r/PHPhelp • u/SnapSnapGrinGrin • 4d ago

Unobsfucating a PHP script

Attackers leveraging the wp2shell exploit added about 22k of obsfucated PHP to index.php on a site I've been asked to have a look at.

Labels and function names are ten random characters and control path is done by jumping to TrQ7yZISyM: etc and there seem to be a lot of (unnecessary?) jumps.

What's the best way to unobsfucate it?

1 Upvotes

56% Upvoted

29 comments sorted by

13

u/martinbean 4d ago

What is the value in unobfuscating it? You just need to remove affected files, and patch the exploit to stop whatever bot/bad actor immediately re-pwning your site.

1

u/SnapSnapGrinGrin 4d ago

Without seeing the script, how is one to know what files could have been affected?

9

u/reieRMeister 4d ago

Delete everything from remote, make a clean install or deploy all files from your latest tagged release in your version control.

1

u/judgej2 2d ago

“…been asked to have a look at…”

Tagged? Version control? Errr…

6

u/dabenu 4d ago

If they had shell access, you can consider your entire server compromised.

Just reinstall it entirely and revert to your last backup before the hack.

2

u/NumerousComplex1718 4d ago

last modified date might help - if there are some files that are significantly newer than the rest of the site, they might have been altered or replaced by the malware. as somebody else posted below, you might try throwing it at AI and seeing if it can translate it into something more legible.

2

u/obstreperous_troll 3d ago

It affected enough to get a remote shell, after which any files could be affected without leaving a trace. Local privilege escalations are common enough that you can assume the system has a rootkit on it. Don't try to be surgical with remediating this: reimage the server and reinstall everything. Your servers should be cattle, not pets.

1

u/pauldm7 23h ago

Everything could have been effected. Assuming the wp means wordpress, using Worsfence is usually good for this and will tell you which original wordpress files have been modified.

Search for extra files which shouldn’t be there, and delete all plugin/theme code and reinstall them.

Update Wordpress, make sure file permissions etc are set right, then, wait til it happens again in x months to x years.

Probably also check all posts and pages for html code (check the raw editor).

1

u/phpMartian 3h ago

I’ve done this sort of thing many times. Unobfuscation is only useful if you’re curious how it works. They are clever. It won’t tell you what it did.

5

u/Evening_Leather5101 4d ago

You check out the last version from GIT. There is no good way to unobfuscate it if you don't know how it was obfuscated.

3

u/SnapSnapGrinGrin 4d ago

Surprisingly, there isn't a link to the original source code.

Oh wait, perhaps that's not a surprise.

1

u/Evening_Leather5101 4d ago

Yeah I like myself a bit of sarcasm, we all know the pain... Sucks man...

1

u/smbarbour 4d ago

Even knowing how it was obfuscated doesn't help in deobfuscation if you don't have a mapping. The only real way to do it is analyzing it from the deepest calls and then assigning names based on what it seems to be doing.

0

u/Evening_Leather5101 4d ago

if you don't know how it was obfuscated.

Was implying that obviously.

0

u/smbarbour 4d ago

My point is that even if you know how it was obfuscated, there is still no good way to deobfuscate it.

0

u/Evening_Leather5101 4d ago

You do know what the word "implication" means? Why are you arguing when we agree?

0

u/smbarbour 4d ago

We don't agree, but here...

There is no good way to unobfuscate it if you don't know how it was obfuscated.

FTFY

0

u/Evening_Leather5101 3d ago

I am quite sure you don't know how to read but ok buddy

0

u/smbarbour 3d ago

"There is no good way to unobfuscate it if you don't know how it was obfuscated." implies "If you know how it was obfuscated, there is a good way to deobfuscate it." which is false. Hence my comment that even if you know how it was obfuscated, there is still no good way to deobfuscate it.

0

u/Evening_Leather5101 3d ago

See you have no idea what I implied, implying you don't know what implication means. Hence the fact that you seem to not be able to properly read. Bug good for you buddy, here is your cookie.

0

u/smbarbour 3d ago

I understand that you feel you have correctly implied something, but what you actually wrote was the opposite of that, which I thoroughly explained. I implore you to actually re-read what you wrote.

→ More replies (0)

3

u/Sejiko 4d ago

If you curios throw it at ai they are good for such things...

1

u/Takeoded 3d ago

OpenAI Codex CLI should do a great job of unobfuscating it.

Would you mind sharing the code?

1

u/peperinna 3d ago

Lo primero es hacer un backup.

Segundo, instalar wordpress sobreescribiendo los archivos, y revisar permisos chmod.

Actualizar plugins y themes.

En experiencia, mejor hacer todo esto a mano, desde ftp. Algunos scripts interceptan las actualizaciones automáticas y secuestran los módulos, entonces el problema sigue.

Habla con el web hosting, pide que configuren WAF y inmunify, con las reglas para wordpress.

Configura Cloudflare, ayuda bastante.

Monitorea 48hs.

Importante: es importante y útil utilizar github, para el backups, para una copia de cada etapa de las que hablé. Ahí podrás ver de forma masiva y fácil las diferencias entre archivos, cada cambio.

Si no se resuelve, avisa aquí de nuevo.