PHP代码解密

Question

有如下被加密的代码，是wordpress模版footer.php中的内容
<?php
eval(gzinflate(base64_decode('NdJHjptQAADQ/Zwiu/GIhTEdJcoIMKaaauom4ptPMfWDDYbTJ5tc4el9//749T1W4wdcsvZQ7nVftNkTHkA2Q4b6k8P7kMPDp5Xr+jyOgiCc3SUrNLZ70e5lFJB+lJNKS0URpdbWZkrp6twmQQe9uCu77yxHOvfjc7bIykYdiRkQzX6Tcd69ExQ4OnXFW/WUF2k/vOORYDhzlenNm9ZOIE7wQoPEkK83jaGJwNHq9pQDytcyTF+a1SOBbMw34GgKsOw0fiB1fIuDE92rQc30WeExnbWeFTiGfIn7eM+rQd484uGF4OY3wGg8OST06RGE4VbHRL6bYbTQVDfG1txZuPPStXwbTHrwbsmD2UEiVXZsojmFFlrcwqWwtIzTwaCiahvOgr3SF1F5KDMDkDMN7zYBbhweU+IkvbUnhlzhfL6+Y/IiyFjAKnYiRdd8x30fd1QvMt5RrJhU0vhI/QfJJaf5PJsbNorqCkcONxiotSzBKQiZYwMXm83XsNxNQG8VP1C9ZXpPzPU9nlFDEfSYL/WBa1zoE+dTebY9bFw8QXa1WaPbKcivm85XdOAGTQ3zjB8GManstjAWnQj5q4KKW5/x4ail0hUkshp2WplonudKHU6m1kOZDOtkFn0jSwTNn5dJjAwhaFvDVFTyJpWv1V1X7ZnGXr1zE3PMwQJ5u8Aczr4Wn19fXz8/vv/H+/EX')));
?>
takashiro 我将代码拷贝到一个.php的文件中，上传到服务器，浏览该php文件，只输出了“?> <?php ”几个字符。
lishifan可否说详细点？我不懂。

Answer 1

<xmp>
第1次解密结果如下:(虚线为分隔符）
-------------------------
?>
<?php
eval(gzinflate(base64_decode('NdJJsppAAADQvafI7mu5QFpAqJ/EYhIZBBqZNylaGgQJ8yCePqu8M7zz783Pc/tsN3hOqm3+KeqsSka8RcmAGepPih9NirdfZnoxXp268LwE5yRrwmA21eF5bYKEMTI652UPIil1db4SIa+JvkwR3bEKsTbPIGbNOZXjqHpxBoPWchoHaJsG9+J7Nthb/V9g0S0n9HUdkjXouqeySkbKkREV2JrjUVVyiX2dzLVWv54mpXNsmN0PuJIdyoL5oRTYj6zbYChOXLqsZeNqvQfQ4+ZgXZoK4WhyoDAOw5FBGjGs6bqProxlYbQXV/Z21CxIt+qQADDMxX3FAE+U7GOYCWMdz0SS0PHRWKxWXGL4YkSqHNyl8Y1sDsLy+pBHwep80K6eIl728GqqLpkevO7dwVgzLb5yh9o4nNLRt+QSR96HVBbn+SCnUQKF518S4dayjO0B1e7wO7Kmz4e9wyJ9h5UQUkieda9ooBYhOlfKvJ2V9MGqfTna9VpIZCMbYEHVmIgYIRRQCm03ZNjGrKN1LfnkEC259DvrBWKAUllKLGH3TCguwQwwItZXRiz8r6/dbve9Of+P8OMf')));
?>
<?php
-----------------------------
解密方法为：
把开始部分的：“eval(”和 “);” 之间的内容COPY下来，
做成：
$a= gzinflate(base64_decode('NdJHjp ………… EX'));
printf("<xmp>\n第1次解密:\n%s\n</xmp>\n",$a);
这样就出结果了，下面的一样处理，到第5次就得到了HTML了
</xmp>
<xmp>
第2次解密结果如下:(虚线为分隔符）
-------------------------
?>
<?php
eval(gzinflate(base64_decode('NdFLkqIwAADQvafoXWvNIshHoWa6Lf5gAEUQbDdTKAlCQAJCVE4/q3lXeJvv2Z8NvdEZYlk9L6byjutsQPNL9kAr8W+Orm2O5p9BrnnX1n2qqhGyDLd91Y4WPJRU4laFZVK1gJpKH7uGqRPQfS0elER4OQg0jB8zEKP2si79dwyjoTJrU2bcMReKDuiB3N92iL0s36bJ/sydy+YH6OOeb+Cy8M3JOQ5pIsa22sviSye2eu4EVeQfBtnZv/aa5Z3LwOpCwZQk6C4jsTwoVLfvWXjHcEtBOqV2pyUGCF+QHNIT1d0UqxqQZJNOAlTsnL07dtVOEjeYUz1GwRhc1utD2iUVFaBMp86PU2IPqexYOuzz8SQidxXlBX4bEvKUioQJYb5gGjgpvGdc8IrjtPnyiD1oEL2wbltaCebbbW4G5Po1XpZ8RJqp1h9b5DT5xfrB/sQDjjD8/Pr6XCwWv2eb/ykf/wA=')));
?>
<?php
---------------------------
</xmp>
<xmp>
第3次解密结果如下:(虚线为分隔符）
-------------------------
?>
<?php
eval(gzinflate(base64_decode('NdBLcoIwAADQvaforjouFKRip506gFEpAgKBApsOmvAz/CMBTt9V3xHe/mv2ua/Teob7iMyTKStjElE8v0Ud3gq/CN8rhOevxFMGpVPZ0ZimY/CuP2mK1gMEzHUtWV4TGAr84xCkGAZq3A42sDkOG+PBFLZiNFqQ3E55KI1S4iR9pCGnaQnfKJp/WzWGqBVD/QxKkRWXpCIWfAB/58Epz3K9GdvyqvcBX50tEzluSNuNb77RWqVjp3K8pzqMTWkGtW8HFCKrduX4eI6SdgfyD5eL9jkQVkvM3EDfVgLwTg29HHod1UfLKDkCgFhJpj3EyImhDK0r7f1i2SkmzlCsJeHmdbFYfMz2/0kvfw==')));
?>
<?php
------------------------
</xmp>
<xmp>
第4次解密结果如下:(虚线为分隔符）
-------------------------
?>
<?php
eval(gzinflate(base64_decode('lVCxCsIwFNzzFY9Muthd0xTEwUUQBB0lTZ42kDYheTYIfrxRER11eNyDO467ayQTlbGjZAyAgSgvaKdSqrl2qCKXb/qN7KmxpuYn7wmLgolQTkEX8VTzjijMqyrnPMvY2oHQOdSUZtr3XO5tpItysI12VISwwzhiTKJSEm7wo8nykuyAKcEBW1j7RHY4/+ewUYM6o4EVGqtLDvMdpFQNn1lEE7oAORxfdSfTBTQPtvXm+sCOeidfKgZ3')));
?>
<?php
----------------------
</xmp>
<xmp>
第5次解密结果如下:(虚线为分隔符）终于看到HTML了
-------------------------
?>
</div>

<div class="clear"></div>

</div>

<div id="footer">
<p>
<a href="http://www.webintellects.com">Virtual Private Servers</a> | <a href="http://www.webintellects.com">Business Web Hosting</a> | <a href="http://www.webintellects.com">Managed Dedicated Servers</a>
</p>
</div>

<?php wp_footer(); ?>
</body>
</html>
<?php
---------------------------
</xmp>本回答被提问者采纳

Answer 2

我……上传到你的网站上运行。
<?php
echo(gzinflate(base64_decode('NdJHjptQAADQ/Zwiu/GIhTEdJcoIMKaaauom4ptPMfWDDYbTJ5tc4el9//749T1W4wdcsvZQ7nVftNkTHkA2Q4b6k8P7kMPDp5Xr+jyOgiCc3SUrNLZ70e5lFJB+lJNKS0URpdbWZkrp6twmQQe9uCu77yxHOvfjc7bIykYdiRkQzX6Tcd69ExQ4OnXFW/WUF2k/vOORYDhzlenNm9ZOIE7wQoPEkK83jaGJwNHq9pQDytcyTF+a1SOBbMw34GgKsOw0fiB1fIuDE92rQc30WeExnbWeFTiGfIn7eM+rQd484uGF4OY3wGg8OST06RGE4VbHRL6bYbTQVDfG1txZuPPStXwbTHrwbsmD2UEiVXZsojmFFlrcwqWwtIzTwaCiahvOgr3SF1F5KDMDkDMN7zYBbhweU+IkvbUnhlzhfL6+Y/IiyFjAKnYiRdd8x30fd1QvMt5RrJhU0vhI/QfJJaf5PJsbNorqCkcONxiotSzBKQiZYwMXm83XsNxNQG8VP1C9ZXpPzPU9nlFDEfSYL/WBa1zoE+dTebY9bFw8QXa1WaPbKcivm85XdOAGTQ3zjB8GManstjAWnQj5q4KKW5/x4ail0hUkshp2WplonudKHU6m1kOZDOtkFn0jSwTNn5dJjAwhaFvDVFTyJpWv1V1X7ZnGXr1zE3PMwQJ5u8Aczr4Wn19fXz8/vv/H+/EX')));
?>

Answer 3

?>
</div>

<div class="clear"></div>

</div>

<div id="footer">
<p>
<a href="http://www.webintellects.com">Virtual Private Servers</a> | <a href="http://www.webintellects.com">Business Web Hosting</a> | <a href="http://www.webintellects.com">Managed Dedicated Servers</a>
</p>
</div>

<?php wp_footer(); ?>
</body>
</html>
<?php