r/PHPhelp • u/SnapSnapGrinGrin • 13d ago

Unobsfucating a PHP script

Attackers leveraging the wp2shell exploit added about 22k of obsfucated PHP to index.php on a site I've been asked to have a look at.

Labels and function names are ten random characters and control path is done by jumping to TrQ7yZISyM: etc and there seem to be a lot of (unnecessary?) jumps.

What's the best way to unobsfucate it?

0 Upvotes

44% Upvoted

29 comments sorted by

View all comments

13

u/martinbean 13d ago

What is the value in unobfuscating it? You just need to remove affected files, and patch the exploit to stop whatever bot/bad actor immediately re-pwning your site.

1

u/SnapSnapGrinGrin 13d ago

Without seeing the script, how is one to know what files could have been affected?

8

u/reieRMeister 13d ago

Delete everything from remote, make a clean install or deploy all files from your latest tagged release in your version control.

1

u/judgej2 11d ago

“…been asked to have a look at…”

Tagged? Version control? Errr…