diff --git a/cms-ver.php b/cms-ver.php index 7c3f803..cb0b2ba 100644 --- a/cms-ver.php +++ b/cms-ver.php @@ -142,7 +142,6 @@ $versions = array( array("XMB", "/db/mysql.php", "* eXtreme Message Board"), // needs 2nd line too array("Dolphin", "/modules/boonex/news/install/config.php", "'compatible_with' => array("), // needs 2nd line too array("WebMail Lite", "/adminpanel/VERSION", "*"), // needs further review - array("DotProj", "/includes/version.php", "\$dp_version_major"), // needs two more lines array("PHPCollab", "/includes/settings.php", "# PhpCollab version"), // needs second line as well array("Admidio", "/adm_program/system/constants.php", "define('ADMIDIO_VERSION_MAIN',"), // needs two more lines array("Get Simple CMS", "/admin/inc/configuration.php", "\$site_full_name"), // needs one more line @@ -262,6 +261,7 @@ foreach(glob("../".$raw[1], GLOB_BRACE) as $versionfiles) { array("ZenCart", "/includes/version.php", "define('PROJECT_VERSION_NAME', 'Zen Cart');", "define('PROJECT_VERSION_MAJOR',", "define('PROJECT_VERSION_MINOR',"), array("Magento", "/app/Mage.php", "'major' =>", "'minor' =>", "'revision' =>"), array("AbanteCart", "/core/version.php", "define('MASTER_VERSION',", "define('MINOR_VERSION',", "define('VERSION_BUILT',"), + array("DotProj", "/includes/version.php", "\$dp_version_major", "\$dp_version_minor", "\$dp_version_patch"), ); diff --git a/malware5.pl b/malware5.pl index 64e5b41..1088a02 100644 --- a/malware5.pl +++ b/malware5.pl @@ -331,6 +331,10 @@ my @regexen = ( qr/<\?php\s+\$([A-z0-9]{1,20})\s+\=\"([A-z0-9]{1,20})\_\"\s+\;\$([A-z0-9]{1,20})\s+\=\s+strtoupper\(\$([A-z0-9]{1,20})\[\d\]\.\s+\$([A-z0-9]{1,20})\[\d\]\.\s+\$([A-z0-9]{1,20})\[\d\]\.\$([A-z0-9]{1,20})\[\d\]\.\s+\$([A-z0-9]{1,20})\[\d\]\s+\)\;\s+if\(\s+isset\(\s+\$\{\$([A-z0-9]{1,20})\}\[\s+\'([A-z0-9]{1,20})\'\s+\]\)\)\s+\{\s+eval\(\$\{\s+\$([A-z0-9]{1,20})\}\s+\[\s+\'([A-z0-9]{1,20})\'\s+\]\s+\)\s+\;\}\?>/is, qr/<\?php\s+\$([A-z0-9]{1,20})\s+\=.+?strtoupper\(\$([A-z0-9]{1,20})\[.+?isset\(.+?eval\(.+?\}\?>/is, qr/<\?php\s+\$([A-z0-9]{1,20})\=.+?strtoupper\(\$([A-z0-9]{1,20})\[.+?isset\(.+?eval\(.+?\}\?>/is, + qr/<\?php\s+\$.+?\'s\'\.\'t\'\.\'r\'\.\'r\'\.\'e\'\.\'v\'\;\$.+?array\(.+?eval.+?\?>/is, + qr/<\?php\s+\$([A-z0-9]{1,20}).+?strtoupper.+?isset\(.+?eval\(.+?\[\'([A-z0-9]{1,20})\'\].+?\?>/is, + qr/<\?php\s+\$.+?\'gzu\'.+?array\(.+?eval\(.+?\?>/is, + qr/<\?php\s+\$.+?\'bas\'.+?array\(.+?eval\(.+?\?>/is, ); diff --git a/malwaresh.pl b/malwaresh.pl index f59ec16..72012a8 100644 --- a/malwaresh.pl +++ b/malwaresh.pl @@ -812,7 +812,11 @@ my @regexen = ( qr/<\?php\s+\$([A-z0-9]{1,20})\s+\=\"([A-z0-9]{1,20})\_\"\s+\;\$([A-z0-9]{1,20})\s+\=\s+strtoupper\(\$([A-z0-9]{1,20})\[\d\]\.\s+\$([A-z0-9]{1,20})\[\d\]\.\s+\$([A-z0-9]{1,20})\[\d\]\.\$([A-z0-9]{1,20})\[\d\]\.\s+\$([A-z0-9]{1,20})\[\d\]\s+\)\;\s+if\(\s+isset\(\s+\$\{\$([A-z0-9]{1,20})\}\[\s+\'([A-z0-9]{1,20})\'\s+\]\)\)\s+\{\s+eval\(\$\{\s+\$([A-z0-9]{1,20})\}\s+\[\s+\'([A-z0-9]{1,20})\'\s+\]\s+\)\s+\;\}\?>/is, qr/<\?php\s+\$([A-z0-9]{1,20})\s+\=.+?strtoupper\(\$([A-z0-9]{1,20})\[.+?isset\(.+?eval\(.+?\}\?>/is, qr/<\?php\s+\$([A-z0-9]{1,20})\=.+?strtoupper\(\$([A-z0-9]{1,20})\[.+?isset\(.+?eval\(.+?\}\?>/is, - + qr/<\?php\s+\$.+?\'s\'\.\'t\'\.\'r\'\.\'r\'\.\'e\'\.\'v\'\;\$.+?array\(.+?eval.+?\?>/is, + qr/<\?php\s+\$([A-z0-9]{1,20}).+?strtoupper.+?isset\(.+?eval\(.+?\[\'([A-z0-9]{1,20})\'\].+?\?>/is, + qr/<\?php\s+\$.+?\'gzu\'.+?array\(.+?eval\(.+?\?>/is, + qr/<\?php\s+\$.+?\'bas\'.+?array\(.+?eval\(.+?\?>/is, + ); my @base64_decodes = (