3

I found a jpeg image on a server that contained the string <?php. The server also hosts an application written in PHP. The contents of the image that come after the string <?php are non-ascii.

I'm unable to find anything in the file that appears to be valid PHP code, yet I'm unwilling to accept that the string <?php appears within the file coincidentally.

The jpeg image is viewable in Windows, but clearly displays visual abnormalities about 1/3 of the way down. Saving the portion of the image that starts with <?php as a separate jpeg image and viewing it as an image confirms that the visual abnormalities begin at the same point that the string <?php occurs.

I'm reasonably certain that this image contains malicious PHP, but my attempts to detect executable PHP code have failed.

Edit

This image has visual abnormalities that begin at the point of the string "<?php" and continue to the bottom of the image. For testing, I've taken a different (known safe) jpeg, opened it in a text editor, and added the string "<?php" somewhere in the middle. The test image has zero visual abnormalities. This implies to me that the image in question was not only maliciously altered to contain the string "<?php", but that there were additional alterations made after the string "<?php". It seems likely that this image somehow contains executable PHP code.

--

Could this image indeed contain valid executable PHP that is encoded in a way as to not be readable within a text editor?

How can I confirm and/or translate the image file contents so that I may determine what the malware has done?

Edit

The image is attached

malware.jpg

Below is the image before it was modified

original.jpg

  • The alleged maliciousness of the code aside, it shouldn't make too much a deal, as long as the file's extension is not .php and your code is not prone to file injection attack (and it shouldn't be anyway). – Your Common Sense Sep 20 '18 at 7:58
  • I don't like this approach to security. It's like... "the dynamite is safe as long as no one touches it" – Aaron Cicali Sep 20 '18 at 18:09
  • This file does not seem malicious. <?phpW¦§I´Çy§Ò is not valid code, and will not execute. – ThoriumBR Sep 20 '18 at 19:59
  • Agreed that <?phpW¦§I´Çy§Ò is not valid code, but I would say that this file does seem malicious. Maybe the perpetrator failed at their goal, but the file has been modified. – Aaron Cicali Sep 20 '18 at 20:27
2

No, PHP code is always at least some part readable ASCII.

Typical obfuscation methods are to decode a piece of code and run that:

eval(gz_decompress(base64_decode("0Z074L7expJKXs...")));

But you would still see a PHP function name after <?php.

  • I think you are right, but at the same time I would not say that this does not mean the file is not maliscious in some weird way. Just not sure how. – Anders Sep 20 '18 at 8:02
  • Thanks @Sjoerd. Can you provide any references citing this? I want to believe that this is true, but this image seems compelling proof otherwise. I'll edit my question to provide additional discovery. – Aaron Cicali Sep 20 '18 at 18:02
  • I tried calling token_get_all() on the file contents to see what PHP's tokenizer finds, and it concurs. This image does not contain executable PHP, just the PHP opening statement. Additionally, I tried adding code throughout an image and running it, but indeed it does not execute. The code must be ascii, with the exception of string contents. I don't have any official reference to confirm this though. For this particular image, it's actually possible this was not placed there by a bad actor, but was part of a find/replace to remove short open tags from the actual PHP files. – Aaron Cicali Sep 20 '18 at 22:19
0

The php code must be ASCII.

Anything outside the can be binary.

Anything inside quotes within the php code can be binary.

It is possible that you may be looking at encoded php code typically this needs additional binaries and/or licence files to execute.

It might have been helpful (safer?) if you had included a screenshot of the content as seen in your editor around the tags.

0

The selected answer is probably true that valid PHP code is always at least some part readable ASCII, however...

Yes, PHP can be written in non-ascii.

An example of UTF-8 PHP can be found here: https://rosettacode.org/wiki/Unicode_variable_names#PHP

<?php
$Δ = 1;
++$Δ;
echo $Δ;

This code can be saved as UTF-8 and successfully run. The output from running this script is 2.


Additional Information

The code above proves that PHP can be written as non-ascii, but it still resembles valid PHP code... there are line endings, dollar signs for variables, echo and assignment statements, and a unary operator.

The original post was regarding specific non-ascii content that followed an opening <?php tag, but that code did not resemble code like this sample above. Instead, it appeared to be binary image contents, or possibly hex strings. My current understanding of character encoding does not allow me to rule out the possibility that the code in question was executable, however it seems unlikely.

That said, if PHP allows the mentioned symbols ($=;++echo) to also be written as non-ascii equivalents, then it is entirely possible for code to exist that in no way resembles recognizable PHP. It would be great if someone with a broad understanding of character encoding could add to this post.

0

Could this image indeed contain valid executable PHP that is encoded in a way as to not be readable within a text editor?

Yes. But it depends how this code will be used. I suppose targeted code should inject the code from the image. In case if any callbacks exists that will decode it before it can be encoded (base64 or anything else). In some cases I was founding the code that has been included in raw view like this:

<?php 
include(path/to/image);
?>

How can I confirm and/or translate the image file contents so that I may determine what the malware has done?

It could be difficult. You need to understand exploit. If you use some opensource solution you can try to find some among known security issues.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.