7

I have a very messy PHP script of which I need to determine the function. I can't quite understand the code, it's really messy. Now I thought that I perhaps could reverse engineer this script.

What I want to do is to run this script (eventually with specific parts commented) to gain a better understanding of what part of the script does what. With that information, I should be able to get a full understanding of the script.

However, I do not want to change anything in the database on the server, I do not want that the script is going to mail things, etc. Basically, the script should be totally separated from the world, but I do want to see what it tries to do. So, for example, when the script runs a mail() function, I want to see that a mail would've been sent if the script wasn't separated from the world.

I therefore need a copy of the server installation (Ubuntu Server 12.04), which isn't that hard. The hard part is that I need to have a system which acts like it is the outside world, but actually is a logging system in which I can see what's happening.

Are there any tools that can do this? If not, how should I go in building it myself?

Improve this question
2

4 Answers 4

Reset to default
10

I would recommend using virtual machines to test your sample. If the sample is going to be interacting with other machines (for example, if it sends mail but the mail server is located at mail.example.com) then you will probably want to emulate a two machine setup. If everything is already configured on the machine where your sample will be running (so mail calls are made locally) then you will probably only need one virtual machine.

Set up a Virtual Machine Host Only Network

You can use VMWare if you have it or you can use the VirtualBox, which is free. If you use a host only network (VMWare or VirtualBox instructions) then you can sniff the network traffic of the VMs from within your host, but the traffic will never leave your host.

Before running the sample

If you suspect this php script will change the state of your virtual machine (for example it will drop databases or overwrite files) then I suggest you take a snapshot. This way you can always revert any changes that are made when the script runs. VMWare or VirtualBox instructions.

Running the Sample

Once the virtual network is built, you can run your sample while capturing traffic with a tool like wireshark. This will capture all the network traffic

Getting outside feedback

As you described it, your sample probably won't need to communicate with fake services, but if it does, here are a few applications you can look into.

  • Windows
    • FakeNet as mentioned by Mick, this is a good solution if you are running on windows XP SP3.
  • Linux
    • inetsim - This will simulate responses for application level protocols such as HTTP, TCP or SMTP. It can also reply to DNS requests.
    • honeyd - This is ligheter than inetsim but will also simulate responses for application level protocols such as HTTP, TCP or SMTP. It can also reply to DNS requests.
    • farpd - This utility is very useful if you don't know the IP address that will be request. This application can be used to redirect IP traffic to your virtual machine.
Improve this answer
5

You may be able to use the open-source FakeNet to simulate a real network.

However, FakeNet is designed to be run on an XP SP3 system, so using it would require you to ensure traffic is routed from your Ubuntu system/VM to an XP sp3 system/VM.

There are likely some Linux based FakeNet alternatives out there, but I've used FakeNet before when analyzing Windows malware and it works very well.

Features

  • Supports DNS, HTTP, and SSL
  • HTTP server always serves a file and tries to serve a meaningful file; if the malware request a .jpg then a properly formatted .jpg is served, etc. The files being served are user configurable.
  • Ability to redirect all traffic to the localhost, including traffic destined for a hard-coded IP address.
  • Python extensions, including a sample extension that implements SMTP and SMTP over SSL.
  • Built in ability to create a capture file (.pcap) for packets on localhost.
  • Dummy listener that will listen for traffic on any port, auto-detect and decrypt SSL traffic and display the content to the console.
Improve this answer
5

A more general solution is to use something like runkit, a PHP extension to intercept arbitrary function calls. Rather than trying to simulate a network (the safer option for your situation), if you instead knew the complete set of functions that you wanted to prevent from being called, you could simply runkit_function_redefine each to log a message instead.

Improve this answer
1
  • 1
    The downside to this kind of approach is you have to predefine what you want to catch where you may not know beforehand.
    – amccormack
    Mar 28, 2013 at 15:17
3

Since you already have the source file, I believe that there is a simpler and easier approach (as compared to rerouting network traffic on low levels would be to intercept the methods being called.)

Firstly, identify and replace methods in your php file (remember to make a copy!). For example, if you want to intercept mail(), you can find mail( and replace it with shim_mail(. You can also do so for other interesting methods such as mysql_connect().

Once you finish, add include 'shim.php'; at the top of your file. The "shim" will act as a layer between the php script and the actual method, so you can choose to log it to a text file, allow it to execute, or even point it to a replica database!

shim.php 

$logfile = 'log.txt';

function shim_mysql_connect($server, $username, $password, $new_link = false, $client_flags = 0)
{
    file_put_contents($logfile, file_get_contents($logfile) . "\r\nmysql_connect() to " . $server . " with username " . $username . " and password " . $password);

    // intercept the command and point it to the 'honeypot'
    return mysql_connect('your_new_server', 'username', 'password');
}

function shim_mail($to, $subject, $message, $additional_headers = '', $additional_parameters = '')
{
    file_put_contents($logfile, file_get_contents($logfile) . "\r\nmail() to " . $to . " with subject " . $subject . " and message " . $message);

    // don't actually send an email
}

?>

In this shim file, you can add functions that you are interested to find out about (simply by copying the same method signature as the original file and printing relevant logs). By observing the log, you can probably find out a lot more about the php script!

(while I was midway composing this, I realized that Daniel W. Steinbrook has also come up with a similar method. My method has a slight advantage that it is simpler without adding new dependencies, but runkit sounds like a more correct way. Either way, you can simply pick one that works!)

Improve this answer
2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.