I found a number of PHP scripts on a friends webserver which had been loaded by hackers. The actual code was hidden using several layers of encryption as follows. They had a huge string assigned to a variable $str. Then they used the following line to decrypt the string and run the code eval(gzinflate(str_rot13(base64_decode($str))));

They can't run the code because there's a .htaccess file preventing the execution of scripts from that folder, this is a temporary fix.

However, I am curious as to the decrypted contents of the script. I'd like to see what it is doing as this may give clues as to the vulnerabilities which may exist on the system. How can I do so safely without exposing the system to the intended attack?

Could I safely put this on a linux vm running on a pc while altering the statement above to echo(gzinflate(str_rot13(base64_decode($str))));?

closed as off topic by Chopper3 Jul 5 '11 at 15:20

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Anyone else interested in seeing the results posted once OP decodes? I know I am. Curious what $str is being set to. – Chris Jul 5 '11 at 14:19
  • Thinking security.stackexchange.com would be interested as well. You could migrate this over there, especially if you have follow up questions based on the contents... – Rory Alsop Jul 5 '11 at 14:25
  • Heh, rot13. Sneaky..? – Shane Madden Jul 5 '11 at 14:25
  • Maybe we could migrate this question to a more appropriate site? – conorgriffin Jul 5 '11 at 15:55
  • For those interested, the content of the unencrypted script is on pastebin pastebin.com/u7kY9ren – conorgriffin Jul 5 '11 at 21:32

Yes, the command you provide is a valid and safe way of getting the code that's being run. It'll be mangled and very hard to read, though; you'll need to take some time to reformat it for readability.

  • There are also online tools for that - just google: php deobfuscator – Marki555 Jul 12 '15 at 22:00

Not the answer you're looking for? Browse other questions tagged or ask your own question.