Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new patterns

Browse Source
This commit is contained in:
Palma Solutions LTD 2018-05-28 07:44:18 +02:00
parent 4f87bac1aa
commit e18ebfa29e
2 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
malware6.pl
View File

@ -106,6 +106,7 @@ my @regexen = (
qr/<\?php \@passthru\(\"cd \/tmp; wget http:\/\/+?\?>/is, qr/<\?php \@passthru\(\"cd \/tmp; wget http:\/\/+?\?>/is,
qr/<\?php exec\(\"wget http:\/\/.+?\?>/is, qr/<\?php exec\(\"wget http:\/\/.+?\?>/is,
qr/<\?php+?elseif\(function_exists\(\"passthru\"\)\)\{.+?fclose\(\$handle\);.+?echo ex\(\"cd \/dev\/shm;rm -rf ([A-z0-9_]{1,20})\.txt\"\);\s+\?>/is, qr/<\?php+?elseif\(function_exists\(\"passthru\"\)\)\{.+?fclose\(\$handle\);.+?echo ex\(\"cd \/dev\/shm;rm -rf ([A-z0-9_]{1,20})\.txt\"\);\s+\?>/is,
qr/<\?php.+?if \(isset\(\$_GET\[\"cookie\"\]\)\) \{ echo \'cookie=4\'; if \(isset\(\$_POST\[\"([A-z0-9_]{1,20})\"\]\)\) \@eval\(base64_decode\(\$_POST\[\"([A-z0-9_]{1,20})\"\]\)\); exit; \}.+?\?>/is,

1
malwaresh.pl
View File

@ -1091,6 +1091,7 @@ my @regexen = (
qr/<\?php \@passthru\(\"cd \/tmp; wget http:\/\/+?\?>/is, qr/<\?php \@passthru\(\"cd \/tmp; wget http:\/\/+?\?>/is,
qr/<\?php exec\(\"wget http:\/\/.+?\?>/is, qr/<\?php exec\(\"wget http:\/\/.+?\?>/is,
qr/<\?php+?elseif\(function_exists\(\"passthru\"\)\)\{.+?fclose\(\$handle\);.+?echo ex\(\"cd \/dev\/shm;rm -rf ([A-z0-9_]{1,20})\.txt\"\);\s+\?>/is, qr/<\?php+?elseif\(function_exists\(\"passthru\"\)\)\{.+?fclose\(\$handle\);.+?echo ex\(\"cd \/dev\/shm;rm -rf ([A-z0-9_]{1,20})\.txt\"\);\s+\?>/is,
qr/<\?php.+?if \(isset\(\$_GET\[\"cookie\"\]\)\) \{ echo \'cookie=4\'; if \(isset\(\$_POST\[\"([A-z0-9_]{1,20})\"\]\)\) \@eval\(base64_decode\(\$_POST\[\"([A-z0-9_]{1,20})\"\]\)\); exit; \}.+?\?>/is,