Unraveling an obfuscated PHP web shell! Exploring web shells for malware anlaysis!

Web shells are often used to maintain access to a compromised web server. In this video, we'll explore another popular web shell called ORVX Shell v3. Our focus won't be so much on capabilities, but rather on deobfuscating the many layers of it's source code!
Cybersecurity, reverse engineering, malware analysis and ethical hacking content!
🎓 Courses on Pluralsight 👉🏻 www.pluralsight.com/authors/j...
🌶️ KZbin 👉🏻 Like, Comment & Subscribe!
🙏🏻 Support my work 👉🏻 / joshstroschein
🌎 Follow me 👉🏻 / jstrosch , / joshstroschein
⚙️ Tinker with me on Github 👉🏻 github.com/jstrosch
0:39 ORVX shell capabilities
2:03 Layer 1 of the obfuscation
3:04 Viewing the stages of the PHP code
3:30 Identifying EVALs, breaking up the code
3:45 Cyberchef to the rescue
4:23 Identifying the primary structure of the obfuscation
5:10 More EVALs, more obfuscation
5:44 Finding layer 2
8:48 Changes to the obfuscation
10:30 Devising a strategy
12:00 unPHP

[@ghazialkofahi6653]

great video, thank you josh

[@jstrosch]

Glad you liked it!

[@yurilsaps]

Amazing job, it’s so sad that blue team Chanel’s are so underrated

[@jstrosch]

Thanks for the feedback - if you have any suggestions for promo I’m all ears 🤓

[@aiexhibit]

Thanks Josh, that was a great explainer. I always get tripped up when trying to figure out the indexing locations. This will help me for sure.

[@jstrosch]

Great to hear!

[@sdfnz]

How does it get "substring" out of "rumbits" (around the 7 minute mark) ? Should it be "runbits" or am I misunderstanding what's going on? Either way, thanks for making this video!

[@jstrosch]

Great question! I misspoke a bit, it's "substr" not "substring" - www.php.net/manual/en/function.substr.php. Thanks for pointing that out! That's what I get for getting lazy :)