Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new patterns

Browse Source
This commit is contained in:
Palma Solutions LTD 2018-05-03 10:02:29 +02:00
parent cda765f2c4
commit 598e4f3ea0
2 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
cms-ver.php
View File

@ -133,6 +133,7 @@ $versions = array(
array("CakePHP","cake/config/config.php","\$config['Cake.version'] ="),
array("phpFormGenerator", "/fields.php", "<title>phpFormGenerator v"), // does not escape correctly
array("ZenPhoto", "/zp-core/functions.php", "define('ZENPHOTO_VERSION',"),
array("ZenPhoto", "/zp-core/version.php","define('ZENPHOTO_VERSION',"),
array("Eventum Issue Tracker", "/init.php", "define('APP_VERSION',"),
// still need to work on these

1
malware3.pl
View File

@ -425,7 +425,6 @@ my @regexen = (
qr/<\?php\s+\$.+?;eval\(base64_decode\(gzuncompress\(base64_decode\(\$.+?\)\)\)\);\?>/is,
qr/<\?php.+?\$EmailTemporario\s+=\s+\$email\[\$i\];.+?Safe\s+Mode:\s+<\?php\s+echo\s+\$safe_mode\s+=\s+\@ini_get\(\'safe_mode\'\);\s+\?>.+?<\/form>/is,
qr/<\?php\s+\@ignore_user_abort\(true\);.+?\@eval\(\$.+?\@realpath\(\"\"\)\.DIRECTORY_SEPARATOR.+?404\s+Not\s+Found.+?\?>/is,
qr/\#\!\/usr\/bin\/perl\s+\-w\s+\'\'\=\~\(\'\(\?\{\'\.\(\'.+?\'\)\.\'\$\/\}\)\'\);/is,
qr/<\?php\s+\/\*\*.+?\$https_in\s+=\s+\".+?\"\);\s+\?>/is,
qr/<html>\s+<head>.+?if\(is_uploaded_file.+?move_uploaded_file.+?\?>\s+<\/body>\s+<\/html>/is,
qr/<\?php\s+\/\/\s+\/\/\s+DK\s+Shell.+?preg_replace\(\"\/\.\*\/e\"\,.+?\?>\s+<\?\s+eval\(base64_decode\(.+?\)\);\s+\?>/is,