Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

changed scores

Browse Source
This commit is contained in:
Palma Solutions LTD
2018-12-27 12:14:59 +01:00
parent 8b2d38b584
commit 4eeaee75ba
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
scan.py
View File

@@ -198,7 +198,7 @@ scoring = {
'BASE64_STRING': (50, u'base64 string found'), 'BASE64_STRING': (50, u'base64 string found'),
'CRYPT_PHP': (50, u'CryptoPHP inclusion for social.png'), 'CRYPT_PHP': (50, u'CryptoPHP inclusion for social.png'),
'PHP_SHELL': (50, u'Shell Script'), 'PHP_SHELL': (50, u'Shell Script'),
'PHP_OBFUSC_SHELL': (50, u'Obfuscated Shell Script'), 'PHP_OBFUSC_SHELL': (9, u'Obfuscated Shell Script'),
'ACCESS_DENIED': (-30, u'Early block execution'), 'ACCESS_DENIED': (-30, u'Early block execution'),
'JAVASCRIPT_HACK': (50, u'Javascript'), 'JAVASCRIPT_HACK': (50, u'Javascript'),
'HAS_EVAL': (2, u'Has eval()'), 'HAS_EVAL': (2, u'Has eval()'),
@@ -575,7 +575,7 @@ def is_hacked(filename):
score.append(('MANY_LINES3', '%i lines' % line_num)) score.append(('MANY_LINES3', '%i lines' % line_num))
# Shell super bien caché, toutes les lignes ont la même longueur # Shell super bien caché, toutes les lignes ont la même longueur
if len(first_lines) > 12 and line_num < 30 and first_lines[0] == '<?php' and \ if len(first_lines) > 12 and line_num < 30 and first_lines[0] == '<?php' and \
len(first_lines[1]) == len(first_lines[2]) == len(first_lines[3]) == len(first_lines[4]) == len(first_lines[5]) == len(first_lines[6]) == len(first_lines[7]) == len(first_lines[8]) and len(first_lines[3]) > 40 and first_lines[3][0] == ' ': len(first_lines[1]) == len(first_lines[2]) == len(first_lines[3]) == len(first_lines[4]) == len(first_lines[5]) == len(first_lines[6]) == len(first_lines[7]) == len(first_lines[8]) and len(first_lines[3]) > 40 and first_lines[3][0] == ' ':
score.append(('PHP_OBFUSC_SHELL', '')) score.append(('PHP_OBFUSC_SHELL', ''))