I found a number of PHP scripts on a friends webserver which had been loaded by hackers. The actual code was hidden using several layers of encryption as follows. They had a huge string assigned to a variable $str. Then they used the following line to decrypt the string and run the code eval(gzinflate(str_rot13(base64_decode($str))));
They can't run the code because there's a .htaccess file preventing the execution of scripts from that folder, this is a temporary fix.
However, I am curious as to the decrypted contents of the script. I'd like to see what it is doing as this may give clues as to the vulnerabilities which may exist on the system. How can I do so safely without exposing the system to the intended attack?
Could I safely put this on a linux vm running on a pc while altering the statement above to echo(gzinflate(str_rot13(base64_decode($str))));?
