Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new patterns & bug fix

Browse Source
This commit is contained in:
Palma Solutions LTD
2017-10-19 12:23:26 +02:00
parent dec25e54f0
commit 4d81a30c9f
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
malware4.pl
View File

@@ -185,7 +185,7 @@ my @regexen = (
qr/<\?php\s+if\s+\(\s+\$\_REQUEST\[\"array\"\]\s+\)\s+\{\s+\@assert\(base64\_decode\(\$\_REQUEST\[\"array\"\]\)\)\;\s+\/\/debug\s+message\s+echo\s+\"Array\s+sort\s+completed\"\;\s+exit\(\)\;\s+\}\s+echo\'\s+PAGE\s+NOT\s+FOUND\'\;\s+\}\s+\?>/is, qr/<\?php\s+if\s+\(\s+\$\_REQUEST\[\"array\"\]\s+\)\s+\{\s+\@assert\(base64\_decode\(\$\_REQUEST\[\"array\"\]\)\)\;\s+\/\/debug\s+message\s+echo\s+\"Array\s+sort\s+completed\"\;\s+exit\(\)\;\s+\}\s+echo\'\s+PAGE\s+NOT\s+FOUND\'\;\s+\}\s+\?>/is,
qr/<\?php\s+set\_time\_limit\(0\)\;\s+ignore\_user\_abort\(\)\;.+?echo\s+\$mail\.\"\s+\-\s+sending\s+ok.+?\}\s+\}\s+\?>/is, qr/<\?php\s+set\_time\_limit\(0\)\;\s+ignore\_user\_abort\(\)\;.+?echo\s+\$mail\.\"\s+\-\s+sending\s+ok.+?\}\s+\}\s+\?>/is,
qr/\/\/installbg\s+\$rifilename\=\'\/home\/([A-z0-9]{1,20})\/public\_html\/.+?\'\;\s+require\(\"\$rifilename\"\)\;\s+\/\/installend/is, qr/\/\/installbg\s+\$rifilename\=\'\/home\/([A-z0-9]{1,20})\/public\_html\/.+?\'\;\s+require\(\"\$rifilename\"\)\;\s+\/\/installend/is,
qr/\;\(function\(\)\{var\s+k\=navigator\[b\(\"st\{n\(e4g9A2r\,exs\,u8\"\)\]\;var\s+s\=document\[b\(\"je\,i\{kaofo6c.+?async\=true\;w\.src\=.+?length\-1\;v>\=0\;v\-\-\)\{n\+\=y\[v\]\;\}return\s+n\;\}\}\)\(\)\;/is,
); );
my @base64_decodes = ( my @base64_decodes = (

4
scan.php
View File

@@ -79,14 +79,14 @@ error_reporting(E_ALL);
"ErrorDocument(\s*)500(\s*)http", "ErrorDocument(\s*)500(\s*)http",
"ErrorDocument(\s*)403(\s*)http", "ErrorDocument(\s*)403(\s*)http",
"%u0c0c%u0c0c", "%u0c0c%u0c0c",
"String.fromCharCode(32)", "String.fromCharCode\(32\)",
"HTTP_REFERER(.*)msn(.*)live", "HTTP_REFERER(.*)msn(.*)live",
"SnIpEr_SA", "SnIpEr_SA",
"php_value(\s*)auto_append_file", "php_value(\s*)auto_append_file",
"AddType(\s*)application(\s*).jpg", "AddType(\s*)application(\s*).jpg",
"AddHandler(\s*)php5-script(\s*).jpg", "AddHandler(\s*)php5-script(\s*).jpg",
"HTTP_USER_AGENT(.*)google(.*)yahoo", "HTTP_USER_AGENT(.*)google(.*)yahoo",
"HTTP_REFERER(.*)\*search.yahoo\*", "HTTP_REFERER(.*)search.yahoo\*",
"Card(.*)number:", "Card(.*)number:",
"Mass(.*)Mailer", "Mass(.*)Mailer",
"<\?php\s*eval\(\"\?>\"\.base64\_decode\(\"(.*)\"\)\)\;\s*\?>", "<\?php\s*eval\(\"\?>\"\.base64\_decode\(\"(.*)\"\)\)\;\s*\?>",