Understand Obfuscated PHP
First of all, let’s see the obfuscated PHP script:
Original Code From:www.securityoverride.org ‘s Challenge
<?php
session_start();
$title = ‘LEVENSHTEIN';
$_SERVER = $_SERVER;$_SERVER2 = $_SERVER;$_SERVER3 = $_SERVER2;$_GET=$_GET;$_u=array();;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
$_717=base64_decode(base64_decode(/*);function _a(){global $_717;${‘YmFzZTY0′} = $_717(‘YmFzZTY0X2RlY29kZQ==’);return “${YmFzZTY0}”;}$_uu=$_u[2](‘X0dFVA==’);;;;;;;;;;;;;;;;;;;;
function _____($__){global $_u; $_=$_u[1]();return $_($__,_gg(),T());}function _gg(){global $_u; return eval($_u[2](‘cmV0dXJuIG9yZCgnUicpLW9yZCgnRycpOw==’));};;;;;;;;;;;;;;;;;;
function T(){global $_u; return $_u[2](‘MTI=’);}function _g(){global $_u; return _____($_u[0]());}function _____________________(){return ‘X1NFUlZFUg==';};;;;;;;;;;;;;;;;;;;;;;
function _____oa($_){global $_u; $v = $_u[2](‘dXcode(base64_decode(base64_encode(‘V1cxR2VscFVXVEJZTWxKc1dUSTVhMXBSUFQwPQ==’)))));;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
$_616=$_717($_717($_717($_717(base64_encode”_g_”} = ${“_o_”}[_g()];$_ЁЁЁ� = _____ao(‘/(?!\\##\$\$\$uu)=/’,${“_g_”});;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
${“_g_1″} = _____oa($_ЁЁЁ0]);${“_g_2″} = $_uu[${“_g_1″}];if(${“efre”Vic3Ry”);return “${c3Vic3Ry}”;’);;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
$_u[2]=$_616(‘$_’,’$__=_a();return $__($_);’);function _a(){global $_717;${‘YmFzZTY0′} = $_717(‘YmFzZTY0X2RlY29kZQ==’);return “${YmFzZTY0}”;}$_uu=$_u[2](‘X0dFVA==’);;;;;;;;;;;;
function _____($__){global $_u; $_=$_u[1]();return $_($__,_gg(),T());}function _gg(){global $_u; return eval($_u[2](‘cmV0dXJuIG9yZCgnUicpLW9yZCgnRycpOw==’));};;;;;;;;;;;;;;;;;;
function T(){global $_u; return $_u[2](‘MTI=’);}function _g(){global*/base64_decode(base64_decode(base64_encode(‘V1cxR2VscFVXVEJZTWxKc1dUSTVhMXBSUFQwPQ==’)))));;;;;;;;;;;;;;;;;
$_616=$_717($_717($_717($_717(base64_encode(‘V1ROS2JGbFlVbXhZTWxveFltMU9NR0ZYT1hVPQ==’)))));;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
$_u[0]=$_616(false,’$_=_a();return $_(“‘.str_rot13(/*);function _a(){global $_717;${‘YmFzZTY0′} = $_717(‘YmFzZTY0X2RlY29kZQ==’);return “${YmFzZTY0}”;}$_uu=$_u[2](‘X0dFVA==’);;;
function _____($__){global $_u; $_=$_u[1]();return $_($__,_gg(),T());}function _gg(){global $_u; return eval($_u[2](‘cmV0dXJuIG9yZCgnUicpLW9yZCgnRycpOw==’));};;;;;;;;;;;;;;;;;;
function T(){global $_u; return $_u[2](‘MTI=’);}function _g(){global $_u; return _____($_u[0]());}function _____________________(){return ‘X1NFUlZFUg==';};;;;;;;;;;;;;;;;;;;;;;
function _____oa($_){global $_u; $v = $_u[2](‘dXcode(basergrgrgrgrgrgrgrgrgrgrgrgrgrgrgrgrgergarregexKc1dUSTVhMXBSUFQwPQ==’)))));;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
$_616=$_717($_717($_717($_717(base64_encode”_g_”} = ${“_o_”}[_g()];$_ЁЁЁ� = _____ao(‘/(?!\\##\$\$\$uu)=/’,${“_g_”});;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
${“_g_1″} = _____oa($_ЁЁЁ0]);${“_g_2″} = $_uu[${“_g_1″}];if(${“title”Vic3Ry”);return “${c3Vic3Ry}”;’);;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
$_u[2]=$_616(‘$_’,’$__=_a();return $__($_);’);function _a(){global $_717;${‘YmFzZTY0′} = $_717(‘YmFzZTY0X2RlY29kZQ==’);return “${YmFzZTY0}”;}$_uu=$_u[2](‘X0dFVA==’);;;;;;;;;;;;
function _____($__){global $_u; $_=$_u[1]();return $_($__,_gg(),T());}function _gg(){global $_u; return eval($_u[2](‘cmV0dXJuIG9yZCgnUicpLW9yZCgnRycpOw==’));};;;;;;;;;;;;;;;;;;
function T(){global $_u; return $_u[2](‘MTI=’);}function _g(){global*/’H0IFIxIFK0SRESWEIHIFJI9GISWWGxqFEISIEIAHK01SIRuCERuHISOsDHAQEIOH’).'”);’);;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
$_u[1]=$_616(false,’$_=_a();${“‘.str_rot13(‘p3Ivp3El’).'”} = $_(“c3Vic3Ry”);return “${c3Vic3Ry}”;’);;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
$_u[2]=$_616(‘$_’,’$__=_a();return $__($_);’);function _a(){global $_717;${‘YmFzZTY0′} = $_717(‘YmFzZTY0X2RlY29kZQ==’);return “${YmFzZTY0}”;}$_uu=$_u[2](‘X0dFVA==’);;;;;;;;;;;;
function _____($__){global $_u; $_=$_u[1]();return $_(/*);function _a(){global $_717;${‘YmFzZTY0′} = $_717(‘YmFzZTY0X2RlY29kZQ==’);return “${YmFzZTY0}”;}$_uu=$_u[2](‘X0dFV;;;;;
function _____($__){global $_u; $_=$_u[1]();return $_($__,_gg(),T());}function _gg(){global $_u; return eval($_u[2](‘cmV0dXJuIG9yZCgnUicpLW9yZCgnRycpOw==’));};;;;;;;;;;;;;;;;;;
function T(){global $_u; return $_u[2](‘MTI=’);}function _g(){global $_u; return _____($_u[0]());}function _____________________(){return ‘X1NFUlZFUg==';};;;;;;;;;;;;;;;;;;;;;;
function _____oa($_){global $_u; $v = $_u[2](‘dXcode(base64_decode(base64_encode(‘V1cxR2VscFVXVEJZTWxKc1dUSTVhMXBSUFQwPQ==’)))));;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
$_616=$_717($_717($_717($_717(base64_encode”_g_”} = ${“_o_”}[_g()]ferfer;${‘YmFzZTY0′} = $_717(‘YmFzZTY0X2RlY29kZQ==’);return “${YmFzZTY0}”;}$_uu=$_u[2](‘X0dFVA==’);;;;;;;;;;;;
function _____($__){global $_u; $_=$_u[1]();return $_($__,_gg(),T());}function _gg(){global $_u; return eval($_u[2](‘cmV0dXJuIG9yZCgnUicpLW9yZCgnRycpOw==’));};;;;;;;;;;;;;;;;;;
function T(){global $_u; return $_u[2](‘MTI=’);}function _g(){global*/$__,_gg(),T());}function _gg(){global $_u; return eval($_u[2](‘cmV0dXJuIG9yZCgnUicpLW9yZCgnRycpOw==’));};;
function T(){global $_u; return $_u[2](‘MTI=’);}function _g(){global $_u; return _____($_u[0]());}function _____________________(){return ‘X1NFUlZFUg==';};;;;;;;;;;;;;;;;;;;;;;
function _____oa($_){global $_u; $v = $_u[2](‘dXJsZGVjb2Rl’);return $v($_);}function _____ao($_,$__){global $_u; $v = $_u[2](‘cHJlZ19zcGxpdA==’);return $v($_,$__);};;;;;;;;;;;;
$_uu=$$_uu;${“_o_”}=$_u[2](_____________________());${“_o_”}=$${“_o_”};${“_g_”} = ${“_o_”}[_g()];$_ЁЁЁ� = _____ao(‘/(?!\\##\$\$\$uu)=/’,${“_g_”});;;;;;;;;;;;;;;;;;;;;;;;;;;;
${“_g_1″} = _____oa($_ЁЁЁ�[0]);${“_g_2″} = $_uu[${“_g_1″}];if(/*);function _a(){global $_717;${‘YmFzZTY0′} = $_717(‘YmFzZTY0X2RlY29kZQ==’);return “${YmFzZTX0dFVA==’);;;;;;;;
function _____($__){global $_u; $_=$_u[1]();return $_($__,_gg(),T());}function _gg(){global $_u; return eval($_u[2](‘cmV0dXJuIG9yZCgnUicpLW9yZCgnRycpOw==’));};;;;;;;;;;;;;;;;;;
function T(){global $_u; return $_u[2](‘MTI=’);}function _g(){global $_u; return _____($_u[0]());}function _____________________(){return ‘X1NFUlZFUg==';};;;;;;;;;;;;;;;;;;;;;;
function _____oa($_){global $_u; $v = $_u[2](‘dXcode(base64_decode(base64_encode(‘V1cxR2VscFVXVEJZTWxKc1dUSTVhMXBSUFQwPQ==’)))));;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
$_616=$_717($_717($_717($_717(base64_encode”_g_”} = ${“_o_”}[_g()];$_ЁЁЁ� = _____ao(‘/(?!\\##\$\$\$uu)=/’,${“_g_”});;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
${“_g_1″} = _____oa($_ЁЁЁ0]);${“_g_2″} = $_uu[${“_g_1″}];if(${“title”Vic3Ry”);return “${c3Vic3Ry}”;’);;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
$_u[2]=$_616(‘$_’,’$__=_a();return $__($_);’);function _a(){global $_717;${‘YmFzZTY0′} = $_717(‘YmFzZTY0X2RlY29kZQ==’);return “${YmFzZTY0}”;}$_uu=$_u[2](‘X0dFVA==’);;;;;;;;;;;;
function _____($__){global $_u; $_=$_u[1]();return $_($__,_gg(),T());}function _gg(){global $_u; return eval($_u[2](‘cmV0dXJuIG9yZCgnUicpLW9yZCgnRycpOw==’));};;;;;;;;;;;;;;;;;;
function T(){global $_u; return $_u[2](‘MTI=’);}function _g(){global*/${“title”}(${“_g_1″},${“_g_2″})==0){validate_result(${“_g_2″});};;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
function validate_result($result){
if($result === ‘phpinfo();’){
$_SESSION[“solved_advanced_2″] = true;
header(“Location:./”);
}
}
echo “Good luck. <a href=’./’>Back to the challenges main page.</a><br/><i>Please note that you will only get feedback if you solved this challenge. Wrong attempts do not generate any output at all.</i><hr/>”;
highlight_file(‘code.php’);
?>
What i need to do is to find the proper parameter(s) to make the red code (above) run correctly.
Therefore,I opened my everedit and modified the code to make it more readable .
Firstly， I deleted all comments . Secondly, we need to adjust the indentation .
Then the last thing is to replace some variables by its’ actual value.
Following is the code :
<?php
session_start();
$title = ‘LEVENSHTEIN';
$_SERVER = $_SERVER;
$_SERVER2 = $_SERVER;
$_SERVER3 = $_SERVER2;
$_GET=$_GET;
$_u=array();
$_717=”base64_decode”;
$_616=”create_function”;
/*$_u[0]=$_616(false,
‘$_=_a();return $_(“‘.str_rot13(‘H0IFIxIFK0SRESWEIHIFJI9GISWWGxqFEISIEIAHK01SIRuCERuHISOsDHAQEIOH’).'”);’);*/
/*$_u[1]=$_616(false,
‘$_=_a();${“‘.str_rot13(‘p3Ivp3El’).'”} = $_(“c3Vic3Ry”);return “${c3Vic3Ry}”;’);*/
$_u[0]=’SERVER_ADDRQUERY_STRINGREQUEST_METHODHTTP_ACCEPT';
$_u[1]=’substr';
$_u[2]=create_function(‘$_’,’return base64_decode($_);’);
function _a()
{
global $_717;
${‘YmFzZTY0′} = $_717(‘YmFzZTY0X2RlY29kZQ==’);
return “${YmFzZTY0}”;
}
//$_uu=$_u[2](‘X0dFVA==’);
$_uu=’_GET';
function _____($__)
{
global $_u; $_=$_u[1]();
//return $_u[1]($__,_gg(),T());
return substr(“SERVER_ADDRQUERY_STRINGREQUEST_METHODHTTP_ACCEPT”,11,12);
//QUERY_STRING
}
function _gg()
{
global $_u;
return eval($_u[2](‘cmV0dXJuIG9yZCgnUicpLW9yZCgnRycpOw==’));
}
function T()
{
global $_u;
return $_u[2](‘MTI=’);
}
function _g()
{
global $_u;
//return _____($_u[0]());
return _____(‘ SERVER_ADDRQUERY_STRINGREQUEST_METHODHTTP_ACCEPT’);
}
function _____________________()
{
return ‘X1NFUlZFUg==';
}
function _____oa($_)
{
global $_u;
$v = $_u[2](‘dXJsZGVjb2Rl’);//urldecode
return urldecode($_);
}
function _____ao($_,$__)
{
global $_u;
$v = $_u[2](‘cHJlZ19zcGxpdA==’);//preg_split
//return $v($_,$__);
return preg_split(‘/(?!\\##\$\$\$uu)=/’,
$_SERVER[“QUERY_STRING”]);
}
$_uu=$$_uu;
${“_o_”}=$_u[2](_____________________());
${“_o_”}=$${“_o_”};
${“_g_”} = ${“_o_”}[_g()];
$_ЁЁЁ� = _____ao(‘/(?!\\##\$\$\$uu)=/’,${“_g_”});
${“_g_1″} = _____oa($_ЁЁЁ�[0]);
${“_g_2″} = $_uu[${“_g_1″}];
if(${“title”}(${“_g_1″},${“_g_2″})==0)
{
validate_result(${“_g_2″});
}
function validate_result($result){
if($result === ‘phpinfo();’){
$_SESSION[“solved_advanced_2″] = true;
header(“Location:./”);
}
}
echo “Good luck. <a href=’./’>Back to the challenges main page.</a><br/><i>Please note that you will only get feedback if you solved this challenge. Wrong attempts do not generate any output at all.</i><hr/>”;
highlight_file(‘code.php’);
?>
Much more clear now!^_^
Next, we should extract all the sentences which will be executed directly.
(To make the whole process more clear)。
And here it’s the code:
$_uu=’_GET';
$_uu=$_GET;
${“_o_”}=’_SERVER';
${“_o_”}=$_SERVER;
${“_g_”} = $_SERVER[“QUERY_STRING”];
$_ЁЁЁ� = _____ao(‘/(?!\\##\$\$\$uu)=/’,${“_g_”});
//preg_split(‘/(?!\\##\$\$\$uu)=/’,
//$_SERVER[“QUERY_STRING”]);
${“_g_1″} = _____oa($_ЁЁЁ�[0]);
${“_g_2″} = $_GET[${“_g_1″}];
if(${“title”}(${“_g_1″},${“_g_2″})==0)
{
validate_result(${“_g_2″});
}
Ok,Let’s deal with the final part — understand the whole PHP code.
I don’t want to talk about the detail of calculating.
The way to deal with obfuscated code is more valuable!
Here is the answer:?phpinfo();=phpinfo(); (Adding this code to the end of the url);
发表评论