diff --git a/cms-ver.php b/cms-ver.php index c050925..7ae97e5 100644 --- a/cms-ver.php +++ b/cms-ver.php @@ -22,6 +22,7 @@ array("phpBB", "/includes/constants.php", "define('PHPBB_VERSION',", "Maintained"), array("SMF", "/index.php", "\$forum_version = 'SMF", "Maintained"), array("Gallery", "/modules/gallery/helpers/gallery.php", "const VERSION =", "EOL"), + array("Gallery2", "/modules/core/module.inc", "\$this->setGalleryVersion(", "EOL"), array("Coppermine", "/versioncheck.inc.php", "Coppermine version:", ""), array("4images", "/includes/constants.php", "define('SCRIPT_VERSION',", ""), array("MediaWiki", "/includes/DefaultSettings.php", "\$wgVersion =", ""), @@ -163,7 +164,7 @@ array("phpMyAdmin", "/libraries/Config.php", "\$this->set('PMA_VERSION',", "Not Allowed"), array("phpMyAdmin", "/libraries/Config.class.php", "\$this->set('PMA_VERSION',", "Not Allowed"), array("CubeCart", "/ini.inc.php", "define('CC_VERSION',", "Maintained"), - + // still need to work on these array("Silverstripe", "/cms/silverstripe_version", "*"), //needs review array("Croogo", "/Vendor/croogo/croogo/VERSION.txt", "*"), // needs further review diff --git a/cms-vss.php b/cms-vss.php index ce552b5..bb619c3 100644 --- a/cms-vss.php +++ b/cms-vss.php @@ -28,7 +28,8 @@ array("osCommerce", "/includes/application_top.php", "define('PROJECT_VERSION', 'osCommerce Online Merchant", "Maintained"), array("phpBB", "/includes/constants.php", "define('PHPBB_VERSION',", "Maintained"), array("SMF", "/index.php", "\$forum_version = 'SMF", "Maintained"), - array("Gallery", "/modules/gallery/helpers/gallery.php", "const VERSION =", "EOL"), + array("Gallery2", "/modules/gallery/helpers/gallery.php", "const VERSION =", "EOL"), + array("Gallery2", "/modules/core/module.inc", "\$this->setGalleryVersion(", "EOL"), array("Coppermine", "/versioncheck.inc.php", "Coppermine version:", ""), array("4images", "/includes/constants.php", "define('SCRIPT_VERSION',", ""), array("MediaWiki", "/includes/DefaultSettings.php", "\$wgVersion =", ""), diff --git a/malware5.pl b/malware5.pl index ed5c073..2b2fca9 100644 --- a/malware5.pl +++ b/malware5.pl @@ -475,6 +475,7 @@ my @regexen = ( qr/<\?\s+\$buffer\s+\=.+?\$buffer\.\=.+?\$newphrase\=str\_replace\(.+?eval\(\$\_\w\(\$newphrase\)\)\;\s+\?>/is, qr/<\?pHp\s+\$([A-z0-9]{1,20})\s+\=\s+urldecode\(\$\_GET\[\'\w\'\]\)\;\s+\@ini\_set\(\'output\_buffering\'\,0\)\;\s+\@ini\_set\(\'display\_errors\'\,\s+0\)\;\s+\$auth\_pass\s+\=\s+\"([A-z0-9]{32})\"\;\s+\$([A-z0-9]{1,20})\s+\=\s+file\_get\_contents\(\$([A-z0-9]{1,20})\)\;\s+eval\(\$([A-z0-9]{1,20})\)\;\s+\?>/is, qr/<\?php.+?function\s+ASGLogin\(\)\s+\{.+?if\s+\(empty\(\$tmpdir\)\).+?<\/html><\?php\s+chdir\(\$lastdir\)\;\s+\?>/is, + qr/<\?php.+?str\_replace\(\"j\"\,\"\"\,\"sjtrj\_jrjejpljajcje\"\)\;.+?\(\"i\"\,\s+\"\"\,\s+\"ibiaisie6i4i\_dieicoide\"\)\;.+?\(\"k\"\,\"\"\,\"crkekatkek\_kfkukncktkikon\"\)\;.+?\(\)\;\s+\?>/is, ); diff --git a/malwaresh.pl b/malwaresh.pl index 493f2f2..2284fc6 100644 --- a/malwaresh.pl +++ b/malwaresh.pl @@ -958,7 +958,7 @@ my @regexen = ( qr/<\?\s+\$buffer\s+\=.+?\$buffer\.\=.+?\$newphrase\=str\_replace\(.+?eval\(\$\_\w\(\$newphrase\)\)\;\s+\?>/is, qr/<\?pHp\s+\$([A-z0-9]{1,20})\s+\=\s+urldecode\(\$\_GET\[\'\w\'\]\)\;\s+\@ini\_set\(\'output\_buffering\'\,0\)\;\s+\@ini\_set\(\'display\_errors\'\,\s+0\)\;\s+\$auth\_pass\s+\=\s+\"([A-z0-9]{32})\"\;\s+\$([A-z0-9]{1,20})\s+\=\s+file\_get\_contents\(\$([A-z0-9]{1,20})\)\;\s+eval\(\$([A-z0-9]{1,20})\)\;\s+\?>/is, qr/<\?php.+?function\s+ASGLogin\(\)\s+\{.+?if\s+\(empty\(\$tmpdir\)\).+?<\/html><\?php\s+chdir\(\$lastdir\)\;\s+\?>/is, - + qr/<\?php.+?str\_replace\(\"j\"\,\"\"\,\"sjtrj\_jrjejpljajcje\"\)\;.+?\(\"i\"\,\s+\"\"\,\s+\"ibiaisie6i4i\_dieicoide\"\)\;.+?\(\"k\"\,\"\"\,\"crkekatkek\_kfkukncktkikon\"\)\;.+?\(\)\;\s+\?>/is, ); my @base64_decodes = (