Quick check to avoid malware in PHP scripts.

[PedroNavp]

I made a quick checklist to avoid manipulated PHP scripts with malware I hope you find it useful.

• Open the PHP file in a you IDE: Use a code editor
• Look for suspicious function calls: Search for potentially dangerous functions like:
  • eval()
  • exec()
  • shell_exec()
  • system()
  • passthru()
  • popen()
  • proc_open()
• Check for base64 encoded strings: Malware often uses base64 encoding to hide malicious code. Look for:
  • base64_decode()
  • Long strings of seemingly random characters
• Inspect CURL usage: While CURL itself isn't malicious, it can be used for unauthorized data transfer. Look for:
  • curl_init()
  • curl_setopt()
  • curl_exec() Check the URLs being accessed and ensure they're legitimate.
• Examine file operations: Look for suspicious file read/write operations:
  • fopen()
  • file_get_contents()
  • file_put_contents()
• Check for obfuscated code: Malware often uses obfuscation techniques. Look for:
  • Extremely long lines of code
  • Unusual variable names (e.g., $a1b2c3)
  • Strings of hexadecimal characters
• Verify included files: Check all include() and require() statements to ensure they're including legitimate files.
• Look for unauthorized database queries: Search for database operations that might be extracting or modifying data:
  • mysql_query() (for older PHP versions)
  • mysqli_query()
  • $wpdb->query() (in WordPress)
• Check for hidden backdoors: Look for code that might create admin users or provide unauthorized access:
  • wp_insert_user() (in WordPress)
  • add_user() (in other CMS systems)

PS. This tool is useful too https://github.com/marcocesarato/PHP-Antimalware-Scanner

 

[herf18]

Sometimes the above elements can be avoided, which will be undetectable for certain code executed from a variable as a function, example in the image.

This PHP code is a clear example of obfuscation, a technique often used in malicious attacks to hide the true purpose of the script. The variables appear to be assembling encoded or hidden strings, which are likely intended to execute harmful commands. This type of obfuscation is commonly found in webshells or backdoors, allowing attackers to gain unauthorized access to the server. It could also be part of a code injection attack, where external code is introduced and executed in the application, leading to potential data theft, server control, or further exploitation. The obfuscation makes it difficult to detect and analyze the true nature of the attack without decoding the strings.

 

[Fernando Rogerio]

Is changing laravel to add bootstrap 5 styles worth it?Is changing laravel to add bootstrap 5 styles worth it?Is changing laravel to add bootstrap 5 styles worth it?ual! muiot ok

 

[xtreme256]

Can't the javascript be used to execute php functions in the front end as well, recently got an attack on my server just after using a template from this forum, so i try to avoid php scripts

 

[nuxs]

Thanks for the quick check. Will avoid php script.

 

[FallenAngel]

Thanks for sharing this! Cheers mate!

 

[bordun]

Thank you! This is super helpful.