Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Fortunately despite recently becoming a full time web developer, security is something I take very seriously. There's a developer that I work with who's system was recently compromised with obfuscated php (Frequently using eval() and base64_decode()). At first glance it looks like the script might fail due to a missing token but would like to evaluate this script myself.

What's the best way to do this? I had thought about using an online php parser, parsing it on my localhost, or setting up a lamp virtual box but need to verify that any one of these methods is safe or legal.

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

If you simply replace eval() with something like file_put_contents() in each de-obfuscation step you will be able to get the actual malicious code and be able to analyze it. Just make sure you don't output the results to the browser because at some point actual malicious code will be executed in the browser and your machine might get compromised. Write the contents of each step in a plain text file and open them with a plain text editor in each step.

share|improve this answer
    
The difficulty with that is that calls to eval() can be arbitrarily obfuscated. If you don't discover and replace all calls to eval(), you can end up running the malicious code, instead of writing it to a file. –  Bruce Ediger Dec 15 '12 at 20:25
    
@BruceEdiger of course each step in this approach requires thorough scrutiny and a certain amount of knowledge what to look for and what to do with it. –  code_burgar Dec 15 '12 at 21:09
    
@code_burgar would something like this normally be best carried out on a throwaway virtual machine? Especially for those new to analysing threats like myself? –  Adam-E Dec 15 '12 at 22:41
1  
an embedded eval within the code will only be invoked of the code containing it is invoked. Yes, deconstructing of the code should be done carefully, on adedicated machine isolated from the network. But as long as you're careful there's no direct risk from code within an eval statement. –  symcbean Dec 16 '12 at 22:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.