Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

converted cms-ver.php back to web

Browse Source
This commit is contained in:
Palma Solutions LTD
2018-05-06 12:10:05 +02:00
parent 0a8f9bcef0
commit 1a1d952dd8
2 changed files with 25 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
cms-ver.php
View File

@@ -204,10 +204,10 @@ foreach(glob("../{**/*,*}".$row[1], GLOB_BRACE) as $versionfile){
$pattern = preg_quote($row[2], '/'); $pattern = preg_quote($row[2], '/');
$pattern = "/^.*$pattern.*\$/m"; $pattern = "/^.*$pattern.*\$/m";
if(preg_match_all($pattern, $file, $matches)){ if(preg_match_all($pattern, $file, $matches)){
echo "\n"; echo "<br />";
echo "\n".$row[0]." found - (".$row[3]."):\n"; echo "<br />".$row[0]." found - (".$row[3]."):<br />";
echo implode("\n", $matches[0]); echo implode("<br />", $matches[0]);
echo "\n"; echo "<br />";
$location = $versionfile; $location = $versionfile;
$trim = str_replace($row[1], '', $location); $trim = str_replace($row[1], '', $location);
print_r ("location:".$trim); print_r ("location:".$trim);
@@ -223,10 +223,10 @@ foreach(glob("../".$row[1], GLOB_BRACE) as $versionfile) {
$pattern = preg_quote($row[2], '/'); $pattern = preg_quote($row[2], '/');
$pattern = "/^.*$pattern.*\$/m"; $pattern = "/^.*$pattern.*\$/m";
if(preg_match_all($pattern, $file, $matches)){ if(preg_match_all($pattern, $file, $matches)){
echo "\n"; echo "<br />";
echo "\n".$row[0]." found - (".$row[3]."):\n"; echo "<br />".$row[0]." found - (".$row[3]."):<br />";
echo implode("\n", $matches[0]); echo implode("<br />", $matches[0]);
echo "\n"; echo "<br />";
$location = $versionfile; $location = $versionfile;
$trim = str_replace($row[1], '', $location); $trim = str_replace($row[1], '', $location);
print_r ("location:".$trim); print_r ("location:".$trim);
@@ -256,10 +256,10 @@ foreach(glob("../{**/*,*}".$raw[1], GLOB_BRACE) as $versionfiles){
$pattern2 = preg_quote($raw[3], '/'); $pattern2 = preg_quote($raw[3], '/');
$pattern = "/^.*$pattern1.*\$|^.*$pattern2.*\$/m"; $pattern = "/^.*$pattern1.*\$|^.*$pattern2.*\$/m";
if(preg_match_all($pattern, $file, $matches)){ if(preg_match_all($pattern, $file, $matches)){
echo "\n"; echo "<br />";
echo "\n".$raw[0]." found - (".$raw[4]."):\n"; echo "<br />".$raw[0]." found - (".$raw[4]."):<br />";
echo implode("\n", $matches[0]); echo implode("<br />", $matches[0]);
echo "\n"; echo "<br />";
$location = $versionfiles; $location = $versionfiles;
$trim = str_replace($raw[1], '', $location); $trim = str_replace($raw[1], '', $location);
print_r ("location:".$trim); print_r ("location:".$trim);
@@ -275,10 +275,10 @@ foreach(glob("../".$raw[1], GLOB_BRACE) as $versionfiles) {
$pattern2 = preg_quote($raw[3], '/'); $pattern2 = preg_quote($raw[3], '/');
$pattern = "/^.*$pattern1.*\$|^.*$pattern2.*\$/m"; $pattern = "/^.*$pattern1.*\$|^.*$pattern2.*\$/m";
if(preg_match_all($pattern, $file, $matches)){ if(preg_match_all($pattern, $file, $matches)){
echo "\n"; echo "<br />";
echo "\n".$raw[0]." found - (".$raw[4]."):\n"; echo "<br />".$raw[0]." found - (".$raw[4]."):<br />";
echo implode("\n", $matches[0]); echo implode("<br />", $matches[0]);
echo "\n"; echo "<br />";
$location = $versionfiles; $location = $versionfiles;
$trim = str_replace($raw[1], '', $location); $trim = str_replace($raw[1], '', $location);
print_r ("location:".$trim); } print_r ("location:".$trim); }
@@ -307,10 +307,10 @@ foreach(glob("../{**/*,*}".$rxw[1], GLOB_BRACE) as $versionfilex){
$pattern3 = preg_quote($rxw[4], '/'); $pattern3 = preg_quote($rxw[4], '/');
$pattern = "/^.*$pattern1.*\$|^.*$pattern2.*\$|^.*$pattern3.*\$/m"; $pattern = "/^.*$pattern1.*\$|^.*$pattern2.*\$|^.*$pattern3.*\$/m";
if(preg_match_all($pattern, $file, $matches)){ if(preg_match_all($pattern, $file, $matches)){
echo "\n"; echo "<br />";
echo "\n".$rxw[0]." found - (".$rxw[5]."):\n"; echo "<br />".$rxw[0]." found - (".$rxw[5]."):<br />";
echo implode("\n", $matches[0]); echo implode("<br />", $matches[0]);
echo "\n"; echo "<br />";
$location = $versionfilex; $location = $versionfilex;
$trim = str_replace($rxw[1], '', $location); $trim = str_replace($rxw[1], '', $location);
print_r ("location:".$trim); print_r ("location:".$trim);
@@ -327,10 +327,10 @@ foreach(glob("../".$rxw[1], GLOB_BRACE) as $versionfilex) {
$pattern3 = preg_quote($rxw[4], '/'); $pattern3 = preg_quote($rxw[4], '/');
$pattern = "/^.*$pattern1.*\$|^.*$pattern2.*\$|^.*$pattern3.*\$/m"; $pattern = "/^.*$pattern1.*\$|^.*$pattern2.*\$|^.*$pattern3.*\$/m";
if(preg_match_all($pattern, $file, $matches)){ if(preg_match_all($pattern, $file, $matches)){
echo "\n"; echo "<br />";
echo "\n".$rxw[0]." found - (".$row[5]."):\`"; echo "<br />".$rxw[0]." found - (".$row[5]."):\`";
echo implode("\n", $matches[0]); echo implode("<br />", $matches[0]);
echo "\n"; echo "<br />";
$location = $versionfilex; $location = $versionfilex;
$trim = str_replace($rxw[1], '', $location); $trim = str_replace($rxw[1], '', $location);
print_r ("location:".$trim); print_r ("location:".$trim);

2
malwaresh.pl
View File

@@ -26,6 +26,7 @@ print "Content-type: text/html\n\n";
my $user = $ARGV[0]; my $user = $ARGV[0];
my @regexen = ( my @regexen = (
qr/<\?php.+?\$([A-z0-9]{1,20})\=\(([0-9]{1,5})\-([0-9]{1,5})\)\;\s+\$([A-z0-9]{1,20})\=\$([A-z0-9]{1,20})\-1\;\s+\?>/is,
qr/<\?php\s+\$\{\"\\x47\\x4c\\x4fB\\x41\\x4c\\x53\"\}.+?exit\(\)\;\s+\}\Z/is, qr/<\?php\s+\$\{\"\\x47\\x4c\\x4fB\\x41\\x4c\\x53\"\}.+?exit\(\)\;\s+\}\Z/is,
qr/<\?php\s+\/\/header\(\'Content\-Type\:text\/html\;.+?\=array\(.+?\=urldecode\(.+?\)\;exit\(\)\;\}\'\)\;\$\{\"\\x47\\x4c\\x4f\\x42\\x41\\x4c\\x53\"\}.+?\]\(\)\;\?>/is, qr/<\?php\s+\/\/header\(\'Content\-Type\:text\/html\;.+?\=array\(.+?\=urldecode\(.+?\)\;exit\(\)\;\}\'\)\;\$\{\"\\x47\\x4c\\x4f\\x42\\x41\\x4c\\x53\"\}.+?\]\(\)\;\?>/is,
qr/<\?php.+?\$\{\"\\x47\\x4c\\x4fB\\x41\\x4c\\x53\"\}.+?\?>/is, qr/<\?php.+?\$\{\"\\x47\\x4c\\x4fB\\x41\\x4c\\x53\"\}.+?\?>/is,
@@ -935,7 +936,6 @@ my @regexen = (
qr/<\?php\s+Error\_Reporting\(E\_ALL.+?<title>FakeSender\s+by\s+POCT\s+\[FuckAV\.ru\]<\/title>.+?if\(mail\(\$to\,\s+\$subject\,\s+\$message\,\s+\$header\)\).+?\?>\s+<\/body>\s+<\/html>/is, qr/<\?php\s+Error\_Reporting\(E\_ALL.+?<title>FakeSender\s+by\s+POCT\s+\[FuckAV\.ru\]<\/title>.+?if\(mail\(\$to\,\s+\$subject\,\s+\$message\,\s+\$header\)\).+?\?>\s+<\/body>\s+<\/html>/is,
qr/<\?\s+eval\(gzinflate\(str\_rot13\(base64\_decode\(.+?\)\)\)\)\;\s+\?>/is, qr/<\?\s+eval\(gzinflate\(str\_rot13\(base64\_decode\(.+?\)\)\)\)\;\s+\?>/is,
qr/<\?php.+?\?>([A-z0-9]{1,20})\%([A-z0-9]{1,20})\%.+?\$([A-z0-9]{1,20})\=\$([A-z0-9]{1,20})\-1\;\s+\?>/is, qr/<\?php.+?\?>([A-z0-9]{1,20})\%([A-z0-9]{1,20})\%.+?\$([A-z0-9]{1,20})\=\$([A-z0-9]{1,20})\-1\;\s+\?>/is,
qr/<\?php.+?\$([A-z0-9]{1,20})\=\(([0-9]{1,5})\-([0-9]{1,5})\)\;\s+\$([A-z0-9]{1,20})\=\$([A-z0-9]{1,20})\-1\;\s+\?>/is,
); );