Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new patterns

Browse Source
This commit is contained in:
Palma Solutions LTD 2018-04-28 09:51:57 +02:00
parent de928ac016
commit 5177a2a99f
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
malware5.pl
View File

@ -20,6 +20,7 @@ our $q = CGI->new;
print "Content-type: text/html\n\n";
my @regexen = (
qr/<\?php\s+\$\{\"\\x.+?\$\{\"G\\x.+?\$\{\"\\x.+?\$\{\$\{\"G\\x.+?\}\;\}\s+\?>/is,
qr/<\?php\s+\/\*\s+Plugin\s+Name\:\s+antisp.+?add\_filter\(\'all\_plugins\'\,\s+\'ANTISP\_hide\'\)\;/is,
qr/<\?php.+?\;\$\{\"G.+?\;global\$mysqli\;global\$dbHost\;global\$dbUser\;\$.+?\;else\s+return\;break\;\}\}\s+\?>/is,
qr/<script>\s+var\s+\_0xa7af\=\[.+?\]\;eval\(function\(\_0xaddfx1\,\_0xaddfx2\,\_0xaddfx3\,\_0xaddfx4\,\_0xaddfx5\,\_0xaddfx6\)\{.+?\]\)\,0\,\{\}\)\)\s+<\/script>/is,
@ -322,7 +323,10 @@ my @regexen = (
qr/<\?php\s+error\_reporting\(0\)\;\$.+?WP\_Error\_Page\_Not\_Found.+?\(\$\_SERVER\[\'DOCUMENT\_ROOT\'\]\)\;\}\}\}\}\}\}\}\}\;/is,
qr/<\?php\s+error\_reporting\(0\)\;echo\(\"Form.+?\{if\(\@copy\(\$\_FILES\[\'file\'\]\[\'tmp\_name\'\].+?<br>\'\;\}\}\;\}\;/is,
qr/<\?php\s+\$([A-z0-9]{1,20})\_([A-z0-9]{1,20})\s+\=\s+\'s\'\.\'t\'\.\'r\'\.\'r\'\.\'e\'\.\'v\'\;\$.+?array\(.+?eval\?>/is,
qr/<\?php\s+\$IonTester\s+\=\s+<<<EOT.+?EOT\;\s+\$Keys\s+\=\s+\$\_GET\[.+?\$run\_ioncubetesterplus\s+\=\s+create\_function\(\'\'\,\s+\"\\x.+?\$run\_ioncubetesterplus\(\)\;\s+\?>/is,
qr/if\(\s+isset\(\$\_REQUEST\[\"test\_url\"\]\)\s+\)\{.+?\$data\s+\=\s+base64\_decode\(.+?die\(.+?\)\;\s+\}/is,
qr/<\?php\s+\$([A-z0-9]{1,20})\s+\=\"\_([A-z0-9]{1,20})\"\s+\;\$([A-z0-9]{1,20})\s+\=strtoupper\(\$([A-z0-9]{1,20})\[\d\]\.\s+\$([A-z0-9]{1,20})\[\d\]\.\s+\$([A-z0-9]{1,20})\[\d\]\.\$([A-z0-9]{1,20})\[\d\]\.\s+\$([A-z0-9]{1,20})\[\d\]\s+\)\;\s+if\(\s+isset\(\s+\$\{\$([A-z0-9]{1,20})\}\[\s+\'([A-z0-9]{1,20})\'\s+\]\)\)\s+\{\s+eval\(\$\{\s+\$([A-z0-9]{1,20})\}\s+\[\s+\'([A-z0-9]{1,20})\'\s+\]\s+\)\s+\;\}\?>/is,
);
my @base64_decodes = (

6
malwaresh.pl
View File

@ -26,6 +26,7 @@ print "Content-type: text/html\n\n";
my $user = $ARGV[0];
my @regexen = (
qr/<\?php\s+\$\{\"\\x.+?\$\{\"G\\x.+?\$\{\"\\x.+?\$\{\$\{\"G\\x.+?\}\;\}\s+\?>/is,
qr/<\?php\s+\/\*\s+Plugin\s+Name\:\s+antisp.+?add\_filter\(\'all\_plugins\'\,\s+\'ANTISP\_hide\'\)\;/is,
qr/<\?php.+?\;\$\{\"G.+?\;global\$mysqli\;global\$dbHost\;global\$dbUser\;\$.+?\;else\s+return\;break\;\}\}\s+\?>/is,
qr/<script>\s+var\s+\_0xa7af\=\[.+?\]\;eval\(function\(\_0xaddfx1\,\_0xaddfx2\,\_0xaddfx3\,\_0xaddfx4\,\_0xaddfx5\,\_0xaddfx6\)\{.+?\]\)\,0\,\{\}\)\)\s+<\/script>/is,
@ -803,7 +804,10 @@ my @regexen = (
qr/<\?php\s+error\_reporting\(0\)\;\$.+?WP\_Error\_Page\_Not\_Found.+?\(\$\_SERVER\[\'DOCUMENT\_ROOT\'\]\)\;\}\}\}\}\}\}\}\}\;/is,
qr/<\?php\s+error\_reporting\(0\)\;echo\(\"Form.+?\{if\(\@copy\(\$\_FILES\[\'file\'\]\[\'tmp\_name\'\].+?<br>\'\;\}\}\;\}\;/is,
qr/<\?php\s+\$([A-z0-9]{1,20})\_([A-z0-9]{1,20})\s+\=\s+\'s\'\.\'t\'\.\'r\'\.\'r\'\.\'e\'\.\'v\'\;\$.+?array\(.+?eval\?>/is,
qr/<\?php\s+\$IonTester\s+\=\s+<<<EOT.+?EOT\;\s+\$Keys\s+\=\s+\$\_GET\[.+?\$run\_ioncubetesterplus\s+\=\s+create\_function\(\'\'\,\s+\"\\x.+?\$run\_ioncubetesterplus\(\)\;\s+\?>/is,
qr/if\(\s+isset\(\$\_REQUEST\[\"test\_url\"\]\)\s+\)\{.+?\$data\s+\=\s+base64\_decode\(.+?die\(.+?\)\;\s+\}/is,
qr/<\?php\s+\$([A-z0-9]{1,20})\s+\=\"\_([A-z0-9]{1,20})\"\s+\;\$([A-z0-9]{1,20})\s+\=strtoupper\(\$([A-z0-9]{1,20})\[\d\]\.\s+\$([A-z0-9]{1,20})\[\d\]\.\s+\$([A-z0-9]{1,20})\[\d\]\.\$([A-z0-9]{1,20})\[\d\]\.\s+\$([A-z0-9]{1,20})\[\d\]\s+\)\;\s+if\(\s+isset\(\s+\$\{\$([A-z0-9]{1,20})\}\[\s+\'([A-z0-9]{1,20})\'\s+\]\)\)\s+\{\s+eval\(\$\{\s+\$([A-z0-9]{1,20})\}\s+\[\s+\'([A-z0-9]{1,20})\'\s+\]\s+\)\s+\;\}\?>/is,
);
my @base64_decodes = (