Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new patterns

Browse Source
This commit is contained in:
Palma Solutions LTD
2018-06-17 07:51:55 +02:00
parent 27907d6fbe
commit 36ad688697
2 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
malware6.pl
View File

@@ -212,7 +212,13 @@ my @regexen = (
qr/<\?php error_reporting\(0\);if\(isset\(\$_POST\[\"\w\"\]\) and isset\(\$_POST\[\"\w\"\]\)\)\{if\(isset\(\$_POST\[\"input\"\]\)\)\{\$user_auth=\"&l=\"\.base64_encode\(\$_POST\[\"\w\"\]\).+?\{print \"sys_active\"\.\`uname -a\`;\}\} \?>/is,
qr/<\?php \$([A-z0-9_]{1,20})=\'base\'\.\(32*2\)\.\'_de\'\.\'code\';\$([A-z0-9_]{1,20})=\$([A-z0-9_]{1,20})\(str_replace\(\"\\n\", \'\', \'([A-z0-9_]{20,}).+?<form action=\"\" method=\"post\"><input type=\"text\" name=\"([A-z0-9_]{1,20})\" value=\"\"\/><input type=\"submit\" value=\"&gt;\"\/><\/form>/is,
qr/<\?php.+?\$xml = \$\w->response->asXML\(\);\s+echo base64_encode\(\$xml\);.+?\$xml_str = base64_decode\(\$str\);.+?echo \" error num: \"\.\$errno\.\' : \'\.\$errstr;\s+\}\s+\}\s+\}\s+\?>/is,
qr/\/\/([A-z0-9_+/]{500,})\Z/is,
qr/\/\/([A-z0-9+\/]{500,})\Z/is,
qr/<\?php\s+\$([A-z0-9_]{1,20})=\'([A-z0-9_]{1,20}).+?([A-z0-9_]{1,20})\*\/\$([A-z0-9_]{1,20})\)eval\(\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\)\).+?([A-z0-9_]{1,20});([A-z0-9_]{1,20})\';/is,
qr/<\?php.+?\$login=\"([A-z0-9_]{1,20})\";\s+\$md=str_rot13\(\"([A-z0-9_]{1,20})\"\);\s+\$mdh = str_rot13\(\'([A-z0-9_]{1,20})\'\);\s+\$md5_pass=\"([A-z0-9]{32})\";.+?eval\(\$mdh\(\$md\(strrev\(.+?\s+\?>/is,
qr/<\?php\s+\$([A-z0-9_]{1,20})=\'([A-z0-9_]{1,20})\'.+?exit,\$([A-z0-9_]{1,20})\);eval\(\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\)\).+?([A-z0-9_]{1,20})\)\';/is,
qr/<\?php\s+\$([A-z0-9_]{1,20})=\'([A-z0-9_]{1,20})\'.+?\$([A-z0-9_]{1,20})\)\)die;eval\(\$([A-z0-9_]{1,20})\(\/\*([A-z0-9_]{1,20})\'\..+?\(([A-z0-9_]{1,20})\)\';/is,
qr/<\?php\s+\$([A-z0-9_]{1,20})=\'([A-z0-9_]{1,20})\'.+?if\(!\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\)\),\$([A-z0-9_]{1,20})\)\)eval\(\$([A-z0-9_]{1,20})\(\$.+?\(([A-z0-9_]{1,20});([A-z0-9_]{1,20}),([A-z0-9_]{1,20})\';/is,
qr/<\?php\s+\$([A-z0-9_]{1,20})=\'([A-z0-9_]{1,20})\'.+?\)eval\(\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\)\);.+?([A-z0-9_]{1,20})\';/is,

8
malwaresh.pl
View File

@@ -1199,7 +1199,13 @@ my @regexen = (
qr/<\?php error_reporting\(0\);if\(isset\(\$_POST\[\"\w\"\]\) and isset\(\$_POST\[\"\w\"\]\)\)\{if\(isset\(\$_POST\[\"input\"\]\)\)\{\$user_auth=\"&l=\"\.base64_encode\(\$_POST\[\"\w\"\]\).+?\{print \"sys_active\"\.\`uname -a\`;\}\} \?>/is,
qr/<\?php \$([A-z0-9_]{1,20})=\'base\'\.\(32*2\)\.\'_de\'\.\'code\';\$([A-z0-9_]{1,20})=\$([A-z0-9_]{1,20})\(str_replace\(\"\\n\", \'\', \'([A-z0-9_]{20,}).+?<form action=\"\" method=\"post\"><input type=\"text\" name=\"([A-z0-9_]{1,20})\" value=\"\"\/><input type=\"submit\" value=\"&gt;\"\/><\/form>/is,
qr/<\?php.+?\$xml = \$\w->response->asXML\(\);\s+echo base64_encode\(\$xml\);.+?\$xml_str = base64_decode\(\$str\);.+?echo \" error num: \"\.\$errno\.\' : \'\.\$errstr;\s+\}\s+\}\s+\}\s+\?>/is,
qr/\/\/([A-z0-9_+/]{500,})\Z/is,
qr/\/\/([A-z0-9+\/]{500,})\Z/is,
qr/<\?php\s+\$([A-z0-9_]{1,20})=\'([A-z0-9_]{1,20}).+?([A-z0-9_]{1,20})\*\/\$([A-z0-9_]{1,20})\)eval\(\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\)\).+?([A-z0-9_]{1,20});([A-z0-9_]{1,20})\';/is,
qr/<\?php.+?\$login=\"([A-z0-9_]{1,20})\";\s+\$md=str_rot13\(\"([A-z0-9_]{1,20})\"\);\s+\$mdh = str_rot13\(\'([A-z0-9_]{1,20})\'\);\s+\$md5_pass=\"([A-z0-9]{32})\";.+?eval\(\$mdh\(\$md\(strrev\(.+?\s+\?>/is,
qr/<\?php\s+\$([A-z0-9_]{1,20})=\'([A-z0-9_]{1,20})\'.+?exit,\$([A-z0-9_]{1,20})\);eval\(\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\)\).+?([A-z0-9_]{1,20})\)\';/is,
qr/<\?php\s+\$([A-z0-9_]{1,20})=\'([A-z0-9_]{1,20})\'.+?\$([A-z0-9_]{1,20})\)\)die;eval\(\$([A-z0-9_]{1,20})\(\/\*([A-z0-9_]{1,20})\'\..+?\(([A-z0-9_]{1,20})\)\';/is,
qr/<\?php\s+\$([A-z0-9_]{1,20})=\'([A-z0-9_]{1,20})\'.+?if\(!\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\)\),\$([A-z0-9_]{1,20})\)\)eval\(\$([A-z0-9_]{1,20})\(\$.+?\(([A-z0-9_]{1,20});([A-z0-9_]{1,20}),([A-z0-9_]{1,20})\';/is,
qr/<\?php\s+\$([A-z0-9_]{1,20})=\'([A-z0-9_]{1,20})\'.+?\)eval\(\$([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\)\);.+?([A-z0-9_]{1,20})\';/is,
);