5.149.250.194-2018-03-14a

Amusingly encoded WSO 2.5 Web shell

WSO web shell downloaded via a WSO web shell. This has occurred before, in fact this WSO is from the same IP address, but the method of obfuscation is novel, and different than the previous WSO.

Origin

IP Address 5.149.250.194

No DNS name for 5.149.250.194

whois says 5.149.250.194 belongs to a Bulgarian network:

address:        4000, Bulgaria, Plovdiv, 2 Lyuben Karavelov, unit 5
phone:          +35932571279
nic-hdl:        VD3206-RIPE
mnt-by:         HZ-HOSTING-LTD
route:          5.149.250.0/23
descr:          HZ-HOSTING-LTD
origin:         AS61046
mnt-by:         HZ-HOSTING-LTD
created:        2013-03-05T14:08:17Z
last-modified:  2016-11-28T19:10:21Z

Download

The attacker downloaded a file wp-sss.php to an instance of a WordPress honey pot's WSO web shell emulation. The download happened via the "FilesMan" action, "uploadFile" sub-action. This is a pretty common way to send a file through Web Shell by oRb.

Decoding

1. Edit file 5.149.250.194WqktwuMePafnXJA4zqY9dQAAAAg.0.file into file dc1.php. This changes "eval" to "print"
2. Execute a 2-layer decoding by invoking php dc1.php > dc2.php
   1. gzinflate(base64_decode(...)) - decompress some Base64-encoded bytes.
   2. Subtract one from every byte value in the decompressed bytes: $NVAR[$i] = chr(ord($NVAR[$i])-1); Unfortunately, the deobfuscated code in dc2.php just reveals another layer of obfuscation.
3. Hand-edit dc2.php into dc3.php
4. Comment out line 2 (the "eval") from dc3.php.
5. Run reverse engineering tool over dc3.php to get dc4.php
6. Edit dc3.php and dc4.php to get dc5.php. dc5.php should just end up printing out the un-obfuscated code.
7. Invoke php dc5.php > dc6.php
8. Pretty print dc6.php into dc7.php

dc6.php is probably the original code, but dc7.php is more legible.

Analysis

It looks like someone took an already-obfuscated version of WSO 2.5, wrapped that in a test (if (isset($_GET['ina'])) { ... }), then inserted a check on "Referer:" HTTP headers. If the request for the WSO file is refered from Google or Bing or AOL or Yahoo or any other Big Search company, you get redirected to http://chilli-recipes.com/administrator/includes/joomla.php

If you don't get redirected, you have to know to call the WSO URL with an HTTP GET parameter "ina", or else you get nothing. Get past "ina", and you have to use the usual WSO password-only authentication.