT.'./forumdata/updatetime.lock'); 
if(emptyempty($updatetime) || ($timestamp - $updatetime > 3600 * 4)) { 
@touch(DISCUZ_ROOT.'./forumdata/updatetime.lock'); 
$update['members'] = $db->result_first("SELECT COUNT(*) FROM {$tablepre}members"); 
$update['threads'] = $db->result_first("SELECT COUNT(*) FROM {$tablepre}threads"); 
$update['posts'] = $db->result_first("SELECT COUNT(*) FROM {$tablepre}posts"); 
$query = $db->query("SELECT special, count(*) AS spcount FROM {$tablepre}threads GROUP BY special"); 
while($thread = $db->fetch_array($query)) { 
$thread['special'] = intval($thread['special']); 
$update['spt_'.$thread['special']] = $thread['spcount']; 
} 
} 
$data = ''; 
foreach($update as $key => $value) { 
$data .= $key.'='.rawurlencode($value).'&'; 
} 
return 'update='.rawurlencode(base64_encode($data)).'&md5hash='.substr(md5($_SERVER['HTTP_USER_AGENT'].implode('', $update).$timestamp), 8, 8).'×tamp='.$timestamp; 
} 
 
还有admin/home.inc.php,大概193~196行(DZ6.1.0 UTF-8官方原版),这里: 
 代码如下:

showtablerow('', array('class="vtop td24 lineheight"', 'class="lineheight smallfont"'), array( 
lang('home_discuz_version'), 
'Discuz! '.DISCUZ_VERSION.' Release '.DISCUZ_RELEASE.' '.lang('home_check_newversion').' ' 
)); 
 
虽然说这里没有直接与官方进行通信,但是,,,我看着不爽,想打补丁自己常去官方看就是了.还有所有文件名中包含insenz的文件,用不着的话就直接删除.没什么用.