7

I found this backdoor on a client's website.

http://pastebin.com/wVs8w44v (original format)

http://pastebin.com/acfx49QJ (semi - readable)

I have gotten rid of it and realise it's an obfuscated script but how can I deobfuscate it in order to get to the root of this matter and understand the motive behind this attack better?

Thanks!

2
  • 1
    You're welcome (related to deleted question on IT security site). Please try and include the most important parts (or in this case a sample) of the code on any SE site. Jun 15, 2015 at 17:26
  • Jason Geffner , Sorry for the inconvenience, brother, I would like to be able to decipher the php obfuscator, github.com/mauro199304/PHP-ofuscato , I find it very difficult, please can you help me.
    – Elverdes
    Jun 7, 2021 at 19:21

1 Answer 1

17

I wrote a small Python script to deobfuscate the majority of the string obfuscation:

import urllib
import re

php = urllib.urlopen("http://pastebin.com/raw.php?i=wVs8w44v").read()

# Slight modification below so that we don't escape $
z26 = "jmiO@sxhFnD>J\r/u+RcHz3}g\nd{^8 ?eVwl_T\\\t|N5q)LobU]40!p%,rC-97k<'y=W:P$1BI&S6\"E(K`Y~.Q;f[v2a#X*ZAGtM"

# Decode all $z26[...] strings
for i in range(len(z26)):
    php = php.replace("$z26[" + str(i) + "]", "\"" + z26[i] + "\"")

# Concatenate decoded strings
php = php.replace("\".\"", "")

# Replace all $GLOBALS[...]
globals = {}
for m in re.finditer("\$GLOBALS\['(?P<key>\w+?)'\] = \"(?P<value>.*?)\";", php):
    globals[m.group("key")] = m.group("value")
php = re.sub(" \$GLOBALS\['(?P<key>\w+?)'\] = \"(?P<value>.*?)\";", "", php)
for key in globals.keys():
    php = php.replace("$GLOBALS['" + key + "']", globals[key])

print php

I then formatted the output with http://phpbeautifier.com/ and stored the results at http://pastebin.com/p7Tmvq4e.

The only major thing left to do is to rename the functions and arguments, but that can't be easily automated. I think the content at http://pastebin.com/p7Tmvq4e should meet your needs, though!

1
  • Really appreciate your effort into this trivial problem of mine. I would upvote you if I could. Jun 15, 2015 at 18:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.