Skip to content

Comment on One of my Drupal sites was hacked

Comments

Simple python script to deobfuscate the hex and replace the junk variables:

    import re

    a = open('test.php')
    line = a.readlines()
    
    # Replace hex values with ASCII, regex to find the \x values and a lambda to replace each match individually
    def decoder(char):
        return char[2:].decode("hex")

    unhex =  re.sub("\\\\x[a-f0-9][a-f0-9]", lambda m: decoder(m.group()), line[0])

    # Replace ${"GLOBALS"}["foo"] = "bar"
    for match in re.findall('\${"GLOBALS"}["[a-z0-9]+"]="[a-z0-9]+"', unhex):
        variable = re.findall(r'"(.*?)"', match)
       pattern = '\${\${"GLOBALS"}\["'+variable[1]+'"\]}'
        unhex = re.sub(pattern, variable[2], unhex)
        unhex = unhex.replace(match+";", '')

    # Replace $bar = "foo"
    for match in re.findall('\$[a-z0-9]+="[a-z0-9]+"', unhex):
        replace = re.findall(r'"(.*?)"', match)[0]
        pattern = re.findall(r'\$[a-z]+', match)[0]
        unhex = unhex.replace(pattern, replace)
    
    # Chuck in newlines
    unhex = unhex.replace(";", ";\n ")

    b = open('out.php', 'w')
    b.writelines(unhex)
The files all seemed to be one liners, so this works. More work to replace everything else though. Blergh.

Edited to include variable replacement. I think there are some catches with things like ${sgasklgna} but it largely works. Just needs prettifying.

Note that to decode escaped characters you can just use

    str.decode('string-escape')

Thanks for that, I wasn't aware there was a built-in to handle strings where there's mixed ascii/hex content.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.