卓越飞翔博客卓越飞翔博客

卓越飞翔 - 您值得收藏的技术分享站
技术文章1842本站已运行41113

火车头采集器新插件--eval解密插件

大家可以测试采集奇漫屋动漫之家
加密1

加密2

分页或多页运用插件后

使用方法:
第1种,上传api.php到网站的根目录,之后分页或多页运用插件后http://你的网址/api.php?url=eval加密的网址
第2种方法自己研究吧。
<?php 
//本插件由“呱呱生”和某位大牛联合制作,请不要去除此版权。谢谢!
//呱呱生
//请到吾爱破解关注我哦!
?>
<?php
$url = $_GET["url"];

$fh= file_get_contents($url);  
echo $fh;  
?>
<?php

class JavaScriptUnpacker
{
    private $unbaser;
    private $payload;
    private $symtab;
    private $radix;
    private $count;

    function Detect($source)
    {
        $source = preg_replace("/ /","",$source);
        preg_match("/eval\(function\(p,a,c,k,e,[r|d]?/", $source, $res);

        Debug::Write($res,"detection result");

        return (count($res) > 0);
    }

    function Unpack($source)
    {
        preg_match_all("/}\('(.*)', *(\d+), *(\d+), *'(.*?)'\.split\('\|'\)/",$source,$out);

        Debug::Write($out,"DOTALL", false);

        // 有效载荷
        $this->payload = $out[1][0];
        Debug::Write($this->payload,"payload");
        // 字
        $this->symtab = preg_split("/\|/",$out[4][0]); 
        Debug::Write($this->symtab,"symtab");
        // 基数
        $this->radix = (int)$out[2][0];
        Debug::Write($this->radix,"radix");
        // 字数
        $this->count = (int)$out[3][0];
        Debug::Write($this->count,"count");

        if( $this->count != count($this->symtab)) return; // 格式错误的 p.a.c.k.e.r 符号表!

        //待办事项:尝试捕捉
        $this->unbaser = new Unbaser($this->radix);

        $result = preg_replace_callback(
                    '/\b\w+\b/',
                        array($this, 'Lookup')
                    ,
                    $this->payload
                );
        $result = str_replace('\\', '', $result);
        Debug::Write($result);
        $this->ReplaceStrings($result);
        return $result;
    }

    function Lookup($matches)
    {
        $word = $matches[0];
        $ub = $this->symtab[$this->unbaser->Unbase($word)];
        $ret = !empty($ub) ? $ub : $word;
        return $ret;
    }

    function ReplaceStrings($source)
    {
        preg_match_all("/var *(_\w+)\=\[\"(.*?)\"\];/",$source,$out);
        Debug::Write($out);
    }

}

class Unbaser
{
    private $base;
    private $dict;
    private $selector = 52;
    private $ALPHABET = array(
        52 => '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOP',
        54 => '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQR',
        62 => '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ',
        95 => ' !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~'
    );


    function __construct($base)
    {
        $this->base = $base;

        if($this->base > 62) $this->selector = 95;
        else if($this->base > 54) $this->selector = 62;
        else if($this->base > 52) $this->selector = 54;
    }

    function Unbase($val)
    {
        if( 2 <= $this->base && $this->base <= 36)
        {
            return intval($val,$this->base);
        }else{
            if(!isset($this->dict)){

                $this->dict = array_flip(str_split($this->ALPHABET[$this->selector]));
            }
            $ret = 0;
            $valArray = array_reverse(str_split($val));

            for($i = 0; $i < count($valArray) ; $i++)
            {
                $cipher = $valArray[$i];
                $ret += pow($this->base, $i) * $this->dict[$cipher];
            }
            return $ret;
            // 非基础扩展($x, $base)
        }
    }

}


class Debug
{
    public static $debug = false;
    public static function Write($data, $header = "", $mDebug = true)
    {
        if(!self::$debug || !$mDebug) return;

        if(!empty($header))
            echo "<h4>".$header."</h4>";

        echo "<pre>";
        print_r($data);
        echo "</pre>";
    }

}


// 遵循所有重定向:
// 这会发出多个请求,跟随每个重定向直到到达
// 最终目的地。
function get_redirect_final_target($url)
{
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_NOBODY, 1);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); // 跟随重定向
    curl_setopt($ch, CURLOPT_AUTOREFERER, 1); // 在重定向时设置引用
    curl_exec($ch);
    $target = curl_getinfo($ch, CURLINFO_EFFECTIVE_URL);
    curl_close($ch);

    if ($target)
        return $target;

    return false;
}
function getURL($u){
    $ops = array(
      'http'=>array(
        'method'=>"GET",
        'header'=>"Accept: text/html\r\n" .
                  "User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\r\n"
      )
    );
    $co = stream_context_create($ops);
    $r = file_get_contents('http://' . $u, false, $co);
    return $r != false ? $r : "";

}
function GetStringBetween($string, $start, $finish){
    $string = " ".$string;
    $position = strpos($string, $start);
    if ($position == 0) return "";
    $position += strlen($start);
    $length = strpos($string, $finish, $position) - $position;
    return substr($string, $position, $length);
}

$grab = file_get_contents($url); 
$streama = GetStringBetween($grab, 'var', '</script>');
$unpacker = new JavaScriptUnpacker();
$unpacked = $unpacker->Unpack($grab);
preg_match_all('/\b(?:(?:https?|ftp|file):\/\/|www\.|ftp\.)[-A-Z0-9+&@#\/%=~_|$?!:,.]*[A-Z0-9+&@#\/%=~_|$]/i', $unpacked, $result, PREG_PATTERN_ORDER);
$result = $result[0];
$stream = GetStringBetween($unpacked, "src:'", "'");
?>
<?= trim($unpacked, "\r\n\t ")?>
 
卓越飞翔博客
上一篇: 火车头采集器新插件--Base64解密插件 图片附件
下一篇: 返回列表
留言与评论(共有 0 条评论)
   
验证码:
隐藏边栏