Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new patterns

Browse Source
This commit is contained in:
Palma Solutions LTD
2018-04-28 13:03:29 +02:00
parent 730226dfc2
commit 25b34c14c5
3 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cms-ver.php
View File

@@ -142,7 +142,6 @@ $versions = array(
array("XMB", "/db/mysql.php", "* eXtreme Message Board"), // needs 2nd line too
array("Dolphin", "/modules/boonex/news/install/config.php", "'compatible_with' => array("), // needs 2nd line too
array("WebMail Lite", "/adminpanel/VERSION", "*"), // needs further review
array("DotProj", "/includes/version.php", "\$dp_version_major"), // needs two more lines
array("PHPCollab", "/includes/settings.php", "# PhpCollab version"), // needs second line as well
array("Admidio", "/adm_program/system/constants.php", "define('ADMIDIO_VERSION_MAIN',"), // needs two more lines
array("Get Simple CMS", "/admin/inc/configuration.php", "\$site_full_name"), // needs one more line
@@ -262,6 +261,7 @@ foreach(glob("../".$raw[1], GLOB_BRACE) as $versionfiles) {
array("ZenCart", "/includes/version.php", "define('PROJECT_VERSION_NAME', 'Zen Cart');", "define('PROJECT_VERSION_MAJOR',", "define('PROJECT_VERSION_MINOR',"),
array("Magento", "/app/Mage.php", "'major' =>", "'minor' =>", "'revision' =>"),
array("AbanteCart", "/core/version.php", "define('MASTER_VERSION',", "define('MINOR_VERSION',", "define('VERSION_BUILT',"),
array("DotProj", "/includes/version.php", "\$dp_version_major", "\$dp_version_minor", "\$dp_version_patch"),
);

4
malware5.pl
View File

@@ -331,6 +331,10 @@ my @regexen = (
qr/<\?php\s+\$([A-z0-9]{1,20})\s+\=\"([A-z0-9]{1,20})\_\"\s+\;\$([A-z0-9]{1,20})\s+\=\s+strtoupper\(\$([A-z0-9]{1,20})\[\d\]\.\s+\$([A-z0-9]{1,20})\[\d\]\.\s+\$([A-z0-9]{1,20})\[\d\]\.\$([A-z0-9]{1,20})\[\d\]\.\s+\$([A-z0-9]{1,20})\[\d\]\s+\)\;\s+if\(\s+isset\(\s+\$\{\$([A-z0-9]{1,20})\}\[\s+\'([A-z0-9]{1,20})\'\s+\]\)\)\s+\{\s+eval\(\$\{\s+\$([A-z0-9]{1,20})\}\s+\[\s+\'([A-z0-9]{1,20})\'\s+\]\s+\)\s+\;\}\?>/is,
qr/<\?php\s+\$([A-z0-9]{1,20})\s+\=.+?strtoupper\(\$([A-z0-9]{1,20})\[.+?isset\(.+?eval\(.+?\}\?>/is,
qr/<\?php\s+\$([A-z0-9]{1,20})\=.+?strtoupper\(\$([A-z0-9]{1,20})\[.+?isset\(.+?eval\(.+?\}\?>/is,
qr/<\?php\s+\$.+?\'s\'\.\'t\'\.\'r\'\.\'r\'\.\'e\'\.\'v\'\;\$.+?array\(.+?eval.+?\?>/is,
qr/<\?php\s+\$([A-z0-9]{1,20}).+?strtoupper.+?isset\(.+?eval\(.+?\[\'([A-z0-9]{1,20})\'\].+?\?>/is,
qr/<\?php\s+\$.+?\'gzu\'.+?array\(.+?eval\(.+?\?>/is,
qr/<\?php\s+\$.+?\'bas\'.+?array\(.+?eval\(.+?\?>/is,
);

6
malwaresh.pl
View File

@@ -812,7 +812,11 @@ my @regexen = (
qr/<\?php\s+\$([A-z0-9]{1,20})\s+\=\"([A-z0-9]{1,20})\_\"\s+\;\$([A-z0-9]{1,20})\s+\=\s+strtoupper\(\$([A-z0-9]{1,20})\[\d\]\.\s+\$([A-z0-9]{1,20})\[\d\]\.\s+\$([A-z0-9]{1,20})\[\d\]\.\$([A-z0-9]{1,20})\[\d\]\.\s+\$([A-z0-9]{1,20})\[\d\]\s+\)\;\s+if\(\s+isset\(\s+\$\{\$([A-z0-9]{1,20})\}\[\s+\'([A-z0-9]{1,20})\'\s+\]\)\)\s+\{\s+eval\(\$\{\s+\$([A-z0-9]{1,20})\}\s+\[\s+\'([A-z0-9]{1,20})\'\s+\]\s+\)\s+\;\}\?>/is,
qr/<\?php\s+\$([A-z0-9]{1,20})\s+\=.+?strtoupper\(\$([A-z0-9]{1,20})\[.+?isset\(.+?eval\(.+?\}\?>/is,
qr/<\?php\s+\$([A-z0-9]{1,20})\=.+?strtoupper\(\$([A-z0-9]{1,20})\[.+?isset\(.+?eval\(.+?\}\?>/is,
qr/<\?php\s+\$.+?\'s\'\.\'t\'\.\'r\'\.\'r\'\.\'e\'\.\'v\'\;\$.+?array\(.+?eval.+?\?>/is,
qr/<\?php\s+\$([A-z0-9]{1,20}).+?strtoupper.+?isset\(.+?eval\(.+?\[\'([A-z0-9]{1,20})\'\].+?\?>/is,
qr/<\?php\s+\$.+?\'gzu\'.+?array\(.+?eval\(.+?\?>/is,
qr/<\?php\s+\$.+?\'bas\'.+?array\(.+?eval\(.+?\?>/is,
);
my @base64_decodes = (