2

I have a customer who wants me to "restore" his Wordpress page. I looked a little bit deeper in the codes and found the following code a few times in different files:

http://pastebin.com/nL4i6t8x

I'm not an expert in IT Security but for me this looks pretty much as "encrypted" code that does not belong to Wordpress.

How can I analyze what this code does? I really need to know what it is before I can "clean" it. I'm interested to learn something about it so I'm very thankful for explanations what it is, what is does, where it (might) comes from and how to remove it.

Thanks in advance!

  • It seems as if there needs to be another part that kind of "executes" (eval()) the code but I don't know where to search. – Daniel K. Jul 18 '14 at 19:39
  • Used: find . -type f -name '*.php' | xargs grep -l "eval *(" - nothing found that is related to that. – Daniel K. Jul 18 '14 at 19:52
  • 2
    I think this is rather highly obfuscated than encrypted. But still - working out what it does will take a few hours. – marstato Jul 18 '14 at 21:13
  • What research have you done? There's lots written on analyzing obfuscated Javascript. Depending on your experience level, the answer might be "you don't know enough to make analyzing the code a worthwhile avenue to pursue". – D.W. Jul 23 '14 at 23:32
2

The best solution would be to use a local PHP server on a computer without Internet if you want to be safe.

Download PHP, put this text in a .php file, COMMENT OUT ALL THE PARTS YOU DON'T UNDERSTAND YET, and run 'php -S localhost:80' (or even better, take this version I cleaned a little)

Then just add 'echo $variable' to see what's going on, and uncomment lines when you think you understand what it does.

EDIT: This doesn't seem to be heavily obfuscated, the only lines you might be afraid of are the very last ones.

SECOND EDIT: The eval is in the hex string at the end

\x20\57\x2a\40\x67\146\x71\165\x79\157\x70\167\x78\171\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x31\63\x37\55\x31\60\x30\51\x29\54\x20\143\x68\162\x28\50\x36\60\x31\55\x35\60\x39\51\x29\54\x20\145\x64\161\x68\157\x61\161\x75\161\x70\50\x24\163\x67\152\x6b\160\x62\162\x71\144\x6f\54\x24\143\x72\151\x79\160\x6a\167\x6e\155\x69\51\x29\51\x3b\40\x2f\52\x20\141\x61\155\x72\151\x65\160\x74\167\x75\40\x2a\57\x20

"' /* gfquyopwxy / eval(str_replace(chr((137-100)), chr((601-509)), edqhoaquqp($sgjkpbrqdo, $criypjwnmi))); / aamrieptwu */ '"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.