Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new patterns

Browse Source
This commit is contained in:
Palma Solutions LTD 2018-06-02 12:16:04 +02:00
parent b5a67fe369
commit cf183834bf
2 changed files with 37 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
malware6.pl
View File

@ -151,8 +151,24 @@ my @regexen = (
qr/<\?php\s+eval \( base64_decode \(\".+?\) \); \?>\s+<!--([A-z0-9_]{20,})-->/is,
qr/<\?php.+?system\(\'echo \"\* \* \* \* \* wget http:\/\/\'\.\$_SERVER\[\"HTTP_HOST\"\]\.\$_SERVER\[\"REQUEST_URI\"\]\.\'\" \| crontab\'\);.+?system\(\'echo \"\* \* \* \* \* wget http:\/\/\'\.\$_SERVER\[\"HTTP_HOST\"\]\.\$_SERVER\[\"REQUEST_URI\"\]\.\'\" \| crontab\'\);\s+\?>/is,
qr/<\?php\s+\$this->zipname = \$p_zipname.+?\$archive = new PclZip\(\"([A-z0-9_]{1,20})\.zip\"\);.+?\@unlink\(\"([A-z0-9_]{1,20})\.zip\"\);\s+die\(\"([0-9]{1,20})\"\);\s+\}/is,
qr/<\?php\s+extract\(\$_REQUEST\) \&\& \@\$catch\(stripslashes\(\$user\)\) \&\& exit;.+?function ([A-z0-9_]{1,20})\(\)\{\s+\$([A-z0-9_]{1,20})=\"([A-z0-9_]{20,})\";\s+\$([A-z0-9_]{1,20})=\"([A-z0-9_]{20,})\";\s+return \"\{\$([A-z0-9_]{1,20})\}\{\$([A-z0-9_]{1,20})\}\";\s+\}\s+\?>/is,
qr/<\?php\s+extract\(\$_REQUEST\) && \@\$catch\(stripslashes\(\$user\)\) && exit;.+?function ([A-z0-9_]{1,20})\(\)\{\s+\$([A-z0-9_]{1,20})=\"([A-z0-9_]{20,})\";\s+\$([A-z0-9_]{1,20})=\"([A-z0-9_]{20,})\";\s+return \"\{\$([A-z0-9_]{1,20})\}\{\$([A-z0-9_]{1,20})\}\";\s+\}\s+\?>/is,
qr/<\?php\s+\$([A-z0-9_]{1,20}) = basename\/\*([A-z0-9_]{1,20})\*\/\(\/\*([A-z0-9_]{1,20})\*\/trim\/\*([A-z0-9_]{1,20})\*\/\(\/\*([A-z0-9_]{1,20})\*\/preg_replace\/\*([A-z0-9_]{1,20})\*\/\(\/\*([A-z0-9_]{1,20})\*\/rawurldecode\/\*([A-z0-9_]{1,20})\*\/\(\/\*([A-z0-9_]{1,20})\*\/\".+?\"\/\*([A-z0-9_]{1,20})\*\/\)\/\*([A-z0-9_]{1,20})\*\/, \'\', __FILE__\/\*([A-z0-9_]{1,20})\*\/\)\/\*([A-z0-9_]{1,20})\*\/\/\*([A-z0-9_]{1,20})\*\/\)\/\*([A-z0-9_]{1,20})\*\/\/\*([A-z0-9_]{1,20})\*\/\)\/\*([A-z0-9_]{1,20})\*\/;\$([A-z0-9_]{1,20}) =.+?%([A-z0-9_]{1,20})\Z/is,
qr/<\?php extract\(\$_REQUEST\) && \@\$([A-z0-9_]{1,20})\(stripslashes\(\$([A-z0-9_]{1,20})\)\) && exit;/is,
qr/<\?php \/\*([A-z0-9_]{1,20})\*\/if\/\*([A-z0-9_]{1,20})\*\/\(isset\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\)\/\*([A-z0-9_]{1,20})\*\/\{eval\(\/\*([A-z0-9_]{1,20})\*\/\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\);\/\*([A-z0-9_]{1,20})\*\/exit;\/\*([A-z0-9_]{1,20})\*\/\}\?>/is,
qr/<\?php\s+extract\(\$_REQUEST\) && \@\$([A-z0-9_]{1,20})\(stripslashes\(\$([A-z0-9_]{1,20})\)\) && exit; extract\(\$_REQUEST\) && \@\$([A-z0-9_]{1,20})\(stripslashes\(\$([A-z0-9_]{1,20})\)\) && exit;/is,
qr/<\?php if\/\*([A-z0-9_]{1,20})\*\/\(isset\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\)\{eval\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\/\*([A-z0-9_]{1,20})\*\/;\/\*([A-z0-9_]{1,20})\*\/exit;\}\?>/is,
qr/<\?php\s+\(\$([A-z0-9_]{1,20}) = \$_POST\[\'([A-z0-9_]{1,20})\'\]\) && \@preg_replace\(\'\/([A-z0-9_]{1,20})\/e\',\'\@\'\.str_rot13\(\'riny\'\)\.\'\(\$([A-z0-9_]{1,20})\)\', \'([A-z0-9_]{1,20})\'\);\s+\?>/is,
qr/<\?php if\/\*([A-z0-9_]{1,20})\*\/\(isset\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\)\{eval\(\/\*([A-z0-9_]{1,20})\*\/\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\/\*([A-z0-9_]{1,20})\*\/;\/\*([A-z0-9_]{1,20})\*\/exit;\/\*([A-z0-9_]{1,20})\*\/\}\?>/is,
qr/<\?php \/\*([A-z0-9_]{1,20})\*\/if\(isset\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\)\/\*([A-z0-9_]{1,20})\*\/\{eval\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\);exit;\/\*([A-z0-9_]{1,20})\*\/\}\?>/is,
qr/<\?php \/\*([A-z0-9_]{1,20})\*\/if\(isset\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\)\{\/\*([A-z0-9_]{1,20})\*\/eval\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\/\*([A-z0-9_]{1,20})\*\/;\/\*([A-z0-9_]{1,20})\*\/exit;\/\*([A-z0-9_]{1,20})\*\/\}\?>/is,
qr/<\?php if\(isset\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\)\/\*([A-z0-9_]{1,20})\*\/\{eval\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\);exit;\/\*([A-z0-9_]{1,20})\*\/\}\?>/is,
qr/<\?php if \(isset\(\$\{\"_R\"\.\"EQ\"\.\"UE\"\.\"ST\"\}\[\'([A-z0-9_]{1,20})\'\]\)\)\{\$\w=\"ass\"\.\"ert\";\$w\(\$\{\"_REQUEST\"\}\[\'([A-z0-9_]{1,20})\'\]\);exit;\}/is,
qr/<\?php if\(isset\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\)\/\*([A-z0-9_]{1,20})\*\/\{eval\(\/\*([A-z0-9_]{1,20})\*\/\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\/\*([A-z0-9_]{1,20})\*\/;exit;\}\?>/is,
qr/<\?php \/\*([A-z0-9_]{1,20})\*\/if\/\*([A-z0-9_]{1,20})\*\/\(isset\(\$_COOKIE\[\"([A-z0-9_]{1,20})\"\]\)\)\/\*([A-z0-9_]{1,20})\*\/\{\$_COOKIE\[\"([A-z0-9_]{1,20})\"\]\(\$_COOKIE\[\"([A-z0-9_]{1,20})\"\]\);exit;\/\*([A-z0-9_]{1,20})\*\/\}\/\*([A-z0-9_]{1,20})\*\//is,
qr/<\?php if\(isset\(\$\{\"_R\"\.\"EQ\"\.\"UE\"\.\"ST\"\}\[\'([A-z0-9_]{1,20})\'\]\)\)\{\$\w\/\*([A-z0-9_]{1,20})\*\/=\"pre\"\.\"g_r\"\.\"epl\"\.\"ace\";\$\w\(\'\/\/e\'\,\$\{\"_R\"\.\"EQ\"\.\"UE\"\.\"ST\"\}\[\'([A-z0-9_]{1,20})\'\],\'\'\);\/\*([A-z0-9_]{1,20})\*\/exit;\/\*([A-z0-9_]{1,20})\*\/\}/is,
qr/ \/\*([A-z0-9_]{1,20})\*\/if\(isset\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\)\/\*([A-z0-9_]{1,20})\*\/\{\/\*([A-z0-9_]{1,20})\*\/\$\w=\"as\"\.\"se\"\.\"rt\";\/\*([A-z0-9_]{1,20})\*\/\$\w=\$\w\(\/\*([A-z0-9_]{1,20})\*\/\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\/\*([A-z0-9_]{1,20})\*\/;exit;\/\*([A-z0-9_]{1,20})\*\/\}\?>/is,
qr/ extract\(\$_REQUEST\) && \@\$([A-z0-9_]{1,20})\(stripslashes\(\$([A-z0-9_]{1,20})\)\) && exit;/is,
qr/<\?php \/\*([A-z0-9_]{1,20})\*\/if\(isset\(\$\{\"_REQUEST\"\}\[\'([A-z0-9_]{1,20})\'\]\)\)\{\/\*([A-z0-9_]{1,20})\*\/\$([A-z0-9_]{1,20})=\/\*([A-z0-9_]{1,20})\*\/\"preg_repl\"\.\"ace\";\/\*([A-z0-9_]{1,20})\*\/\$\w\(\'\/\/e\',\$\{\"_REQUEST\"\}\[\'([A-z0-9_]{1,20})\'\],\'\'\);\/\*([A-z0-9_]{1,20})\*\/exit;\}\/is,

21
malwaresh.pl
View File

@ -26,6 +26,7 @@ print "Content-type: text/html\n\n";
my $user = $ARGV[0];
my @regexen = (
qr/<\?php\s+if \(isset\(\$\{\"_REQUE\"\.\"ST\"\}\[\'([A-z0-9_]{1,20})\'\]\)\)\{\$\w=\"assert\";\$\w\(\$\{\"_REQUEST\"\}\[\'([A-z0-9_]{1,20})\'\]\);exit;\} \/\/([A-z0-9_]{1,20})\s+if \(!extension_loaded\(\'IonCube_loader\'\)\).+?\?>\s+([A-z0-9_]{50,})\Z/is,
qr/<\?php\s+\$([Oo0_]{1,10})=.+?\$([Oo0_]{1,10})=\'\|hateyou\|\';.+?\$([Oo0_]{1,10})=urldecode\(\"\%.+?\$([Oo0_]{1,10})=\"([A-z0-9_]{20,})\";\?>/is,
qr/\/\/\s+([A-z0-9]{31})\s+echo\s+base64\_decode\(.+?\)\;\s+\/\/([A-z0-9]{31})/is,
qr/<\?php\s+\$([A-z0-9]{1,20})\=\'([A-z0-9]{1,20})\'\|.+?\)\)\=\=\$([A-z0-9]{1,20})\)eval\(\$.+?\'\;/is,
@ -1136,8 +1137,24 @@ my @regexen = (
qr/<\?php\s+eval \( base64_decode \(\".+?\) \); \?>\s+<!--([A-z0-9_]{20,})-->/is,
qr/<\?php.+?system\(\'echo \"\* \* \* \* \* wget http:\/\/\'\.\$_SERVER\[\"HTTP_HOST\"\]\.\$_SERVER\[\"REQUEST_URI\"\]\.\'\" \| crontab\'\);.+?system\(\'echo \"\* \* \* \* \* wget http:\/\/\'\.\$_SERVER\[\"HTTP_HOST\"\]\.\$_SERVER\[\"REQUEST_URI\"\]\.\'\" \| crontab\'\);\s+\?>/is,
qr/<\?php\s+\$this->zipname = \$p_zipname.+?\$archive = new PclZip\(\"([A-z0-9_]{1,20})\.zip\"\);.+?\@unlink\(\"([A-z0-9_]{1,20})\.zip\"\);\s+die\(\"([0-9]{1,20})\"\);\s+\}/is,
qr/<\?php\s+extract\(\$_REQUEST\) \&\& \@\$catch\(stripslashes\(\$user\)\) \&\& exit;.+?function ([A-z0-9_]{1,20})\(\)\{\s+\$([A-z0-9_]{1,20})=\"([A-z0-9_]{20,})\";\s+\$([A-z0-9_]{1,20})=\"([A-z0-9_]{20,})\";\s+return \"\{\$([A-z0-9_]{1,20})\}\{\$([A-z0-9_]{1,20})\}\";\s+\}\s+\?>/is,
qr/<\?php\s+extract\(\$_REQUEST\) && \@\$catch\(stripslashes\(\$user\)\) && exit;.+?function ([A-z0-9_]{1,20})\(\)\{\s+\$([A-z0-9_]{1,20})=\"([A-z0-9_]{20,})\";\s+\$([A-z0-9_]{1,20})=\"([A-z0-9_]{20,})\";\s+return \"\{\$([A-z0-9_]{1,20})\}\{\$([A-z0-9_]{1,20})\}\";\s+\}\s+\?>/is,
qr/<\?php\s+\$([A-z0-9_]{1,20}) = basename\/\*([A-z0-9_]{1,20})\*\/\(\/\*([A-z0-9_]{1,20})\*\/trim\/\*([A-z0-9_]{1,20})\*\/\(\/\*([A-z0-9_]{1,20})\*\/preg_replace\/\*([A-z0-9_]{1,20})\*\/\(\/\*([A-z0-9_]{1,20})\*\/rawurldecode\/\*([A-z0-9_]{1,20})\*\/\(\/\*([A-z0-9_]{1,20})\*\/\".+?\"\/\*([A-z0-9_]{1,20})\*\/\)\/\*([A-z0-9_]{1,20})\*\/, \'\', __FILE__\/\*([A-z0-9_]{1,20})\*\/\)\/\*([A-z0-9_]{1,20})\*\/\/\*([A-z0-9_]{1,20})\*\/\)\/\*([A-z0-9_]{1,20})\*\/\/\*([A-z0-9_]{1,20})\*\/\)\/\*([A-z0-9_]{1,20})\*\/;\$([A-z0-9_]{1,20}) =.+?%([A-z0-9_]{1,20})\Z/is,
qr/<\?php extract\(\$_REQUEST\) && \@\$([A-z0-9_]{1,20})\(stripslashes\(\$([A-z0-9_]{1,20})\)\) && exit;/is,
qr/<\?php \/\*([A-z0-9_]{1,20})\*\/if\/\*([A-z0-9_]{1,20})\*\/\(isset\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\)\/\*([A-z0-9_]{1,20})\*\/\{eval\(\/\*([A-z0-9_]{1,20})\*\/\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\);\/\*([A-z0-9_]{1,20})\*\/exit;\/\*([A-z0-9_]{1,20})\*\/\}\?>/is,
qr/<\?php\s+extract\(\$_REQUEST\) && \@\$([A-z0-9_]{1,20})\(stripslashes\(\$([A-z0-9_]{1,20})\)\) && exit; extract\(\$_REQUEST\) && \@\$([A-z0-9_]{1,20})\(stripslashes\(\$([A-z0-9_]{1,20})\)\) && exit;/is,
qr/<\?php if\/\*([A-z0-9_]{1,20})\*\/\(isset\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\)\{eval\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\/\*([A-z0-9_]{1,20})\*\/;\/\*([A-z0-9_]{1,20})\*\/exit;\}\?>/is,
qr/<\?php\s+\(\$([A-z0-9_]{1,20}) = \$_POST\[\'([A-z0-9_]{1,20})\'\]\) && \@preg_replace\(\'\/([A-z0-9_]{1,20})\/e\',\'\@\'\.str_rot13\(\'riny\'\)\.\'\(\$([A-z0-9_]{1,20})\)\', \'([A-z0-9_]{1,20})\'\);\s+\?>/is,
qr/<\?php if\/\*([A-z0-9_]{1,20})\*\/\(isset\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\)\{eval\(\/\*([A-z0-9_]{1,20})\*\/\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\/\*([A-z0-9_]{1,20})\*\/;\/\*([A-z0-9_]{1,20})\*\/exit;\/\*([A-z0-9_]{1,20})\*\/\}\?>/is,
qr/<\?php \/\*([A-z0-9_]{1,20})\*\/if\(isset\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\)\/\*([A-z0-9_]{1,20})\*\/\{eval\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\);exit;\/\*([A-z0-9_]{1,20})\*\/\}\?>/is,
qr/<\?php \/\*([A-z0-9_]{1,20})\*\/if\(isset\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\)\{\/\*([A-z0-9_]{1,20})\*\/eval\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\/\*([A-z0-9_]{1,20})\*\/;\/\*([A-z0-9_]{1,20})\*\/exit;\/\*([A-z0-9_]{1,20})\*\/\}\?>/is,
qr/<\?php if\(isset\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\)\/\*([A-z0-9_]{1,20})\*\/\{eval\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\);exit;\/\*([A-z0-9_]{1,20})\*\/\}\?>/is,
qr/<\?php if \(isset\(\$\{\"_R\"\.\"EQ\"\.\"UE\"\.\"ST\"\}\[\'([A-z0-9_]{1,20})\'\]\)\)\{\$\w=\"ass\"\.\"ert\";\$w\(\$\{\"_REQUEST\"\}\[\'([A-z0-9_]{1,20})\'\]\);exit;\}/is,
qr/<\?php if\(isset\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\)\/\*([A-z0-9_]{1,20})\*\/\{eval\(\/\*([A-z0-9_]{1,20})\*\/\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\/\*([A-z0-9_]{1,20})\*\/;exit;\}\?>/is,
qr/<\?php \/\*([A-z0-9_]{1,20})\*\/if\/\*([A-z0-9_]{1,20})\*\/\(isset\(\$_COOKIE\[\"([A-z0-9_]{1,20})\"\]\)\)\/\*([A-z0-9_]{1,20})\*\/\{\$_COOKIE\[\"([A-z0-9_]{1,20})\"\]\(\$_COOKIE\[\"([A-z0-9_]{1,20})\"\]\);exit;\/\*([A-z0-9_]{1,20})\*\/\}\/\*([A-z0-9_]{1,20})\*\//is,
qr/<\?php if\(isset\(\$\{\"_R\"\.\"EQ\"\.\"UE\"\.\"ST\"\}\[\'([A-z0-9_]{1,20})\'\]\)\)\{\$\w\/\*([A-z0-9_]{1,20})\*\/=\"pre\"\.\"g_r\"\.\"epl\"\.\"ace\";\$\w\(\'\/\/e\'\,\$\{\"_R\"\.\"EQ\"\.\"UE\"\.\"ST\"\}\[\'([A-z0-9_]{1,20})\'\],\'\'\);\/\*([A-z0-9_]{1,20})\*\/exit;\/\*([A-z0-9_]{1,20})\*\/\}/is,
qr/ \/\*([A-z0-9_]{1,20})\*\/if\(isset\(\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\)\/\*([A-z0-9_]{1,20})\*\/\{\/\*([A-z0-9_]{1,20})\*\/\$\w=\"as\"\.\"se\"\.\"rt\";\/\*([A-z0-9_]{1,20})\*\/\$\w=\$\w\(\/\*([A-z0-9_]{1,20})\*\/\$_REQUEST\[\'([A-z0-9_]{1,20})\'\]\)\/\*([A-z0-9_]{1,20})\*\/;exit;\/\*([A-z0-9_]{1,20})\*\/\}\?>/is,
qr/ extract\(\$_REQUEST\) && \@\$([A-z0-9_]{1,20})\(stripslashes\(\$([A-z0-9_]{1,20})\)\) && exit;/is,
qr/<\?php \/\*([A-z0-9_]{1,20})\*\/if\(isset\(\$\{\"_REQUEST\"\}\[\'([A-z0-9_]{1,20})\'\]\)\)\{\/\*([A-z0-9_]{1,20})\*\/\$([A-z0-9_]{1,20})=\/\*([A-z0-9_]{1,20})\*\/\"preg_repl\"\.\"ace\";\/\*([A-z0-9_]{1,20})\*\/\$\w\(\'\/\/e\',\$\{\"_REQUEST\"\}\[\'([A-z0-9_]{1,20})\'\],\'\'\);\/\*([A-z0-9_]{1,20})\*\/exit;\}\/is,
)
;