3 ms·
> The obfuscation used in the russian PHP shells looked awfully familiar I have seen similar obfusaction many times before. Generally most PHP backdoors look l
by codedokode 10y ago
> The obfuscation used in the russian PHP shells looked awfully familiar
I have seen similar obfusaction many times before. Generally most PHP backdoors look like eval($_POST['something']) and here eval is replaced with create_function (by the way I know several other functions that can be used instead of eval). This method of obfuscation (eval + gzip/base64_decode and other functions) is also sometimes used in legitimate scripts.
- ryanlol 10y ago>I have seen similar obfusaction many times before. If you look at it carefully you'll very quickly realize that you haven't. This isn't at all like your typical base64 silliness, and it's certainly very uncommon. This actually uses a cookie to decrypt the encrypted shell before executing it. Pretty obvious, but very few things actually do it.
- rokosbasilisk 10y agohasnt this tech been known for a year now. https://www.fireeye.com/blog/threat-research/2015/12/uncovering_activepower.html https://www.fireeye.com/blog/threat-research/2015/12/uncover... Its been taught in my security class.
- ryanlol 10y agoI'm not sure if I'd describe encrypting and decrypting data as a "tech" :) And it's certainly been known for longer than a year, it's just very rare to see PHP shells doing it like this.
- codedokode 10y agoYou are right, I didn't look carefully, this is not simply eval(POST) backdoor, it has a payload and it is encrypted with an external key that is provided via POST or COOKIE; but I see some weak points and will try to guess the key. Maybe this code is encrypted using some generic obfuscation tool and the file at github matches the rule at report because their payload was encrypted with the same tool? I'll also add some thoughts under @wongarsu's comment.