summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorjvoisin2016-01-04 18:09:53 +0100
committerjvoisin2016-01-04 18:09:53 +0100
commit1c6cf5f703c3ddeafa43237150f750d4b4ca6a1f (patch)
treeaa86b9108d4be65f7777377587d81592e6063c74
parente6c04caba89f6915c84b247990382461851e08f3 (diff)
Revert a broken/wip commit
-rw-r--r--malwares.yara1
-rwxr-xr-xphpmalwarefinder22
2 files changed, 3 insertions, 20 deletions
diff --git a/malwares.yara b/malwares.yara
index ee6ea07..c3679b2 100644
--- a/malwares.yara
+++ b/malwares.yara
@@ -199,6 +199,7 @@ rule DodgyStrings
199 $ = "ps -aux" fullword 199 $ = "ps -aux" fullword
200 $ = "b374k" fullword 200 $ = "b374k" fullword
201 $ = /(reverse|web)\s*shell/ nocase 201 $ = /(reverse|web)\s*shell/ nocase
202 $ = /\t{16,}?/
202 203
203 $vbs = /language\s*=\s*vbscript/ nocase 204 $vbs = /language\s*=\s*vbscript/ nocase
204 $asp = "scripting.filesystemobject" nocase 205 $asp = "scripting.filesystemobject" nocase
diff --git a/phpmalwarefinder b/phpmalwarefinder
index 186218a..2c11fe0 100755
--- a/phpmalwarefinder
+++ b/phpmalwarefinder
@@ -1,5 +1,6 @@
1#!/usr/bin/env bash 1#!/usr/bin/env bash
2 2
3
3YARA=$(type -P yara) 4YARA=$(type -P yara)
4CONFIG_PATH='/etc/phpmalwarefinder/malwares.yara' 5CONFIG_PATH='/etc/phpmalwarefinder/malwares.yara'
5IONICE_BIN=$(type -P ionice) 6IONICE_BIN=$(type -P ionice)
@@ -27,23 +28,6 @@ else
27 fi 28 fi
28fi 29fi
29 30
30# before starting yara, check if the file
31one_line_trick() {
32
33 for file in $(find $@ -type f); do
34 line_num=$(wc -l $file | cut -d' ' -f1)
35 char_num=$(wc -c $file | cut -d' ' -f1)
36
37 if [ "$line_num" -le "2" ]; then
38 # humm, 2 lines long file ?
39 if [ "$char_num" -ge "300" ]; then
40 echo TooShort $file
41 fi;
42 fi;
43 done;
44
45}
46
47show_help() { 31show_help() {
48 cat << EOF 32 cat << EOF
49Usage ${0##*/} [-cfhw] <file|folder> ... 33Usage ${0##*/} [-cfhw] <file|folder> ...
@@ -94,7 +78,7 @@ then
94 exit 1 78 exit 1
95fi 79fi
96 80
97if [ -z $@ ] 81if [ -z "$@" ]
98then 82then
99 show_help 83 show_help
100 exit 1 84 exit 1
@@ -108,6 +92,4 @@ fi
108 92
109OPTS="${OPTS} -r ${CONFIG_PATH}" 93OPTS="${OPTS} -r ${CONFIG_PATH}"
110 94
111one_line_trick $@
112
113${NICE} ${NICE_OPTS} $YARA $OPTS $@ 95${NICE} ${NICE_OPTS} $YARA $OPTS $@