4014f414dc
Example usage: I want to see if a giant block of base64 code contains any references to the string 'base64'. The naive approach is to convert the string to it's base64 equivalent, YmFzZTY0. There are two problems with this approach. The first is that the string will be different depending on the position of the first character 'Y' in the input string. Possible offents are 0 bits, 2 bits or 4 bits. The above example only calculates the 0 bit offset. There should be 3 separate base64 strings to look for. The second problem is that base64 strings use a 6 bit encoding, so the characters don't align the same as 8 bit encoding. This leads to character bleeding at the beginning and ends of a string where the string will change depending on its immediate context. This script calculates the maximum constant string length that should be present. Unfortunately it requires trimming characters which can often lead to very short strings.
PHP malware scanner
Traversing directories for files with php extensions and testing files against text or regexp rules, the rules based on self gathered samples and publicly vailable malwares/webshells. The goal is to find infected files and fight against kiddies, because to easy to bypass rules.
How to use?
$ php ./scan.php -h
Usage scan.php -d <directory> [-i=<directory|file>] [-e=.php] [--hide-ok] [--hide-whitelist]
-d Directory for searching
-e=.php Extension
-i=<directory|file> Directory of file to igonre
--hide-ok Hide OK aka not infected messages
--hide-whitelist Hide whitelisted messages
--extra-check Adds GoogleBot and htaccess to Scan List
--follow-symlink Follow symlinked directories
Ignore argument could be used multiple times and accept glob style matching ex.: "cache*", "??-cache.php" or "/cache" etc.
Patterns
There are two different pattern source, each line in these files is a patter so patterns_raw.txt lines searched as-is, patterns_re.txt used with preg_match function.
Whitelisting
See whitelist.txt file for a predefined MD5 hash list. Only the first 32 characters are used, rest of the line ignored so feel free to leave a comment.
Resources
- PHPScanner
- PMF - PHP Malware Finder
- check regexp online
- malware samples 1
- malware samples 2
- malware samples 3
- malware samples 4
Licensing
PHP malware scanner is licensed under the GNU General Public License v3.