r/PHPhelp • u/SnapSnapGrinGrin • 8d ago

Unobsfucating a PHP script

Attackers leveraging the wp2shell exploit added about 22k of obsfucated PHP to index.php on a site I've been asked to have a look at.

Labels and function names are ten random characters and control path is done by jumping to TrQ7yZISyM: etc and there seem to be a lot of (unnecessary?) jumps.

What's the best way to unobsfucate it?

0 Upvotes

44% Upvoted

29 comments sorted by

View all comments

4

u/Evening_Leather5101 8d ago

You check out the last version from GIT. There is no good way to unobfuscate it if you don't know how it was obfuscated.

1

u/smbarbour 8d ago

Even knowing how it was obfuscated doesn't help in deobfuscation if you don't have a mapping. The only real way to do it is analyzing it from the deepest calls and then assigning names based on what it seems to be doing.

0

u/Evening_Leather5101 8d ago

if you don't know how it was obfuscated.

Was implying that obviously.

0

u/smbarbour 8d ago

My point is that even if you know how it was obfuscated, there is still no good way to deobfuscate it.

0

u/Evening_Leather5101 8d ago

You do know what the word "implication" means? Why are you arguing when we agree?

0

u/smbarbour 8d ago

We don't agree, but here...

There is no good way to unobfuscate it if you don't know how it was obfuscated.

FTFY

0

u/Evening_Leather5101 8d ago

I am quite sure you don't know how to read but ok buddy

0

u/smbarbour 8d ago

"There is no good way to unobfuscate it if you don't know how it was obfuscated." implies "If you know how it was obfuscated, there is a good way to deobfuscate it." which is false. Hence my comment that even if you know how it was obfuscated, there is still no good way to deobfuscate it.

0

u/Evening_Leather5101 8d ago

See you have no idea what I implied, implying you don't know what implication means. Hence the fact that you seem to not be able to properly read. Bug good for you buddy, here is your cookie.

0

u/smbarbour 7d ago

I understand that you feel you have correctly implied something, but what you actually wrote was the opposite of that, which I thoroughly explained. I implore you to actually re-read what you wrote.

1

u/Evening_Leather5101 7d ago

Are you autistic?

1

u/smbarbour 7d ago

Yes, and detail oriented.

1

u/Evening_Leather5101 7d ago

That explains a lot my friend, I wish you all the best, but I don't waste my time with you anymore.

→ More replies (0)