php script containing devil hack

Question

Sadly I have run into a very big problem. I noticed that on a website (not mine anyway) there was a file with avery long obfuscated string (over 70.000 chars) with this:

eval(gzuncompress(base64_decode("CODE")));

I wanted to deobfuscate it locally on my PC but finally i decided to use the lazy way using one of the many online deobfuscator tools. As soon as i clicked on "Deobfuscate" i was able to see the output just for a few seconds. From that moment it seems that i can no longer access to pages where online deobfuscators are hosted. For example i can't open this page (Connection Aborted) even if i can properly browse all other pages:

http://www.whitefirdesign.com/tools/deobfuscate-php-hack-code.html

It's like if all these tools get banned from my PC on every browser and user account. Only few of them are still accessible like MobileFish:

http://www.mobilefish.com/services/eval_gzinflate_base64/eval_gzinflate_base64.php

But no one of them is able to process my requests. It's like if this php script is a pure devil. I suppose that my PC has been compromised in some way since i can't open some particular websites even if both MalwareBytes and Avast can't find anything wormy. Any ideas? What this script does?

http://pastebin.com/yf6R1rVK

Answer 1

The code has been put there through some sort of other vulnerability on the site. Here's the deobfuscated PHP, run at your own peril. It looks like some sort of shell which would allow attackers to run certain commands/farm information on the server it's hosted on

https://gist.github.com/jtylr/4fd6240ddcd046e62535

The code has been encoded and compressed, base64_decode() decodes the string, gzuncompress() decompresses it and eval() (see: evil) will then run the string.

Answer 2

I've run into some malicious code before that was injected into some vBulletin forums I was responsible for. Generally this malicious code is executed on the remote machine by being dumped onto the box as a bunch of bites, and then set up to be decoded, decompressed, and evaluated as suggested by that line you have.

It could have done anything.

Perhaps check your machines' host file and see if there are any strange entries that may prevent you from visiting those web pages.

C:\Windows\System32\drivers\etc\hosts

(Assuming you are on Windows. Look for anything suspicious in there and remove it.)

Could also be something in there preventing your anti-virus software from running, or it may be that no actual viral loads were delivered and that you've simply had your host file rewritten.

Answer 3

I doubt you are infected. The code is some kind of shell, that is certainly bad news for the site you found it on, but the simple act of viewing the code string wont effect you.

You can see the deobed code here: http://pastebin.com/QDvnAzZw

What i expect has happened is that your antivirus software scans webpages as you visit them, and recognized the deobed code as malicious, thus cutting the connection to the site.

I imagine the site is then flagged as malicious by your antivirus, thus blocking later attempts to visit it.

If i am correct, you probably wont be able to see the pastebin page linked above.

The solution is specific to your AV program.

Answer 4

here is the decoded malicious code (this link is a tiny paste , don't worry)

First rapid investigation (i didn't decode the python part) seem to try open backdoors in wordpress & joomla admins.