Decrypting Plesk Panel PHP files (stolen from @silentsignal)

gistfile1.md

Hooking memcpy of swengine

1. /tmp root@apx# nano ld.c
2. /tmp root@apx# gcc -fPIC -c ld.c -o ld.o
3. /tmp root@apx# gcc -shared -o ld.so ld.o
4. /tmp root@apx# LD_PRELOAD=/tmp/ld.so /usr/bin/sw-engine /usr/local/psa/admin/htdocs/login_up.php3

Cheers

ld.c

#include <string.h>
#include <stdio.h>

int i=0;

void *memcpy(void *dst,const void *src,size_t len){
	if((strstr(src,");") > 0) && (i==0)){
		printf("%s\n",src);
		i=1;
	}

	register char *src_c, *dst_c;
	src_c = (char *)src;
	dst_c = (char *)dst;

	while (len-- > 0)
		*dst_c++ = *src_c++;

	return dst;
}

In this case, we have no see include, include_once, require, require_once files. In addition, PLesk from 12.x has another protect algoritm and can't be decrypted this way.

Your way to version 12.x decrypting it?