Freek.dev

Aaron Saray recently found some rogue code on a hacked website and investigated what it actually does.

It’s hard to come up with a title for this - but - basically I found some rogue code the other day that I thought was pretty interesting. I was fixing a “hacked” website when I came across the source of the symptoms of the hack.

This obfuscated code is doing something bad, but we don’t know what at first glance. Obviously, the solution is to remove it - but - aren’t you a little curious what it was doing? Let’s take a look.

https://aaronsaray.com/2017/anatomy-of-a-php-hack.html

Read more

Here's a great story by Collin O'Dell, maintainer of league/commonmark amongst other things, on how he was able to extract the class definitions out of obfuscated PHP source files.

Per the framework's license, decrypting the IonCube-protected code was not allowed. This meant it was impossible to recover the original source code. However, I could require those files and execute them in PHP, which would cause those classes to become usable in code. So how does one figure out what code just got loaded & executed?

https://www.colinodell.com/blog/201708/generating-ide-stubs-ioncube-encoded-classes

Read more