{"id":103,"date":"2023-04-20T04:20:00","date_gmt":"2023-04-20T08:20:00","guid":{"rendered":"https:\/\/bthrx.com\/?p=103"},"modified":"2024-02-13T15:50:36","modified_gmt":"2024-02-13T20:50:36","slug":"happy-holidays-marijuana-php-shell-reversing","status":"publish","type":"post","link":"https:\/\/bthrx.com\/index.php\/2023\/04\/20\/happy-holidays-marijuana-php-shell-reversing\/","title":{"rendered":"Happy Holidays: MARIJUANA.php shell reversing"},"content":{"rendered":"\n

Let’s celebrate by taking a deep look at MARIJUANA.php. The original repo is here:
https:\/\/github.com\/0x5a455553\/MARIJUANA<\/a>
and we will be looking at this version here:
https:\/\/bazaar.abuse.ch\/sample\/e5fb647c470f21d5714601417768873a928f4741063fd86e4d696239eb78bf06<\/a><\/p>\n\n\n\n

RE time<\/h2>\n\n\n\n

First take a look at the original release. This will give us a baseline to figure out what has been obfuscated and changed in recent versions.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n


On the left I’ve opened the github release, and on the right we have the sample we are investigating. The goal is to get our sample to where it resembles the baseline release and then we will dig into the functionality of the php shell.<\/p>\n\n\n\n

The sample we are looking at is a series of charcodes. Using Cyber Chef (https:\/\/gchq.github.io\/CyberChef\/) we can quickly get some readable code from it. The recipe to deobfuscate the charcode to readable php is From Charcode, set the delimiter to comma, and change it from the default base 16 to base 10. This is because Javascript charcodes are represented in base 10.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Looking at the newly readable php code a few things stick out.
First we have an attempt to make the script look less conspicuous if you come across it by suppressing errors and bypass any buffering delays by setting the display_errors to 0 and output_buffering to 0.<\/p>\n\n\n\n

The next obvious thing is the variable $heker<\/code> which is set to a long, obfuscated string.
And lastly, we have an eval<\/code> statement using a long chain of encodings that is run on the $heker<\/code> variable.<\/p>\n\n\n\n

@eval(base64_decode(gzinflate(str_rot13(convert_uudecode(gzinflate(base64_decode(gzinflate(str_rot13(convert_uudecode(gzinflate(base64_decode($heker))))))))))));\nexit;<\/code><\/pre>\n\n\n\n
Rather than recreate the deobfuscation order of this code in Cyber Chef, we will change the eval<\/code> to echo<\/code> and direct it to a new file. We also need to fix the apostrophes on the @ini_set<\/code> functions or just delete them. They should read like this:<\/p>\n\n\n\n
@ini_set('output_buffering',0); \n@ini_set('display_errors', 0);<\/code><\/pre>\n\n\n\n
Then we will run the php script but make absolutely certain that you have saved your change of @eval<\/code> to echo<\/code>.<\/p>\n\n\n\n
php marijuana.php > marijuana_string_deobf.php<\/code><\/pre>\n\n\n\n
Now the php script is in a state where it resembles the original release of the Marijuana.php shell on github, as well as some interesting variables that set up a call back to an email. <\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
When the shell is accessed, it sends an email with the URL of the script and the IP of the visitor. This suggests the attacker is keeping track of when and where their web shell is being accessed.<\/p>\n\n\n\n
At this point, the deobfuscated sample now looks similar to the original released version. In this guide we will continue to deobfuscate the web shell to gain a deeper understanding of the obfuscation techniques, however at this point you have enough information to begin to clean up and understand how the compromise occurred. I will cover this at the end but please feel free to skip ahead.<\/p>\n\n\n\n
Hex-code arrays<\/h2>\n\n\n\n
Looking at the deobfuscated script now, we have a variable named $Array<\/code> which contains an array of hex strings. Further down we fund a variable named $___ that iterates through $Array<\/code>. After that it uses uhex<\/code> which almost certainly takes the hex string and turns it back into readable text. The result of which is stored in the $GNJ<\/code> array.<\/p>\n\n\n\n
$___ = count ($Array);\nfor ($i=0;$i<$___;$i++) {\n     $GNJ [] = uhex($Array[$i]);\n}<\/code><\/pre>\n\n\n\n
Let’s take a closer look at what uhex is doing. <\/p>\n\n\n\n
function uhex ($y) {\n     $n='';\n     for ($i=0; $i < strlen($y) 1; $i +=2) {\n         $n .= chr(hexdec($y[$i].$y[$i+1]));\n     }\n     return $n;\n}<\/code><\/pre>\n\n\n\n
Indeed uhex is taking the hex strings and decoding them. Let’s decode them and see what they are. We will do this by simply copying the relevant code to a new php script.<\/p>\n\n\n\n
<?php\n$Array = [\n\t\t'7068705f756e616d65',\n...\n];\n$decodedArray = [];\n$decode = count($Array);\nfor ($i=0;$i<$decode;$i++){\n  $decodedArray[] = uhex($Array[$i]);\n}\necho implode(\"\\n\", $decodedArray);\nfunction uhex($y){\n  $n='';\n  for ($i=0;$i < strlen($y)-1; $i+=2){\n    $n .= chr(hexdec($y[$i].$y[$i+1]));\n  }\n  return $n;\n}\n?><\/code><\/pre>\n\n\n\n
Now lets take a look at the results:<\/p>\n\n\n\n
php_uname\nphpversion\nchdir\ngetcwd\npreg_split\ncopy\nfile_get_contents\nbase64_decode\nis_dir\nob_end_clean();\nunlink\nmkdir\nchmod\nscandir\nstr_replace\nhtmlspecialchars\nvar_dump\nfopen\nfwrite\nfclose\ndate\nfilemtime\nsubstr\nsprintf\nfileperms\ntouch\nfile_exists\nrename\nis_array\nis_object\nstrpos\nis_writable\nis_readable\nstrtotime\nfilesize\nrmdir\nob_get_clean\nreadfile\nassert<\/code><\/pre>\n\n\n\n
Oof. All kinds of dangerous commands making a well featured web shell.<\/p>\n\n\n\n
Moving further through we get to the html that renders when the web shell is accessed. We get a good indicator of compromise to make an alert for. The shell takes the icon and css file from the original github release. <\/p>\n\n\n\n
<link rel=\"icon\" href=\"\/\/0x5a455553.github.io\/MARIJUANA\/icon.png\" \/>\n<link rel=\"stylesheet\" href=\"\/\/0x5a455553.github.io\/MARIJUANA\/main.css\" type=\"text\/css\"><\/code><\/pre>\n\n\n\n
The rest of the script is mechanics to process queries added to the url, which the requests are formed by the web shell, but you could also directly send to the path of the web shell. <\/p>\n\n\n\n

The “MARIJUANA” web shell provides a range of features and functions that can be used by attackers for various purposes. These functions include file manipulation (uploading, renaming, removing), execution of commands (such as chmod and unzip), and manipulating file timestamps.<\/p>\n\n\n\n
Cleaning up and finding the source of compromise<\/h2>\n\n\n\n
In order to clean up this malware, first you’ll want to immediately remove the charcode file. You’ll want to check logs for access to the path of the web shell which will reveal which commands it has executed and undo them. Then you’ll need to put some thought into how the compromise occurred. Here are some things to consider:

Think about what the file looked like to begin with, a series of charcodes in a file. How would the attacker execute the php out of the charcode? <\/p>\n\n\n\n
There is likely an insecure use of eval() that is accepting user input allowing the attacker to take the charcode and execute the php script inside. Other insecure functions to look out for are system()<\/code>, exec()<\/code>, passthru()<\/code>, and shell_exec()<\/code>.

Think about anywhere the web application accepts uploads, what protections are in place there?<\/p>\n\n\n\n
To prevent this, the application should have protections in place such as checking the file type and size, renaming the file, and storing the file in a location that’s not directly accessible via the web.<\/p>\n","protected":false},"excerpt":{"rendered":"
Let’s celebrate by taking a deep look at MARIJUANA.php. The original repo is here:https:\/\/github.com\/0x5a455553\/MARIJUANA and we will be looking at…<\/span> Continue Reading... \"Happy Holidays: MARIJUANA.php shell reversing\"<\/span><\/a><\/span><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[2],"tags":[18,16,11,17,13],"class_list":["post-103","post","type-post","status-publish","format-standard","hentry","category-reversing","tag-obfuscation-techniques","tag-php","tag-reverse-engineering","tag-web-shell","tag-write-up","no-post-thumbnail"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/bthrx.com\/index.php\/wp-json\/wp\/v2\/posts\/103","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bthrx.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bthrx.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bthrx.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/bthrx.com\/index.php\/wp-json\/wp\/v2\/comments?post=103"}],"version-history":[{"count":5,"href":"https:\/\/bthrx.com\/index.php\/wp-json\/wp\/v2\/posts\/103\/revisions"}],"predecessor-version":[{"id":142,"href":"https:\/\/bthrx.com\/index.php\/wp-json\/wp\/v2\/posts\/103\/revisions\/142"}],"wp:attachment":[{"href":"https:\/\/bthrx.com\/index.php\/wp-json\/wp\/v2\/media?parent=103"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bthrx.com\/index.php\/wp-json\/wp\/v2\/categories?post=103"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bthrx.com\/index.php\/wp-json\/wp\/v2\/tags?post=103"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}