2

Fortunately despite recently becoming a full time web developer, security is something I take very seriously. There's a developer that I work with who's system was recently compromised with obfuscated php (Frequently using eval() and base64_decode()). At first glance it looks like the script might fail due to a missing token but would like to evaluate this script myself.

What's the best way to do this? I had thought about using an online php parser, parsing it on my localhost, or setting up a lamp virtual box but need to verify that any one of these methods is safe or legal.

Improve this question

1 Answer 1

Reset to default
4

If you simply replace eval() with something like file_put_contents() in each de-obfuscation step you will be able to get the actual malicious code and be able to analyze it. Just make sure you don't output the results to the browser because at some point actual malicious code will be executed in the browser and your machine might get compromised. Write the contents of each step in a plain text file and open them with a plain text editor in each step.

Improve this answer
4
  • The difficulty with that is that calls to eval() can be arbitrarily obfuscated. If you don't discover and replace all calls to eval(), you can end up running the malicious code, instead of writing it to a file.
    – Bruce Ediger
    Dec 15, 2012 at 20:25
  • @BruceEdiger of course each step in this approach requires thorough scrutiny and a certain amount of knowledge what to look for and what to do with it.
    – code_burgar
    Dec 15, 2012 at 21:09
  • @code_burgar would something like this normally be best carried out on a throwaway virtual machine? Especially for those new to analysing threats like myself?
    – Adam-E
    Dec 15, 2012 at 22:41
  • 1
    an embedded eval within the code will only be invoked of the code containing it is invoked. Yes, deconstructing of the code should be done carefully, on adedicated machine isolated from the network. But as long as you're careful there's no direct risk from code within an eval statement.
    – symcbean
    Dec 16, 2012 at 22:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .