This malware is hidden in pirated themes and plug-ins for CMS . the ‘social.png’ file confirmed we had found the backdoor; as it contained a big blob of obfuscated PHP code .
My question is how hacker use the code infused inside an image ?
Can i execute an image file as a php keeping php code in an image ?
Even if i infuse some php code in a binary or hexa format into an image file , how hackers use the image .
How to use the code infused inside an image .
I bet there's a small piece of code hidden somewhere that takes care of deobfuscating the real payload from the image and then executing it; that allows the attackers to have a very small piece of malware that they can easily hide somewhere in an otherwise unoffensive PHP file, while keeping the big and not-so-sneaky malware in an image which allows it to go unnoticed most of the time, unless someone knows what to look for.
For the "how to use" part, find a way to embed PHP code in an image (it may be as simple as a PHP file renamed to .png to something more sneaky like steganography that won't be noticeable just by looking at the displayed image), then create a little piece of code that takes care of deobfuscating your actual payload and then executing it.
Also I've read somewhere that badly configured web servers can serve image files as text, which results in a big mess of Unicode characters when viewed in a browser, but what's interesting is that PHP code in these "images" will get executed.
Text comments can be included in PNG, JPG, and GIF files. No steganography is necessary. As you have discovered, if the image is included (using PHP's include construct) the code will be executed. That works because PHP has copy mode and interpret mode. Included files start in copy mode, so the PHP interpreter is not looking at the bits of the image at all, just copying them. When the <?php is encountered in the comments, the PHP processor switches to interpret mode and executes the code until it sees ?>.
