https://mikehorn-git.github.io/tags/php/ Recent content in Php on Mike.Horn Hugo en Sun, 29 Sep 2024 00:00:00 +0200 https://mikehorn-git.github.io/writeups/htb/challenges/obscure/ Sun, 29 Sep 2024 00:00:00 +0200 https://mikehorn-git.github.io/writeups/htb/challenges/obscure/ <h1 id="introduction">Introduction</h1> <p>We are provided with two files:</p> <ul> <li>A <strong>PCAP file</strong></li> <li>A <strong>PHP file</strong></li> </ul> <hr> <h1 id="pcap-analysis">PCAP Analysis</h1> <p>Start by analyzing the PCAP before fully deobfuscating <code>support.php</code>.</p> <p>Filter for <strong>HTTP POST</strong> requests:</p> <p><img alt="POST" loading="lazy" src="./assets/2024-09-28T23:17:53,862253486+02:00.png"></p> <p>Only <strong>4 POST requests</strong> are present.</p> <p>Follow the HTTP streams to inspect the payloads. You will observe obfuscated strings such as:</p> <blockquote> <p><code>0UlYyJHG87EJqEz66f8af44abea0QKxO/n6DAwXuGEoc5X9/H3HkMXv1Ih75Fx1NdSPRNDPUmHTy351039f4a7b5</code></p> </blockquote> <p><img alt="STREAM" loading="lazy" src="./assets/2024-09-28T23:22:19,040121186+02:00.png"></p> <p>These strings will be used as input for the PHP deobfuscation.</p> <hr> <h1 id="php-analysis">PHP Analysis</h1> <p>The provided PHP script performs multiple layers of obfuscation:</p>