Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new patterns, added Gallery2 new match

Browse Source
This commit is contained in:
Palma Solutions LTD
2018-05-09 11:23:48 +02:00
parent e9bd670d51
commit 4af6f2efaa
4 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
cms-ver.php
View File

@@ -22,6 +22,7 @@
array("phpBB", "/includes/constants.php", "define('PHPBB_VERSION',", "Maintained"), array("phpBB", "/includes/constants.php", "define('PHPBB_VERSION',", "Maintained"),
array("SMF", "/index.php", "\$forum_version = 'SMF", "Maintained"), array("SMF", "/index.php", "\$forum_version = 'SMF", "Maintained"),
array("Gallery", "/modules/gallery/helpers/gallery.php", "const VERSION =", "EOL"), array("Gallery", "/modules/gallery/helpers/gallery.php", "const VERSION =", "EOL"),
array("Gallery2", "/modules/core/module.inc", "\$this->setGalleryVersion(", "EOL"),
array("Coppermine", "/versioncheck.inc.php", "Coppermine version:", ""), array("Coppermine", "/versioncheck.inc.php", "Coppermine version:", ""),
array("4images", "/includes/constants.php", "define('SCRIPT_VERSION',", ""), array("4images", "/includes/constants.php", "define('SCRIPT_VERSION',", ""),
array("MediaWiki", "/includes/DefaultSettings.php", "\$wgVersion =", ""), array("MediaWiki", "/includes/DefaultSettings.php", "\$wgVersion =", ""),

3
cms-vss.php
View File

@@ -28,7 +28,8 @@
array("osCommerce", "/includes/application_top.php", "define('PROJECT_VERSION', 'osCommerce Online Merchant", "Maintained"), array("osCommerce", "/includes/application_top.php", "define('PROJECT_VERSION', 'osCommerce Online Merchant", "Maintained"),
array("phpBB", "/includes/constants.php", "define('PHPBB_VERSION',", "Maintained"), array("phpBB", "/includes/constants.php", "define('PHPBB_VERSION',", "Maintained"),
array("SMF", "/index.php", "\$forum_version = 'SMF", "Maintained"), array("SMF", "/index.php", "\$forum_version = 'SMF", "Maintained"),
array("Gallery", "/modules/gallery/helpers/gallery.php", "const VERSION =", "EOL"), array("Gallery2", "/modules/gallery/helpers/gallery.php", "const VERSION =", "EOL"),
array("Gallery2", "/modules/core/module.inc", "\$this->setGalleryVersion(", "EOL"),
array("Coppermine", "/versioncheck.inc.php", "Coppermine version:", ""), array("Coppermine", "/versioncheck.inc.php", "Coppermine version:", ""),
array("4images", "/includes/constants.php", "define('SCRIPT_VERSION',", ""), array("4images", "/includes/constants.php", "define('SCRIPT_VERSION',", ""),
array("MediaWiki", "/includes/DefaultSettings.php", "\$wgVersion =", ""), array("MediaWiki", "/includes/DefaultSettings.php", "\$wgVersion =", ""),

1
malware5.pl
View File

@@ -475,6 +475,7 @@ my @regexen = (
qr/<\?\s+\$buffer\s+\=.+?\$buffer\.\=.+?\$newphrase\=str\_replace\(.+?eval\(\$\_\w\(\$newphrase\)\)\;\s+\?>/is, qr/<\?\s+\$buffer\s+\=.+?\$buffer\.\=.+?\$newphrase\=str\_replace\(.+?eval\(\$\_\w\(\$newphrase\)\)\;\s+\?>/is,
qr/<\?pHp\s+\$([A-z0-9]{1,20})\s+\=\s+urldecode\(\$\_GET\[\'\w\'\]\)\;\s+\@ini\_set\(\'output\_buffering\'\,0\)\;\s+\@ini\_set\(\'display\_errors\'\,\s+0\)\;\s+\$auth\_pass\s+\=\s+\"([A-z0-9]{32})\"\;\s+\$([A-z0-9]{1,20})\s+\=\s+file\_get\_contents\(\$([A-z0-9]{1,20})\)\;\s+eval\(\$([A-z0-9]{1,20})\)\;\s+\?>/is, qr/<\?pHp\s+\$([A-z0-9]{1,20})\s+\=\s+urldecode\(\$\_GET\[\'\w\'\]\)\;\s+\@ini\_set\(\'output\_buffering\'\,0\)\;\s+\@ini\_set\(\'display\_errors\'\,\s+0\)\;\s+\$auth\_pass\s+\=\s+\"([A-z0-9]{32})\"\;\s+\$([A-z0-9]{1,20})\s+\=\s+file\_get\_contents\(\$([A-z0-9]{1,20})\)\;\s+eval\(\$([A-z0-9]{1,20})\)\;\s+\?>/is,
qr/<\?php.+?function\s+ASGLogin\(\)\s+\{.+?if\s+\(empty\(\$tmpdir\)\).+?<\/html><\?php\s+chdir\(\$lastdir\)\;\s+\?>/is, qr/<\?php.+?function\s+ASGLogin\(\)\s+\{.+?if\s+\(empty\(\$tmpdir\)\).+?<\/html><\?php\s+chdir\(\$lastdir\)\;\s+\?>/is,
qr/<\?php.+?str\_replace\(\"j\"\,\"\"\,\"sjtrj\_jrjejpljajcje\"\)\;.+?\(\"i\"\,\s+\"\"\,\s+\"ibiaisie6i4i\_dieicoide\"\)\;.+?\(\"k\"\,\"\"\,\"crkekatkek\_kfkukncktkikon\"\)\;.+?\(\)\;\s+\?>/is,
); );

2
malwaresh.pl
View File

@@ -958,7 +958,7 @@ my @regexen = (
qr/<\?\s+\$buffer\s+\=.+?\$buffer\.\=.+?\$newphrase\=str\_replace\(.+?eval\(\$\_\w\(\$newphrase\)\)\;\s+\?>/is, qr/<\?\s+\$buffer\s+\=.+?\$buffer\.\=.+?\$newphrase\=str\_replace\(.+?eval\(\$\_\w\(\$newphrase\)\)\;\s+\?>/is,
qr/<\?pHp\s+\$([A-z0-9]{1,20})\s+\=\s+urldecode\(\$\_GET\[\'\w\'\]\)\;\s+\@ini\_set\(\'output\_buffering\'\,0\)\;\s+\@ini\_set\(\'display\_errors\'\,\s+0\)\;\s+\$auth\_pass\s+\=\s+\"([A-z0-9]{32})\"\;\s+\$([A-z0-9]{1,20})\s+\=\s+file\_get\_contents\(\$([A-z0-9]{1,20})\)\;\s+eval\(\$([A-z0-9]{1,20})\)\;\s+\?>/is, qr/<\?pHp\s+\$([A-z0-9]{1,20})\s+\=\s+urldecode\(\$\_GET\[\'\w\'\]\)\;\s+\@ini\_set\(\'output\_buffering\'\,0\)\;\s+\@ini\_set\(\'display\_errors\'\,\s+0\)\;\s+\$auth\_pass\s+\=\s+\"([A-z0-9]{32})\"\;\s+\$([A-z0-9]{1,20})\s+\=\s+file\_get\_contents\(\$([A-z0-9]{1,20})\)\;\s+eval\(\$([A-z0-9]{1,20})\)\;\s+\?>/is,
qr/<\?php.+?function\s+ASGLogin\(\)\s+\{.+?if\s+\(empty\(\$tmpdir\)\).+?<\/html><\?php\s+chdir\(\$lastdir\)\;\s+\?>/is, qr/<\?php.+?function\s+ASGLogin\(\)\s+\{.+?if\s+\(empty\(\$tmpdir\)\).+?<\/html><\?php\s+chdir\(\$lastdir\)\;\s+\?>/is,
qr/<\?php.+?str\_replace\(\"j\"\,\"\"\,\"sjtrj\_jrjejpljajcje\"\)\;.+?\(\"i\"\,\s+\"\"\,\s+\"ibiaisie6i4i\_dieicoide\"\)\;.+?\(\"k\"\,\"\"\,\"crkekatkek\_kfkukncktkikon\"\)\;.+?\(\)\;\s+\?>/is,
); );
my @base64_decodes = ( my @base64_decodes = (