Comment on One of my Drupal sites was hackedComments−joshvm12ySimple python script to deobfuscate the hex and replace the junk variables: import re a = open('test.php') line = a.readlines() # Replace hex values with ASCII, regex to find the \x values and a lambda to replace each match individually def decoder(char): return char[2:].decode("hex") unhex = re.sub("\\\\x[a-f0-9][a-f0-9]", lambda m: decoder(m.group()), line[0]) # Replace ${"GLOBALS"}["foo"] = "bar" for match in re.findall('\${"GLOBALS"}["[a-z0-9]+"]="[a-z0-9]+"', unhex): variable = re.findall(r'"(.*?)"', match) pattern = '\${\${"GLOBALS"}\["'+variable[1]+'"\]}' unhex = re.sub(pattern, variable[2], unhex) unhex = unhex.replace(match+";", '') # Replace $bar = "foo" for match in re.findall('\$[a-z0-9]+="[a-z0-9]+"', unhex): replace = re.findall(r'"(.*?)"', match)[0] pattern = re.findall(r'\$[a-z]+', match)[0] unhex = unhex.replace(pattern, replace) # Chuck in newlines unhex = unhex.replace(";", ";\n ") b = open('out.php', 'w') b.writelines(unhex) The files all seemed to be one liners, so this works. More work to replace everything else though. Blergh.Edited to include variable replacement. I think there are some catches with things like ${sgasklgna} but it largely works. Just needs prettifying.−michaelmior12yNote that to decode escaped characters you can just use str.decode('string-escape')−joshvm12yThanks for that, I wasn't aware there was a built-in to handle strings where there's mixed ascii/hex content.
Comments
Simple python script to deobfuscate the hex and replace the junk variables:
The files all seemed to be one liners, so this works. More work to replace everything else though. Blergh.Edited to include variable replacement. I think there are some catches with things like ${sgasklgna} but it largely works. Just needs prettifying.
Note that to decode escaped characters you can just use
Thanks for that, I wasn't aware there was a built-in to handle strings where there's mixed ascii/hex content.