Can valid PHP be written and executed in non-ascii character encodings?

Question

I found a jpeg image on a server that contained the string <?php. The server also hosts an application written in PHP. The contents of the image that come after the string <?php are non-ascii.

I'm unable to find anything in the file that appears to be valid PHP code, yet I'm unwilling to accept that the string <?php appears within the file coincidentally.

The jpeg image is viewable in Windows, but clearly displays visual abnormalities about 1/3 of the way down. Saving the portion of the image that starts with <?php as a separate jpeg image and viewing it as an image confirms that the visual abnormalities begin at the same point that the string <?php occurs.

I'm reasonably certain that this image contains malicious PHP, but my attempts to detect executable PHP code have failed.

Edit

This image has visual abnormalities that begin at the point of the string "<?php" and continue to the bottom of the image. For testing, I've taken a different (known safe) jpeg, opened it in a text editor, and added the string "<?php" somewhere in the middle. The test image has zero visual abnormalities. This implies to me that the image in question was not only maliciously altered to contain the string "<?php", but that there were additional alterations made after the string "<?php". It seems likely that this image somehow contains executable PHP code.

--

Could this image indeed contain valid executable PHP that is encoded in a way as to not be readable within a text editor?

How can I confirm and/or translate the image file contents so that I may determine what the malware has done?

Edit

The image is attached

Below is the image before it was modified

Answer 1

No, PHP code is always at least some part readable ASCII.

Typical obfuscation methods are to decode a piece of code and run that:

eval(gz_decompress(base64_decode("0Z074L7expJKXs...")));

But you would still see a PHP function name after <?php.

Answer 2

The php code must be ASCII.

Anything outside the can be binary.

Anything inside quotes within the php code can be binary.

It is possible that you may be looking at encoded php code typically this needs additional binaries and/or licence files to execute.

It might have been helpful (safer?) if you had included a screenshot of the content as seen in your editor around the tags.

Answer 3

The selected answer is probably true that valid PHP code is always at least some part readable ASCII, however...

Yes, PHP can be written in non-ascii.

An example of UTF-8 PHP can be found here: https://rosettacode.org/wiki/Unicode_variable_names#PHP

<?php
$Δ = 1;
++$Δ;
echo $Δ;

This code can be saved as UTF-8 and successfully run. The output from running this script is 2.

---

Additional Information

The code above proves that PHP can be written as non-ascii, but it still resembles valid PHP code... there are line endings, dollar signs for variables, echo and assignment statements, and a unary operator.

The original post was regarding specific non-ascii content that followed an opening <?php tag, but that code did not resemble code like this sample above. Instead, it appeared to be binary image contents, or possibly hex strings. My current understanding of character encoding does not allow me to rule out the possibility that the code in question was executable, however it seems unlikely.

That said, if PHP allows the mentioned symbols ($=;++echo) to also be written as non-ascii equivalents, then it is entirely possible for code to exist that in no way resembles recognizable PHP. It would be great if someone with a broad understanding of character encoding could add to this post.

Answer 4

Could this image indeed contain valid executable PHP that is encoded in a way as to not be readable within a text editor?

Yes. But it depends how this code will be used. I suppose targeted code should inject the code from the image. In case if any callbacks exists that will decode it before it can be encoded (base64 or anything else). In some cases I was founding the code that has been included in raw view like this:

<?php 
include(path/to/image);
?>

How can I confirm and/or translate the image file contents so that I may determine what the malware has done?

It could be difficult. You need to understand exploit. If you use some opensource solution you can try to find some among known security issues.