Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added NextCloud/OwnCloud - fixed pattern

Browse Source
This commit is contained in:
Palma Solutions LTD
2018-05-05 10:31:36 +02:00
parent 39aa5ee676
commit ca7011379c
3 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
cms-ver.php
View File

@@ -140,6 +140,7 @@ $versions = array(
array("Smarty Framework", "/smarty/libs/Smarty.class.php", "var \$_version"), array("Smarty Framework", "/smarty/libs/Smarty.class.php", "var \$_version"),
array("phpDealerLocator", "/config.php", "phpDealerLocator v"), array("phpDealerLocator", "/config.php", "phpDealerLocator v"),
array("CraftySyntax", "/admin_common.php", "CVS will be released with version"), array("CraftySyntax", "/admin_common.php", "CVS will be released with version"),
array("NextCloud/OwnCloud", "/version.php", "\$OC_VersionString ="),
// still need to work on these // still need to work on these
array("CubeCart", "/index.php", "CubeCart v"), // may need one more line array("CubeCart", "/index.php", "CubeCart v"), // may need one more line

2
malware5.pl
View File

@@ -431,7 +431,7 @@ my @regexen = (
qr/<\?\$sInjectPHP\s+\=\s+\"<iframe\s+src\=.+?function\s+Infect\(\$sDir\).+?closedir\(\$hDir\)\;\s+\}\s+\}\s+\?>/is, qr/<\?\$sInjectPHP\s+\=\s+\"<iframe\s+src\=.+?function\s+Infect\(\$sDir\).+?closedir\(\$hDir\)\;\s+\}\s+\}\s+\?>/is,
qr/<iframe\s+src\=\"http\:\/\/.+?\.php\?.+?\"\s+width\=\"0\"\s+height\=\"0\"\s+frameborder\=\"0\"><\/iframe>/is, qr/<iframe\s+src\=\"http\:\/\/.+?\.php\?.+?\"\s+width\=\"0\"\s+height\=\"0\"\s+frameborder\=\"0\"><\/iframe>/is,
qr/<\?\s+\@include\s+\$\_GET\[\"([A-z0-9]{1,20})\"\]\;\s+\?>/is, qr/<\?\s+\@include\s+\$\_GET\[\"([A-z0-9]{1,20})\"\]\;\s+\?>/is,
qr/<\?php\s+\@include\(\"http\:\/\/.+?(.*r57.*|.*xpl.*|.*cmd.*|.*c99.*)\;\"\)\;\s+\?>/is, qr/<\?php\s+\@include\(\"http\:\/\/.+?(r57|c99)\;\"\)\;\s+\?>/is,
qr/<\?php\s+\@include\(\"http\:\/\/.+?bypass\.txt\?\?\"\)\;\s+\?>/is, qr/<\?php\s+\@include\(\"http\:\/\/.+?bypass\.txt\?\?\"\)\;\s+\?>/is,
qr/<\?php\s+echo\s+base64\_decode\(\"([A-z0-9]{1,20})\"\)\;\s+\@include\(\"http\:\/\/.+?\"\)\;\s+\?>/is, qr/<\?php\s+echo\s+base64\_decode\(\"([A-z0-9]{1,20})\"\)\;\s+\@include\(\"http\:\/\/.+?\"\)\;\s+\?>/is,
qr/<\?php\s+echo\s+\"MFTeaM\"\;\@include\(\"http\:\/\/.+?\"\)\;\s+\?>/is, qr/<\?php\s+echo\s+\"MFTeaM\"\;\@include\(\"http\:\/\/.+?\"\)\;\s+\?>/is,

2
malwaresh.pl
View File

@@ -914,7 +914,7 @@ my @regexen = (
qr/<\?\$sInjectPHP\s+\=\s+\"<iframe\s+src\=.+?function\s+Infect\(\$sDir\).+?closedir\(\$hDir\)\;\s+\}\s+\}\s+\?>/is, qr/<\?\$sInjectPHP\s+\=\s+\"<iframe\s+src\=.+?function\s+Infect\(\$sDir\).+?closedir\(\$hDir\)\;\s+\}\s+\}\s+\?>/is,
qr/<iframe\s+src\=\"http\:\/\/.+?\.php\?.+?\"\s+width\=\"0\"\s+height\=\"0\"\s+frameborder\=\"0\"><\/iframe>/is, qr/<iframe\s+src\=\"http\:\/\/.+?\.php\?.+?\"\s+width\=\"0\"\s+height\=\"0\"\s+frameborder\=\"0\"><\/iframe>/is,
qr/<\?\s+\@include\s+\$\_GET\[\"([A-z0-9]{1,20})\"\]\;\s+\?>/is, qr/<\?\s+\@include\s+\$\_GET\[\"([A-z0-9]{1,20})\"\]\;\s+\?>/is,
qr/<\?php\s+\@include\(\"http\:\/\/.+?(.*r57.*|.*xpl.*|.*cmd.*|.*c99.*)\;\"\)\;\s+\?>/is, qr/<\?php\s+\@include\(\"http\:\/\/.+?(r57|c99)\;\"\)\;\s+\?>/is,
qr/<\?php\s+\@include\(\"http\:\/\/.+?bypass\.txt\?\?\"\)\;\s+\?>/is, qr/<\?php\s+\@include\(\"http\:\/\/.+?bypass\.txt\?\?\"\)\;\s+\?>/is,
qr/<\?php\s+echo\s+base64\_decode\(\"([A-z0-9]{1,20})\"\)\;\s+\@include\(\"http\:\/\/.+?\"\)\;\s+\?>/is, qr/<\?php\s+echo\s+base64\_decode\(\"([A-z0-9]{1,20})\"\)\;\s+\@include\(\"http\:\/\/.+?\"\)\;\s+\?>/is,
qr/<\?php\s+echo\s+\"MFTeaM\"\;\@include\(\"http\:\/\/.+?\"\)\;\s+\?>/is, qr/<\?php\s+echo\s+\"MFTeaM\"\;\@include\(\"http\:\/\/.+?\"\)\;\s+\?>/is,