Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixes

Browse Source
This commit is contained in:
Palma Solutions LTD 2018-04-16 10:07:18 +02:00
parent 6b1a324127
commit aaeef3158d
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
cms-ver.php
View File

@ -131,7 +131,7 @@ $versions = array(
array("CKeditor", "/ckeditor/CHANGES.html", "CKEditor Changelog"),
array("Dokeos", "main/inc/installedVersion.inc.php", "\$dokeos_version"),
array("CakePHP","cake/config/config.php","\$config['Cake.version'] ="),
// still need to work on these
array("CubeCart", "/index.php", "CubeCart v"), // may need one more line
array("Soholaunch", "/index.php", "\#\# Soholaunch\(R\) Site Management Tool"), // needs two more lines
@ -207,7 +207,7 @@ foreach(glob("../".$row[1], GLOB_BRACE) as $versionfile) {
}
$versiondouble = array (
array("Joomla 1.0", "/includes/version.php", "\$RELEASE =", "\$DEV_LEVEL ="),
array("Joomla 1.0", "/includes/version.php", "var \$RELEASE", "var \$DEV_LEVEL"),
array("Joomla 1.5", "/libraries/joomla/version.php", "var \$RELEASE", "var \$DEV_LEVEL"),
array("Joomla 1.6/1.7", "/libraries/cms/version.php", "\$RELEASE =", "\$DEV_LEVEL ="),
array("Joomla 2.5/3.x", "/libraries/cms/version/version.php", "\$RELEASE =", "\$DEV_LEVEL ="),

4
malware5.pl
View File

@ -206,10 +206,10 @@ my @regexen = (
qr/<\?php\s+\$([A-z0-9]{1,20})\s+\=\s+\'s\'\.\'t\'\.\'r\'\.\'r\'\.\'e\'\.\'v\'\;\$([A-z0-9]{1,20})\s+\=\s+array\(.+?\(\'et\'\.\'al\'\.\'fn\'\.\'iz\'\.\'g\'\)\;eval\(\$.+?\)\)\)\)\;\s+\?>/is,
qr/<\?php\s+eval\(\"\\n\\\$([A-z0-9]{1,20})\s+\=\s+intval\(\_\_LINE\_\_\)\s+\*\s+337\;\"\)\;.+?eval\s+\(gzinflate\(base64\_decode\(\$\w\)\)\)\;/is,
qr/<\?php\s+\$([A-z0-9]{1,20})\=\$\_POST\[\'([A-z0-9]{1,20})\'\]\;if\(\$([A-z0-9]{1,20})\!\=\'\'\)\{\$([A-z0-9]{1,20})\=base64\_decode\(\$\_POST\[\'([A-z0-9]{1,20})\'\]\)\;\@eval\(\"\\\$([A-z0-9]{1,20})\=\$([A-z0-9]{1,20})\;\"\)\;\}/is,
qr/<\?php\s+if\s+\(isset\(\$\_POST\[.+?\$email\s+\=\s+\@base64\_decode\(.+?\$return\s+jk\_\_\_\(\$url\)\;\s+\}\s+\}\s+\}/is,
qr/<\?php\s+if\s+\(isset\(\$\_POST\[.+?\$email\s+\=\s+\@base64\_decode\(.+?return\s+jk\_\_\_\(\$url\)\;\s+\}\s+\}\s+\}/is,
qr/<\?php\s+\/\*Details.+?\$auth\_pass\s+\=.+?\$\_\_\=s\(base64\_decode\(.+?\$\_\=create\_function\(\"\"\,\@gzuncompress\(\$\_\_\)\)\;\$\_\(\)\;\?>/is,
qr/eval\(str\_rot13\(\'([A-z0-9]{1,20})\s+([A-z0-9]{1,20})\_([A-z0-9]{1,20})\(\)\{\$\w\=.+?\$\w\=([A-z0-9]{1,20})\(\_\_([A-z0-9]{1,20})\_\_\)\..+?\}\}([A-z0-9]{1,20})\_([A-z0-9]{1,20})\(\)\;\'\)\)\;/is,
);