summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJulien (jvoisin) Voisin2016-03-01 13:40:34 +0100
committerJulien (jvoisin) Voisin2016-03-01 13:40:34 +0100
commit3c19560adfe33f7fb8a6be5dc7f3a30158ae44fd (patch)
treeb008fa6908e39c5363c111ff60562436af6e0e29
parent6fe1ff710b5e543384b2c78eeee35c999b444364 (diff)
Simplify the previous commit
-rw-r--r--php-malware-finder/malwares.yara2
-rwxr-xr-xphp-malware-finder/tests.sh2
2 files changed, 2 insertions, 2 deletions
diff --git a/php-malware-finder/malwares.yara b/php-malware-finder/malwares.yara
index edb1ffb..9ba8ff2 100644
--- a/php-malware-finder/malwares.yara
+++ b/php-malware-finder/malwares.yara
@@ -188,7 +188,7 @@ rule DodgyStrings
188{ 188{
189 strings: 189 strings:
190 $ = ".bash_history" 190 $ = ".bash_history"
191 $ = /AddType\s+application\/x-httpd-php\s+\.htaccess/ 191 $ = /AddType\s+application\/x-httpd-php/
192 $ = ".mysql_history" 192 $ = ".mysql_history"
193 $ = ".ssh/authorized_keys" 193 $ = ".ssh/authorized_keys"
194 $ = "/(.*)/e" // preg_replace code execution 194 $ = "/(.*)/e" // preg_replace code execution
diff --git a/php-malware-finder/tests.sh b/php-malware-finder/tests.sh
index fe9141a..895e202 100755
--- a/php-malware-finder/tests.sh
+++ b/php-malware-finder/tests.sh
@@ -73,7 +73,7 @@ run_test artificial/dodgy.php '0x18d:$shellshock: () { :;};'
73run_test artificial/dodgy.php '0x169:$pr: preg_replace ("/\*/e' 73run_test artificial/dodgy.php '0x169:$pr: preg_replace ("/\*/e'
74run_test artificial/dodgy.php '0x1e0:$user_function: call_user_func' 74run_test artificial/dodgy.php '0x1e0:$user_function: call_user_func'
75run_test artificial/dodgy.php '0x1fd:$various: <!--#exec cmd=' 75run_test artificial/dodgy.php '0x1fd:$various: <!--#exec cmd='
76run_test artificial/dodgy.php '0x214:$: AddType application/x-httpd-php .htaccess' 76run_test artificial/dodgy.php '0x214:$: AddType application/x-httpd-php'
77 77
78run_test artificial/bypasses.php 'DodgyPhp' 78run_test artificial/bypasses.php 'DodgyPhp'
79run_test artificial/bypasses.php '0x6d:$execution: call_user_func_array($_POST' 79run_test artificial/bypasses.php '0x6d:$execution: call_user_func_array($_POST'