Merge branch 'master' of github.com:nbs-system/php-malware-finder

4 files changed, 69 insertions, 49 deletions

diff --git a/php-malware-finder/README.md b/php-malware-finder/README.md
index 59187b1..67dad30 100644
--- a/php-malware-finder/README.md
+++ b/php-malware-finder/README.md
@@ -14,7 +14,8 @@ Detect potentially malicious PHP files.
 
 ## What does it detect?
 
-PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files using PHP functions often used in malwares/webshells.
+PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as
+files using PHP functions often used in malwares/webshells.
 
 The following list of encoders/obfuscators/webshells are also detected:
 
@@ -33,9 +34,14 @@ The following list of encoders/obfuscators/webshells are also detected:
 * [tennc]( http://tennc.github.io/webshell/ )
 * [web-malware-collection]( https://github.com/nikicat/web-malware-collection )
 
+
+Of course it's easy to bypass PMF, but its goal is to catch kiddies and idiots,
+not people with a working brain.
+
 ## How does it work?
 
-Detection is performed by crawling the filesystem and testing files against a [set]( https://github.com/nbs-system/php-malware-finder/blob/master/malwares.yara )
+Detection is performed by crawling the filesystem and testing files against a
+[set]( https://github.com/nbs-system/php-malware-finder/blob/master/malwares.yara )
 of [YARA](https://plusvic.github.io/yara/) rules. Yes, it's that simple!
 
 
@@ -47,6 +53,7 @@ Usage phpmalwarefinder [-cfhw] <file|folder> ...
         -c  Optional path to a configuration file
         -f  Fast mode
         -h  Show this help message
+    -t  Specify the number of threads to use (8 by default)
         -v  Verbose mode
 ```
 
@@ -59,7 +66,8 @@ $ yara -r ./malwares.yara /var/www
 ## Whitelisting
 
 Check the [whitelist.yara]( https://github.com/nbs-system/php-malware-finder/blob/master/whitelist.yara ) file.
-If you're lazy, you can generate whitelists for entire folders with the [generate_whitelist.py]( https://github.com/nbs-system/php-malware-finder/blob/master/generate_whitelist.py ) script.
+If you're lazy, you can generate whitelists for entire folders with the
+[generate_whitelist.py]( https://github.com/nbs-system/php-malware-finder/blob/master/generate_whitelist.py ) script.
 
 ## Licensing
 
diff --git a/php-malware-finder/malwares.yara b/php-malware-finder/malwares.yara
index f733bc3..d0b5c35 100644
--- a/php-malware-finder/malwares.yara
+++ b/php-malware-finder/malwares.yara
@@ -57,16 +57,17 @@ private rule CloudFlareBypass
 rule ObfuscatedPhp
 {
     strings:
-        $eval = /[;{}][\t ]*@?(eval|preg_replace|system|exec|assert|passthru)\(/  // ;eval( <- this is dodgy
-        $b374k = /'ev'\.'al'/
+        $eval = /(<\?php\s*\n*\r*|[;{}])\s*@?(eval|preg_replace|system|exec|assert|passthru|win_shell_execute)/  // ;eval( <- this is dodgy
+        $b374k = "'ev'.'al'"
         $align = /(\$\w+=[^;]*)*;\$\w+=@?\$\w+\(/  //b374k
-        $oneliner = /<\?php\s*\n*\r*\s*(eval|preg_replace|system|exec|assert|passthru)\(/
+        $oneliner = /<\?php\s*\n*\r*\s*@?(eval|preg_replace|system|exec|assert|passthru|win_shell_execute)\(/
         $weevely3 = /\$\w=\$[a-zA-Z]\('',\$\w\);\$\w\(\);/  // weevely3 launcher
         $c99_launcher = /;\$\w+\(\$\w+(,\s?\$\w+)+\);/  // http://bartblaze.blogspot.fr/2015/03/c99shell-not-dead.html
         $strange_arg = /\${\$[0-9a-zA-z]+}/
         $too_many_chr = /(chr\([\d]+\)\.){2,}?/
-        $b64_concat = /('[A-Za-z0-9=+]*'\.){4,8}?/
-    condition:
+        $many_comments = /\/\*.{,28}\*\/[^\/]*\/\*/  // Something like as/* */ser/* */t
+        $b64_concat = /('[A-Za-z0-9=+]*'\.){4,8}?/    
+condition:
         any of them and not IsWhitelisted
 }
 
@@ -106,14 +107,13 @@ rule DodgyPhp
     strings:
         $vars = /\$__+/ // $__ is rarely used in legitimate scripts
         $double_encoding = /(base64_decode\s*\(\s*){2}/
-        $execution = /(eval|assert|passthru|exec|system|win_shell_execute|base64_decode)\s*\(\s*(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\?\$_(GET|REQUEST|POST))/
+        $execution = /(eval|assert|passthru|exec|system|win_shell_execute|base64_decode)\s*\(\s*(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\?\$_(GET|REQUEST|POST|COOKIE))/
         $basedir_bypass = /(curl_init\([\"']file:[\"']|file:file:\/\/)/
         $safemode_bypass = /\x00\/\.\.\/|LD_PRELOAD/
         $shellshock = /putenv\(["']PHP_[^=]=\(\) { [^}] };/
-        $ini_get =
-        /ini_get\(['"](safe_mode|open_basedir|disable_function|safe_mode_exec_dir|safe_mode_include_dir|register_globals)['"]\)/
-        $restore_bypass =
-        /ini_restore\(['"](safe_mode|open_basedir|disable_function|safe_mode_exec_dir|safe_mode_include_dir|register_globals)['"]\)/
+        $restore_bypass = /ini_restore\(['"](safe_mode|open_basedir|disable_function|safe_mode_exec_dir|safe_mode_include_dir|register_globals)['"]\)/
+        $ini_get = /ini_get\(['"](safe_mode|open_basedir|disable_function|safe_mode_exec_dir|safe_mode_include_dir|register_globals)['"]\)/
+     
         $various = "<!--#exec cmd="  //http://www.w3.org/Jigsaw/Doc/User/SSI.html#exec
         $pr = /(preg_replace(_callback)?|mb_ereg_replace|preg_filter)\s*\(['"]\/[^\/]*\/e['"]/  // http://php.net/manual/en/function.preg-replace.php
         $include = /include\([^\.]+\.(png|jpg|gif|bmp)/  // Clever includes
@@ -121,6 +121,7 @@ rule DodgyPhp
         $udp_dos = /sockopen\s*\(['"]udp:\/\//
         $iniset_urlinclude = /ini_set\('allow_url_include,\ * 1'\)/
         $iis_com = /IIS:\/\/localhost\/w3svc/
+        $user_function = /(call_user_func|create_function)/
         $disable_magic_quotes = /set_magic_quotes_runtime\(0\)/
 
     condition:
@@ -174,30 +175,37 @@ rule DangerousPhp
 rule DodgyStrings
 {
     strings:
+        $ = "/../../../"
+        $ = /\/bin\/(ba)?sh/ fullword
         $ = "/etc/passwd"
-        $ = "/etc/shadow"
+        $ = "/etc/proftpd.conf"
         $ = "/etc/resolv.conf"
+        $ = "/etc/shadow"
         $ = "/etc/syslog.conf"
-        $ = "/etc/proftpd.conf"
+        $ = "/proc/cpuinfo" fullword
+        $ = "/windows/system32/"
+        $ = "WScript.Shell"
         $ = "WinExec"
-        $ = "uname -a" fullword
-        $ = "nc -l" fullword
-        $ = "ls -la" fullword
+        $ = "b374k" fullword nocase
+        $ = "backdoor" fullword nocase
+        $ = "c99shell" fullword nocase
         $ = "cmd.exe" fullword nocase
-        $ = "ipconfig" fullword nocase
-        $ = "find . -type f" fullword
         $ = "defaced" fullword nocase
-        $ = "slowloris" fullword nocase
-        $ = "id_rsa" fullword
-        $ = "backdoor" fullword nocase
-        $ = "webshell" fullword nocase
         $ = "exploit" fullword nocase
-        $ = "hacking" fullword nocase
-        $ = "/proc/cpuinfo" fullword
-        $ = "/bin/sh" fullword
-        $ = "/bin/bash" fullword
+        $ = "find . -type f" fullword
+        $ = /hack(ing|er)/ nocase
+        $ = "hashcrack" nocase
+        $ = "id_rsa" fullword
+        $ = "ipconfig" fullword nocase
+        $ = "kingdefacer" nocase
+        $ = "locus7s" nocase
+        $ = "ls -la" fullword
+        $ = "nc -l" fullword
         $ = "ps -aux" fullword
-        $ = "b374k" fullword
+        $ = "rootkit" fullword nocase
+        $ = "slowloris" fullword nocase
+        $ = "uname -a" fullword
+        $ = "warez" fullword nocase
         $ = /(reverse|web)\s*shell/ nocase
 
         $vbs = /language\s*=\s*vbscript/ nocase
@@ -210,28 +218,23 @@ rule DodgyStrings
 rule Websites
 {
     strings:
-        $ = "milw0rm.com"
-        $ = "exploit-db.com"
         $ = "1337day.com"
-        $ = "rapid7.com"
-        $ = "shodan.io"
-        $ = "packetstormsecurity"
+        $ = "antichat.ru"
+        $ = "ccteam.ru"
         $ = "crackfor" nocase
-        $ = "md5.rednoize"
-        $ = "hashcracking" nocase
         $ = "darkc0de" nocase
-        $ = "securityfocus" nocase
-        $ = "antichat.ru"
-        $ = "KingDefacer" nocase
+        $ = "egyspider.eu"
+        $ = "exploit-db.com"
+        $ = "fopo.com.ar"  /* Free Online Php Obfuscator */
+        $ = "hashchecker.com"
+        $ = "hashkiller.com" nocase
         $ = "md5crack.com"
         $ = "md5decrypter.com"
-        $ = "hashkiller.com"
-        $ = "hashchecker.com"
-        $ = "www.fopo.com.ar"  /* Free Online Php Obfuscator */
-        $ = "ccteam.ru"
-        $ = "locus7s.com"
-        $ = "b374k"
-        $ = "www.egyspider.eu"
+        $ = "milw0rm.com"
+        $ = "packetstormsecurity" nocase
+        $ = "rapid7.com"
+        $ = "securityfocus" nocase
+        $ = "shodan.io"
 
     condition:
         any of them and not IsWhitelisted
diff --git a/php-malware-finder/phpmalwarefinder b/php-malware-finder/phpmalwarefinder
index 20d3cee..49cf8ce 100755
--- a/php-malware-finder/phpmalwarefinder
+++ b/php-malware-finder/phpmalwarefinder
@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 
+
 YARA=$(type -P yara)
 CONFIG_PATH='/etc/phpmalwarefinder/malwares.yara'
 IONICE_BIN=$(type -P ionice)
@@ -50,12 +51,13 @@ Usage ${0##*/} [-cfhw] <file|folder> ...
     -c  Optional path to a configuration file
     -f  Fast mode
     -h  Show this help message
+    -t Specify the number of threads to use (8 by default)
     -v  Verbose mode
 EOF
 }
 
 OPTIND=1
-while getopts "c:fhv" opt; do
+while getopts "c:fht:v" opt; do
     case "$opt" in
         h)
             show_help
@@ -67,6 +69,9 @@ while getopts "c:fhv" opt; do
         c)
             CONFIG_PATH=${OPTARG}
             ;;
+        t)
+            OPTS="${OPTS} --threads=${OPTARG}"
+            ;;
         v)
             OPTS="${OPTS} -s"
             ;;
@@ -90,7 +95,7 @@ then
     exit 1
 fi
 
-if [ -z $@ ]
+if [ -z "$@" ]
 then
     show_help
     exit 1
diff --git a/php-malware-finder/whitelist.yara b/php-malware-finder/whitelist.yara
index a798ee8..107c638 100644
--- a/php-malware-finder/whitelist.yara
+++ b/php-malware-finder/whitelist.yara
@@ -23,7 +23,11 @@ private rule Wordpress : Blog
         /* Wordpress 3.2.1 */
         hash.sha1(0, filesize)  == "b4f53b8c360f9e47cc63047305a0ce2e3ff6a251" or // wp-includes/functions.php
         hash.sha1(0, filesize)  == "ac8298df16a560c80fb213ef3f51f90df8ef5292" or // wp-includes/class-phpmailer.php
-        hash.sha1(0, filesize)  == "232e4705e3aa28269c4d5e4a4a700bb7a2d06f24" // wp-admin/includes/menu.php
+        hash.sha1(0, filesize)  == "232e4705e3aa28269c4d5e4a4a700bb7a2d06f24" or // wp-admin/includes/menu.php
+
+        /* Wordpress 4.4 */
+        hash.sha1(0, filesize)  == "2fdf93ae88735d062a8635ac1d22a6904cb89ab8" or // wp-includes/formatting.php
+        hash.sha1(0, filesize)  == "ccd23ef96a588840943fba081bfa6f88531c4abc" // wp-admin/includes/class-pclzip.php
 }
 
 private rule Prestashop : ECommerce