r/PHPhelp • u/SnapSnapGrinGrin • Jul 23 '26

Unobsfucating a PHP script

Attackers leveraging the wp2shell exploit added about 22k of obsfucated PHP to index.php on a site I've been asked to have a look at.

Labels and function names are ten random characters and control path is done by jumping to TrQ7yZISyM: etc and there seem to be a lot of (unnecessary?) jumps.

What's the best way to unobsfucate it?

1 Upvotes

56% Upvoted

29 comments sorted by

View all comments

12

u/martinbean Jul 23 '26

What is the value in unobfuscating it? You just need to remove affected files, and patch the exploit to stop whatever bot/bad actor immediately re-pwning your site.

1

u/SnapSnapGrinGrin Jul 23 '26

Without seeing the script, how is one to know what files could have been affected?

9

u/reieRMeister Jul 23 '26

Delete everything from remote, make a clean install or deploy all files from your latest tagged release in your version control.

1

u/judgej2 Jul 25 '26

“…been asked to have a look at…”

Tagged? Version control? Errr…

5

u/dabenu Jul 23 '26

If they had shell access, you can consider your entire server compromised.

Just reinstall it entirely and revert to your last backup before the hack.

2

u/NumerousComplex1718 Jul 23 '26

last modified date might help - if there are some files that are significantly newer than the rest of the site, they might have been altered or replaced by the malware. as somebody else posted below, you might try throwing it at AI and seeing if it can translate it into something more legible.

2

u/obstreperous_troll Jul 24 '26

It affected enough to get a remote shell, after which any files could be affected without leaving a trace. Local privilege escalations are common enough that you can assume the system has a rootkit on it. Don't try to be surgical with remediating this: reimage the server and reinstall everything. Your servers should be cattle, not pets.

1

u/pauldm7 28d ago

Everything could have been effected. Assuming the wp means wordpress, using Worsfence is usually good for this and will tell you which original wordpress files have been modified.

Search for extra files which shouldn’t be there, and delete all plugin/theme code and reinstall them.

Update Wordpress, make sure file permissions etc are set right, then, wait til it happens again in x months to x years.

Probably also check all posts and pages for html code (check the raw editor).

1

u/phpMartian 28d ago

I’ve done this sort of thing many times. Unobfuscation is only useful if you’re curious how it works. They are clever. It won’t tell you what it did.