Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new patterns

Browse Source
This commit is contained in:
Palma Solutions LTD 2017-11-12 14:06:15 +01:00
parent 605831ed0a
commit 4e5cf4d589
2 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
malware4.pl
View File

@ -243,6 +243,7 @@ foreach my $file (sort @files) {
next if $file eq 'wp-super-cache.php';
next if $file eq 'user-edit.php';
next if $file eq 'youtube.php';
next if $file eq 'FMModelForm_maker_fmc.php';
print "Scanning $start_dir/$file... ";
unless (-r "$start_dir/$file") {

16
scan.php
View File

@ -457,7 +457,21 @@ error_reporting(E_ALL);
"JspWebshell",
"StAkeR ~ Shell",
"SnIpEr_SA",
"<style name=\"Mr.HiTman\""
"<style name=\"Mr.HiTman\"",
"(?P<hex>\\\\x(?:{){0,1}\d{1,3}(?:}){0,1})",
"(?P<varfunc>\$\w+\(.*\))",
"(?P<god_mode_on><\?php\s*\/\*god_mode_on\*\/eval\(base64_decode\([\"'][^\"']{255,}[\"']\)\);\s*\/\*god_mode_off\*\/\s*\?>)",
"(?P<htaccess>RewriteCond %{HTTP_REFERER}\s*\^\.\*\s*\([^\)]*[google|yahoo|bing|ask|wikipedia|youtube][^\)]*)",
"(?P<JSCRIPT>^<script>.*<\/script>)",
"(?P<GRMalware>^<\?php\s*if\(!function_exists\([^{]+\s*{\s*function[^}]+\s*}\s*[^\"']+\s*[\"'][^\"']+[\"'];\s*eval\s*\(.*\)\s*;\s*}\s*)",
"(?P<c99>(<\?php)*\\\$md5\s*=\s*[\"|']\w+[\"|'];\s*\\\$wp_salt\s*=\s*[\w\(\),\"\'\;\$]+\s*\\\$wp_add_filter\s*=\s*create_function\(.*\);\s*\\\$wp_add_filter\(.*\);\s*(\?>)*)",
"(?P<evl>eval\s*\([^\)]+)",
"(?P<ltx>[a-zA-Z0-9\+\-\/]{50,})",
"(?P<ifm><iframe[^>]*)",
"(?P<mbd><embed[^>]*)",
"(?P<tim>[T|t]imthumb)",
"(?P<cfn>create_function[^\)]*)",
"(?P<c64>base64_decode[^\)]*)",
);