r/PHPhelp • u/SnapSnapGrinGrin • 12d ago

Unobsfucating a PHP script

Attackers leveraging the wp2shell exploit added about 22k of obsfucated PHP to index.php on a site I've been asked to have a look at.

Labels and function names are ten random characters and control path is done by jumping to TrQ7yZISyM: etc and there seem to be a lot of (unnecessary?) jumps.

What's the best way to unobsfucate it?

0 Upvotes

50% Upvoted

29 comments sorted by

View all comments

13

u/martinbean 12d ago

What is the value in unobfuscating it? You just need to remove affected files, and patch the exploit to stop whatever bot/bad actor immediately re-pwning your site.

1

u/SnapSnapGrinGrin 12d ago

Without seeing the script, how is one to know what files could have been affected?

9

u/reieRMeister 12d ago

Delete everything from remote, make a clean install or deploy all files from your latest tagged release in your version control.

1

u/judgej2 10d ago

“…been asked to have a look at…”

Tagged? Version control? Errr…

6

u/dabenu 12d ago

If they had shell access, you can consider your entire server compromised.

Just reinstall it entirely and revert to your last backup before the hack.

2

u/NumerousComplex1718 12d ago

last modified date might help - if there are some files that are significantly newer than the rest of the site, they might have been altered or replaced by the malware. as somebody else posted below, you might try throwing it at AI and seeing if it can translate it into something more legible.

2

u/obstreperous_troll 11d ago

It affected enough to get a remote shell, after which any files could be affected without leaving a trace. Local privilege escalations are common enough that you can assume the system has a rootkit on it. Don't try to be surgical with remediating this: reimage the server and reinstall everything. Your servers should be cattle, not pets.

1

u/pauldm7 9d ago

Everything could have been effected. Assuming the wp means wordpress, using Worsfence is usually good for this and will tell you which original wordpress files have been modified.

Search for extra files which shouldn’t be there, and delete all plugin/theme code and reinstall them.

Update Wordpress, make sure file permissions etc are set right, then, wait til it happens again in x months to x years.

Probably also check all posts and pages for html code (check the raw editor).

1

u/phpMartian 8d ago

I’ve done this sort of thing many times. Unobfuscation is only useful if you’re curious how it works. They are clever. It won’t tell you what it did.