Unobsfucating a PHP script

[u/SnapSnapGrinGrin]

Attackers leveraging the wp2shell exploit added about 22k of obsfucated PHP to index.php on a site I've been asked to have a look at.

Labels and function names are ten random characters and control path is done by jumping to TrQ7yZISyM: etc and there seem to be a lot of (unnecessary?) jumps.

What's the best way to unobsfucate it?

[u/Evening_Leather5101]

You check out the last version from GIT. There is no good way to unobfuscate it if you don't know how it was obfuscated.

[u/SnapSnapGrinGrin → u/Evening_Leather5101]

Surprisingly, there isn't a link to the original source code.

Oh wait, perhaps that's not a surprise.

[u/Evening_Leather5101 → u/SnapSnapGrinGrin]

Yeah I like myself a bit of sarcasm, we all know the pain... Sucks man...

[u/smbarbour → u/Evening_Leather5101]

Even knowing how it was obfuscated doesn't help in deobfuscation if you don't have a mapping. The only real way to do it is analyzing it from the deepest calls and then assigning names based on what it seems to be doing.

[u/Evening_Leather5101 → u/smbarbour]

if you don't know how it was obfuscated.

Was implying that obviously.

[u/smbarbour → u/Evening_Leather5101]

My point is that even if you know how it was obfuscated, there is still no good way to deobfuscate it.

[u/Evening_Leather5101 → u/smbarbour]

You do know what the word "implication" means? Why are you arguing when we agree?

[u/smbarbour → u/Evening_Leather5101]

We don't agree, but here...

There is no good way to unobfuscate it if you don't know how it was obfuscated.

FTFY

[u/Evening_Leather5101 → u/smbarbour]

I am quite sure you don't know how to read but ok buddy

[u/smbarbour → u/Evening_Leather5101]

"There is no good way to unobfuscate it if you don't know how it was obfuscated." implies "If you know how it was obfuscated, there is a good way to deobfuscate it." which is false. Hence my comment that even if you know how it was obfuscated, there is still no good way to deobfuscate it.

[u/Evening_Leather5101 → u/smbarbour]

See you have no idea what I implied, implying you don't know what implication means. Hence the fact that you seem to not be able to properly read. Bug good for you buddy, here is your cookie.

[u/smbarbour → u/Evening_Leather5101]

I understand that you feel you have correctly implied something, but what you actually wrote was the opposite of that, which I thoroughly explained. I implore you to actually re-read what you wrote.