0

I found a file in the public folder of our website. Then I searched to find out how this file was uploaded. I finally found that it was uploaded via FTP. We have determined the IP and address to which the FTP connection is made. I'm looking for more definitive proof of who might have done it. The attackers encrypted the file content they uploaded with "eval" and "base64". Can you help me to read this php file?

File: https://www.unphp.net/decode/6051e19611e7cc68ee8491bf73b4d315/

1
  • welcome - this is why you must disable eval (among others) on your web-facing host .. they haven't encrypted anything: the payload has been obfuscated using a series of annoying, built-in steps that could be reversed with enough dedication - the de-obfuscator you linked to only unpicked the first "layer"
    – brynk
    Jan 7, 2023 at 2:06

2 Answers 2

2

That's an encoded webshell. You can convert it by just executing the _2LWOJu0EpqpT8P0vxo6X function with the long encoded input string as input:

print_r(_2LWOJu0EpqpT8P0vxo6X('[string here]'));

It appears it's a modified version of this webshell: https://github.com/theralfbrown/webshell merged with a script called "flamux script 3.3", and possibly some other malware.

It's used to perform all other sorts of attacks on the compromised web server.

I doubt you will find the attacker with that knowledge, it seems they just used an existing webshell script.

0

I'm looking for more definitive proof of who might have done it.

In very many cases remote attacks is not worth attributing; they are commonly automated and random - the attacker have botnets that test passwords and vulnerabilities all over the place, and strike lucky in a small number of attacks.

If I were victim to such an attack, I would focus on learning how it happened and how to avoid similar attacks in the future.

If I knew the IP of the attacker I'd probably send that and relevant information to abuse@.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .