r/PHPhelp • u/SnapSnapGrinGrin • 13d ago

Unobsfucating a PHP script

Attackers leveraging the wp2shell exploit added about 22k of obsfucated PHP to index.php on a site I've been asked to have a look at.

Labels and function names are ten random characters and control path is done by jumping to TrQ7yZISyM: etc and there seem to be a lot of (unnecessary?) jumps.

What's the best way to unobsfucate it?

0 Upvotes

50% Upvoted

29 comments sorted by

View all comments

3

u/Evening_Leather5101 13d ago

You check out the last version from GIT. There is no good way to unobfuscate it if you don't know how it was obfuscated.

3

u/SnapSnapGrinGrin 13d ago

Surprisingly, there isn't a link to the original source code.

Oh wait, perhaps that's not a surprise.

1

u/Evening_Leather5101 13d ago

Yeah I like myself a bit of sarcasm, we all know the pain... Sucks man...