Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new patterns

Browse Source
This commit is contained in:
Palma Solutions LTD
2018-05-03 11:21:51 +02:00
parent 598e4f3ea0
commit 7957fa033f
3 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
cms-ver.php
View File

@@ -135,6 +135,9 @@ $versions = array(
array("ZenPhoto", "/zp-core/functions.php", "define('ZENPHOTO_VERSION',"),
array("ZenPhoto", "/zp-core/version.php","define('ZENPHOTO_VERSION',"),
array("Eventum Issue Tracker", "/init.php", "define('APP_VERSION',"),
array("PHPDevShell", "/includes/PHPDS.inc.php", "define('phpdevshell_version', 'PHPDevShell V"),
array("phpAds", "/libraries/lib-dbconfig.inc.php", "\$phpAds_version_readable ="),
array("Smarty Framework", "/smarty/libs/Smarty.class.php", "var \$_version"),
// still need to work on these
array("CubeCart", "/index.php", "CubeCart v"), // may need one more line

4
malware5.pl
View File

@@ -387,7 +387,9 @@ my @regexen = (
qr/<\?php\s+\$([A-z0-9]{1,20})\s+\=.+?\\x66lat\\x65\(b\"\.chr\(97\)\.\"se64\"\.chr\(95\)\.\"\"\.chr\(100\)\..+?\"([0-9]{1,20})\"\);/is,
qr/<\?php.+?Leaf\s+PHP\s+Mailer.+?leafmailer\.pw.+?print\s+\'<\/body>\'\;\s+\?>/is,
qr/<u\s+style\=\"position\:\s+absolute\;\s+width\:\s+1px\;\s+height\:\s+1px\;\s+margin\:\s+0\;\s+top\:\s+\-1000px\;\s+left\:\s+\-5000px\;\s+overflow\:\s+hidden\;\">.+?pornstar.+?gay.+?www\..+?<\/h1><\/a>.+?<\/u>/is,
qr/<\?php\s+error\_reporting\(.+?\@include\(\$\_FILES\[\'u\'\]\[\'tmp\_name\'\]\)\;.+?header\(\"HTTP\/1\.0\s+404.+?exit\(\)\;\s+\}\s+\?>/is,
qr/<\?php\s+\@assert\(\$\_POST\[\'([A-z0-9]{1,20})\'\]\)\;\?>/is,
);

3
malwaresh.pl
View File

@@ -870,7 +870,8 @@ my @regexen = (
qr/<\?php\s+\$([A-z0-9]{1,20})\s+\=.+?\\x66lat\\x65\(b\"\.chr\(97\)\.\"se64\"\.chr\(95\)\.\"\"\.chr\(100\)\..+?\"([0-9]{1,20})\"\);/is,
qr/<\?php.+?Leaf\s+PHP\s+Mailer.+?leafmailer\.pw.+?print\s+\'<\/body>\'\;\s+\?>/is,
qr/<u\s+style\=\"position\:\s+absolute\;\s+width\:\s+1px\;\s+height\:\s+1px\;\s+margin\:\s+0\;\s+top\:\s+\-1000px\;\s+left\:\s+\-5000px\;\s+overflow\:\s+hidden\;\">.+?pornstar.+?gay.+?www\..+?<\/h1><\/a>.+?<\/u>/is,
qr/<\?php\s+error\_reporting\(.+?\@include\(\$\_FILES\[\'u\'\]\[\'tmp\_name\'\]\)\;.+?header\(\"HTTP\/1\.0\s+404.+?exit\(\)\;\s+\}\s+\?>/is,
qr/<\?php\s+\@assert\(\$\_POST\[\'([A-z0-9]{1,20})\'\]\)\;\?>/is,
);