From 45cb4e3de8e676fa98f1d87bcfdeba3ab19ce1f9 Mon Sep 17 00:00:00 2001
From: jvoisin
Date: Thu, 8 Dec 2016 11:56:21 +0100
Subject: @eval isn't legit at all

---
 php-malware-finder/php.yar | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/php-malware-finder/php.yar b/php-malware-finder/php.yar
index 1238a95..2ac9027 100644
--- a/php-malware-finder/php.yar
+++ b/php-malware-finder/php.yar
@@ -78,9 +78,10 @@ condition:
 rule DodgyPhp
 {
     strings:
-        $basedir_bypass = /curl_init\s*\(\s*["']file:\/\//
+        $basedir_bypass = /curl_init\s*\(\s*["']file:\/\// nocase
         $basedir_bypass2 = "file:file:///" // https://www.intelligentexploit.com/view-details.html?id=8719
-        $disable_magic_quotes = /set_magic_quotes_runtime\s*\(\s*0/
+        $disable_magic_quotes = /set_magic_quotes_runtime\s*\(\s*0/ nocase
+
         $execution = /(eval|assert|passthru|exec|include|system|pcntl_exec|shell_execute|base64_decode|`|array_map|call_user_func(_array)?)\s*\(\s*(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\?\$_(GET|REQUEST|POST|COOKIE|SERVER))/ nocase  // function that takes a callback as 1st parameter
         $execution2 = /(array_filter|array_reduce|array_walk(_recursive)?|array_walk|assert_options|uasort|uksort|usort|preg_replace_callback|iterator_apply)\s*\(\s*[^,]+,\s*(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\?\$_(GET|REQUEST|POST|COOKIE|SERVER))/ nocase  // functions that takes a callback as 2nd parameter
         $execution3 = /(array_(diff|intersect)_u(key|assoc)|array_udiff)\s*\(\s*([^,]+\s*,?)+\s*(base64_decode|php:\/\/input|str_rot13|gz(inflate|uncompress)|getenv|pack|\\?\$_(GET|REQUEST|POST|COOKIE|SERVER))\s*\[[^]]+\]\s*\)+\s*;/ nocase  // functions that takes a callback as 2nd parameter
@@ -92,8 +93,9 @@ rule DodgyPhp
         $pr = /(preg_replace(_callback)?|mb_ereg_replace|preg_filter)\s*\(.+(\/|\\x2f)(e|\\x65)['"]/  nocase // http://php.net/manual/en/function.preg-replace.php
         $safemode_bypass = /\x00\/\.\.\/|LD_PRELOAD/
         $shellshock = /\(\)\s*{\s*:\s*;\s*}\s*;/
-        $udp_dos = /fsockopen\s*\(\s*['"]udp:\/\//
+        $udp_dos = /fsockopen\s*\(\s*['"]udp:\/\// nocase
         $various = "<!--#exec cmd="  //http://www.w3.org/Jigsaw/Doc/User/SSI.html#exec
+        $at_eval = /@eval\s*\(/ nocase
 
     condition:
         (any of them) and not IsWhitelisted
-- 
cgit v1.3