Found this webshell but I can not get the plain text as I have not the secret/password to decode it completely.

This is the part where I am missing some information: md5($_POST['_f__f'])

Does someone have some idea how to decode this one and what it is and does or recognizes it?

  • This obviously calculates a hash of something. If your question is what this calculates the MD5 of, you need to show us where _POST comes from and what is defining _f__f. Your question must be self-contained, we aren't going to trawl external websites that might go away by the time someone next reads the question. – Gilles 'SO- stop being evil' Jun 13 '15 at 12:17
  • Well, this is everything I have, just the sourcecode of this uploaded script. POST values are not logged in accesslogs of Apache. So no one ever saw this code before? – Daniel Ruf Jun 13 '15 at 12:20

The payload is encrypted using a simple autokey cipher, using md5($_f__f).substr(md5(strrev($_f__f)),0,strlen($_f__f)) as the password. You could try the usual techniques for attacking autokey ciphers, but the length of the password (at least 32 characters) and the fact that the plaintext is gzip-compressed make it impractical.


This function calculates the MD5 hash from the POST value "_f__f". It is impossible to get the original value from a MD5 hash because it's a hash and not an encryption.

  • Sure, I know this. But has someone found a decoded version or seen this before? This has to be one of the known webshells like WSO.My question is not about the actual value but about the webshell itself. – Daniel Ruf Jun 12 '15 at 11:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.