4 ms·
>I have seen similar obfusaction many times before. If you look at it carefully you'll very quickly realize that you haven't. This isn't at all like your typic
by ryanlol 10y ago
>I have seen similar obfusaction many times before.
If you look at it carefully you'll very quickly realize that you haven't. This isn't at all like your typical base64 silliness, and it's certainly very uncommon.
This actually uses a cookie to decrypt the encrypted shell before executing it. Pretty obvious, but very few things actually do it.
- rokosbasilisk 10y agohasnt this tech been known for a year now. https://www.fireeye.com/blog/threat-research/2015/12/uncovering_activepower.html https://www.fireeye.com/blog/threat-research/2015/12/uncover... Its been taught in my security class.
- ryanlol 10y agoI'm not sure if I'd describe encrypting and decrypting data as a "tech" :) And it's certainly been known for longer than a year, it's just very rare to see PHP shells doing it like this.
- codedokode 10y agoYou are right, I didn't look carefully, this is not simply eval(POST) backdoor, it has a payload and it is encrypted with an external key that is provided via POST or COOKIE; but I see some weak points and will try to guess the key. Maybe this code is encrypted using some generic obfuscation tool and the file at github matches the rule at report because their payload was encrypted with the same tool? I'll also add some thoughts under @wongarsu's comment.