config/default.rules


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

# Harden the `chmod` function
sp.disable_function.function("chmod").param("mode").value_r("^[0-9]{2}[67]$").drop();

# Prevent various `mail`-related vulnerabilities
sp.disable_function.function("mail").param("additional_parameters").value_r("\\-").drop();

# Since it's now burned, me might as well mitigate it publicly
sp.disable_function.function("putenv").param("setting").value_r("LD_").drop()

##Prevent various `include`-related vulnerabilities
sp.disable_function.function_r("^(?:require|include)_once$").value_r("\\.(?:php|php7|inc|tpl)$").allow();
sp.disable_function.function_r("^require|include$").value_r("\\.(?:php|php7|inc|tpl)$").allow();
sp.disable_function.function_r("^(?:require|include)_once$").drop();
sp.disable_function.function_r("^require|include$").drop();

# Prevent `system`-related injections
sp.disable_function.function("system").param("command").value_r("[$|;&`\\n]").drop();
sp.disable_function.function("shell_exec").param("command").value_r("[$|;&`\\n]").drop();
sp.disable_function.function("exec").param("command").value_r("[$|;&`\\n]").drop();
sp.disable_function.function("proc_open").param("command").value_r("[$|;&`\\n]").drop();

# Prevent runtime modification of interesting things
sp.disable_function.function("ini_set").param("var_name").value("assert.active").drop();
sp.disable_function.function("ini_set").param("var_name").value("zend.assertions").drop();
sp.disable_function.function("ini_set").param("var_name").value("memory_limit").drop();
sp.disable_function.function("ini_set").param("var_name").value("include_path").drop();
sp.disable_function.function("ini_set").param("var_name").value("open_basedir").drop();

# Detect some backdoors via environnement recon
sp.disable_function.function("ini_get").param("var_name").value_r("(?:allow_url_fopen|open_basedir|suhosin)").drop();
sp.disable_function.function("function_exists").param("function_name").value_r("(?:eval|exec|system)").drop();
sp.disable_function.function("is_callable").param("var").value_r("(?:eval|exec|system)").drop();

# Ghetto sqli hardening
sp.disable_function.function_r("mysqli?_query").param("query").value_r("/\\*").drop();
sp.disable_function.function_r("mysqli?_query").param("query").value_r("--").drop();
sp.disable_function.function_r("mysqli?_query").param("query").value_r("#").drop();
sp.disable_function.function_r("mysqli?_query").param("query").value_r(";.*;").drop();
sp.disable_function.function_r("mysqli?_query").param("query").value_r("benchmark").drop();
sp.disable_function.function_r("mysqli?_query").param("query").value_r("sleep").drop();
sp.disable_function.function_r("mysqli?_query").param("query").value_r("information_schema").drop();
sp.disable_function.function("PDO::query").param("query").value_r("/\\*").drop();
sp.disable_function.function("PDO::query").param("query").value_r("--").drop();
sp.disable_function.function("PDO::query").param("query").value_r("#").drop();
sp.disable_function.function("PDO::query").param("query").value_r(";.*;").drop();
sp.disable_function.function("PDO::query").param("query").value_r("benchmark\\s*\\(").drop();
sp.disable_function.function("PDO::query").param("query").value_r("sleep\\s*\\(").drop();
sp.disable_function.function("PDO::query").param("query").value_r("information_schema").drop();

# Ghetto sqli detection
sp.disable_function.function_r("mysqli?_query").ret("FALSE").drop();
sp.disable_function.function_r("PDO::query").ret("FALSE").drop();

#File upload
sp.disable_function.function("move_uploaded_file").param("destination").value_r("\\.ph").drop();
sp.disable_function.function("move_uploaded_file").param("destination").value_r("\\.ht").drop();