Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new patterns + AEF fix

Browse Source
This commit is contained in:
Palma Solutions LTD
2019-02-17 07:28:56 +01:00
parent 12ca4621cf
commit 96eb1e5536
4 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
cms-ver.php
View File

@@ -82,7 +82,6 @@
array("appRain", "/development/definition/system_configuration/config.xml", "<appRainversion>", ""),
array("ClipperCMS", "/manager/includes/version.inc.php", "define('CMS_RELEASE_VERSION',", ""), // forked from ModX
array("MyBB", "/inc/class_core.php", "public \$version =", ""),
array("AEF", "/globals.php", "// AEF : Advanced Electron Forum", ""),
array("Vanilla", "/conf/config.php", "\$Configuration\['Vanilla'\]\['Version'\] =". ""),
array("PunBB", "/include/constants.php", "define('FORUM_VERSION',", ""),
array("FluxBB", "/include/common.php", "define('FORUM_VERSION',", ""),
@@ -276,7 +275,8 @@ $versiondouble = array (
array("CS-Cart", "/config.php", "define('PRODUCT_NAME',", "define('PRODUCT_VERSION',", "Maintained"),
array("SohoLaunch", "/sohoadmin/version.php", "## Soholaunch(R)", "## Version", "EOL"),
array("XMB", "/db/mysql.php", "* eXtreme Message Board", " * XMB ", "EOL"),
array("AEF", "/globals.php", "// AEF : Advanced Electron Forum", "// Version", "EOL"),
);
foreach($versiondouble as $raw){

3
cms-vss.php
View File

@@ -96,7 +96,6 @@
array("appRain", "/development/definition/system_configuration/config.xml", "<appRainversion>", ""),
array("ClipperCMS", "/manager/includes/version.inc.php", "define('CMS_RELEASE_VERSION',", ""), // forked from ModX
array("MyBB", "/inc/class_core.php", "public \$version =", ""),
array("AEF", "/globals.php", "// AEF : Advanced Electron Forum", ""),
array("Vanilla", "/conf/config.php", "\$Configuration\['Vanilla'\]\['Version'\] =". ""),
array("PunBB", "/include/constants.php", "define('FORUM_VERSION',", ""),
array("FluxBB", "/include/common.php", "define('FORUM_VERSION',", ""),
@@ -290,6 +289,8 @@ $versiondouble = array (
array("CS-Cart", "/config.php", "define('PRODUCT_NAME',", "define('PRODUCT_VERSION',", "Maintained"),
array("SohoLaunch", "/sohoadmin/version.php", "## Soholaunch(R)", "## Version", "EOL"),
array("XMB", "/db/mysql.php", "* eXtreme Message Board", " * XMB ", "EOL"),
array("AEF", "/globals.php", "// AEF : Advanced Electron Forum", "// Version", "EOL"),
);

3
malware6.pl
View File

@@ -1376,7 +1376,8 @@ my @regexen = (
qr/<\?php\s+\$md5 = \"([A-z0-9_]{1,32})\";\s+\$([A-z0-9_]{1,5}) = array\(.+?6.+?4.+?\);\s+\$([A-z0-9_]{1,32}) = create_function\(.+?\'\);\s+\?>/is,
qr/<\?php\s+\$.+?if\(!function_exists\(\'str_ireplace\'\)\)\{function str_ireplace\(\$from,\$to,\$string\)\{return trim\(preg_replace\(\"\/\"\.addcslashes\(\$from,\"\?\:\\\\\/\*\^\$\"\)\.\"\/si\",\$to,\$string\)\);\}\};\$.+?\$\{\"\\x47\\x4c\\x4f\\x42\\x41\\x4c\\x53\"\}\[\"\\x4f\\x4f\\x4f\\x30\\x4f\\x5f\\x30\\x30\\x5f\\x5f\"\]\(\);\?>/is,
qr/<\?php.+?\$filter = \'base\'\.\'6\'\.\'4\'\.\'_decode\';.+?\$prepare_func = \'g\'\.\'z\'\.\'inflate\';.+?return \@\$prepare_func\( \$filter \);.+?\}\s+wp_admin_bar_header\(\);/is,
qr/<\?php if\(isset\(\$_REQUEST\[\"([A-z0-9_]{1,20})\"\]\)\)\{\$myvar = base64_decode\(\$_REQUEST\[\"([A-z0-9_]{1,20})\"\]\); eval\(\$myvar\);\}\?>/is,

1
malwaresh.pl
View File

@@ -1386,6 +1386,7 @@ my @regexen = (
qr/<\?php\s+\$md5 = \"([A-z0-9_]{1,32})\";\s+\$([A-z0-9_]{1,5}) = array\(.+?6.+?4.+?\);\s+\$([A-z0-9_]{1,32}) = create_function\(.+?\'\);\s+\?>/is,
qr/<\?php\s+\$.+?if\(!function_exists\(\'str_ireplace\'\)\)\{function str_ireplace\(\$from,\$to,\$string\)\{return trim\(preg_replace\(\"\/\"\.addcslashes\(\$from,\"\?\:\\\\\/\*\^\$\"\)\.\"\/si\",\$to,\$string\)\);\}\};\$.+?\$\{\"\\x47\\x4c\\x4f\\x42\\x41\\x4c\\x53\"\}\[\"\\x4f\\x4f\\x4f\\x30\\x4f\\x5f\\x30\\x30\\x5f\\x5f\"\]\(\);\?>/is,
qr/<\?php.+?\$filter = \'base\'\.\'6\'\.\'4\'\.\'_decode\';.+?\$prepare_func = \'g\'\.\'z\'\.\'inflate\';.+?return \@\$prepare_func\( \$filter \);.+?\}\s+wp_admin_bar_header\(\);/is,
qr/<\?php if\(isset\(\$_REQUEST\[\"([A-z0-9_]{1,20})\"\]\)\)\{\$myvar = base64_decode\(\$_REQUEST\[\"([A-z0-9_]{1,20})\"\]\); eval\(\$myvar\);\}\?>/is,
);