3

I've found a couple of suspicious-looking PHP files on my webserver obfuscated by a substantial block of eval. Ideally, I'd like to know what they do, but I'm struggling to decrypt them.

Everything else on the server matches my git repo, so I'm pretty confident nothing else has been changed. I can't find any mention in the Apache logs of either file being called since they were created. Does that mean it's safe to assume they have never been run?

Improve this question
4
  • I guess you correlated their creation date/time and your date/time of logs? (I mean you keep enough logs) Did you check that those files were not "included" and then called from other files? – Soufiane Tahiri Jan 6 at 14:28
  • It's possible for an attacker to make one php script execute another php script through an eval() exploit. See security.stackexchange.com/questions/179375/… In this case, the second php script (executed by way of eval()) would not appear in the apache logs. – mti2935 Jan 6 at 14:42
  • Somewhat mysteriously, they don't see to have a creation date, but I've checked from their last modified date, and from the last time I know for sure they weren't there. I'm on shared hosting, so I only have the logs they've provided. But it does at least mean I'm pretty confident the logs won't have been tampered with, as I don't have permission to do that myself. As I said, everything else matches my repo, so it wasn't called from them, at least at a code level. Unless one of my users is compromised and can call it from a form on the site somehow? Would that show in the logs if they were? – somnolentsurfer Jan 6 at 14:50
  • 1
    It is never safe to assume anything when it pertains to server security. – svin83 Jan 6 at 16:38
1

No, while they may not appear in your log files they could still have executed via file inclusion bugs in other scripts. Imagine the following request:

POST /index.php HTTP/1.0
Host: yoursite

page=../uploads/shell.php

If vulnerable the script would execute, but the body of the request isn't logged and would not show the reference to shell.php

Additionally as you mentioned Apache you also need to consider the potential impact of .htaccess files which may affect what executes as PHP and logging as well. See this thing I wrote years ago: http://archive.justanotherhacker.com/2011/12/writing-a-stealth-web-shell.html

Improve this answer
1
  • 1
    You wrote that? I've seem this a long time ago and found it an amazing idea, even though I haven't used it. – ThoriumBR Jun 16 at 9:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.