1

I found a number of PHP scripts on a friends webserver which had been loaded by hackers. The actual code was hidden using several layers of encryption as follows. They had a huge string assigned to a variable $str. Then they used the following line to decrypt the string and run the code eval(gzinflate(str_rot13(base64_decode($str))));

They can't run the code because there's a .htaccess file preventing the execution of scripts from that folder, this is a temporary fix.

However, I am curious as to the decrypted contents of the script. I'd like to see what it is doing as this may give clues as to the vulnerabilities which may exist on the system. How can I do so safely without exposing the system to the intended attack?

Could I safely put this on a linux vm running on a pc while altering the statement above to echo(gzinflate(str_rot13(base64_decode($str))));?

5
  • 2
    Anyone else interested in seeing the results posted once OP decodes? I know I am. Curious what $str is being set to.
    – Chris
    Jul 5, 2011 at 14:19
  • Thinking security.stackexchange.com would be interested as well. You could migrate this over there, especially if you have follow up questions based on the contents...
    – Rory Alsop
    Jul 5, 2011 at 14:25
  • Heh, rot13. Sneaky..? Jul 5, 2011 at 14:25
  • Maybe we could migrate this question to a more appropriate site? Jul 5, 2011 at 15:55
  • For those interested, the content of the unencrypted script is on pastebin pastebin.com/u7kY9ren Jul 5, 2011 at 21:32

1 Answer 1

4

Yes, the command you provide is a valid and safe way of getting the code that's being run. It'll be mangled and very hard to read, though; you'll need to take some time to reformat it for readability.

1
  • There are also online tools for that - just google: php deobfuscator
    – Marki555
    Jul 12, 2015 at 22:00

Not the answer you're looking for? Browse other questions tagged .