Sorted a bit + removed '.js' as this was to much and kicked out .json, too.

[ctracker.git] / libs / lib_detector.php

diff --git a/libs/lib_detector.php b/libs/lib_detector.php
index 5ed9917842e8886f5390ce17cfb0c246078fb631..90459c9f184bda2a2a29fedfb91fb78d916ff19e 100644 (file)
--- a/libs/lib_detector.php
+++ b/libs/lib_detector.php
@@ -73,7 +73,7 @@ function initCrackerTrackerArrays () {
                // Other Linux programs (+ brace)
                'locate(', 'grep(', 'kill(', 'mcd(', 'mrd(', 'rm(', 'mv(', 'rmdir(',
                'chmod(', 'chmod(', 'chown(', 'chgrp(', 'passwd(', 'vi(', 'cp(',
-               'mdir(', 'esystem(', 'chr(', 'wget(', 'rush(', 'echr(',
+               'mdir(', 'system(', 'chr(', 'wget(', 'rush(', 'echr(',
 
                // Other Linux programs (+ equal)
                'mcd=', 'mrd=', 'chmod=', 'chr=', 'rush=', 'echr=',
@@ -87,8 +87,8 @@ function initCrackerTrackerArrays () {
                '/chgrp', '/chown', '/chmod', 'chown ', 'chmod ', 'chgrp ',
 
                // Compiler/interpreter
-               'g++ ', 'c++ ', 'cc ', 'bin/./python', 'bin/python', 'bin/tclsh',
-               'bin/./tclsh', 'bin/nasm', 'bin/./nasm', '/perl', 'perl ', 'cmd.exe',
+               'bin/g++ ', 'bin/c++ ', 'cc ', 'bin/python', 'bin/python', 'bin/tclsh',
+               'bin/tclsh', 'bin/nasm', '/perl', 'cmd.exe',
                'nc.exe', 'ftp.exe',
 
                // php.ini settings
@@ -103,7 +103,7 @@ function initCrackerTrackerArrays () {
                'php_', 'class_', '_class.php', 'db_mysql.inc',
 
                // PHP arrays
-               '_PHPLIB',
+               '_phplib', '__callbackparam',
 
                // Generic remote inclusion
                '=http://', '=https://',
@@ -135,6 +135,9 @@ function initCrackerTrackerArrays () {
                // Attempts to insert links into a badly secured URL
                '%3E%3C',
 
+               // Request header being inserted
+               'content-type',
+
                // /proc/ and other forbidden paths
                'proc/self/environ',
 
@@ -144,13 +147,40 @@ function initCrackerTrackerArrays () {
                // @TODO Misc/unsorted
                'cgi-', '.eml', '$_request', '$_get', '$request', '$get', '.system',
                '&aim', 'new_password', '&icq', '.conf', 'motd ', 'HTTP/1.',
-               'window.open', 'img src', 'img src', '.jsp', 'servlet',
-               'wwwacl', '.js', '.jsp', 'server-info', 'server-status',
-               'secure_site, ok', 'chunked', 'org.apache', '/servlet/con',
-               '<script', 'mod_gzip_status', '.system', 'http_',
+               'window.open', 'img src', 'img src', '.jsp', 'servlet', 'org.apache',
+               'wwwacl', 'server-info', 'server-status', '/servlet/con', 'http_',
+               'secure_site, ok', 'chunked''<script', 'mod_gzip_status', '.system',
                'uol.com', ',0x', '(0x'
        );
 
+       // BLock these words found in User-Agent
+       $GLOBALS['ctracker_ua_blacklist'] = array(
+               // Compiler/interpreter
+               'bin/g++ ', 'bin/c++ ', 'cc ', 'bin/python', 'bin/python', 'bin/tclsh',
+               'bin/tclsh', 'bin/nasm', '/perl', 'cmd.exe',
+               'nc.exe', 'ftp.exe', 'wget ', 'system(', 'curl ',
+
+               // php.ini settings
+               'allow_url_fopen', 'allow_url_include', 'auto_prepend_file', 'disable_functions', 'safe_mode',
+
+               // PHP commands/scripts
+               'fopen', 'fwrite', 'phpinfo()', '\<?', '?\>', 'base64_decode', 'file_put_contents',
+               'set_magic_quotes_runtime', 'set_magic_quotes_runtime', 'display_errors', 'passthru',
+
+               // Typical PHP script remote-inclusions and typical include file names
+               '.inc.php', '.lib.php', '.class.php', 'config.php', '.inc', '_php',
+               'php_', 'class_', '_class.php', 'db_mysql.inc',
+
+               // PHP arrays
+               '_phplib', '__callbackparam',
+
+               // Request header being inserted
+               'content-type',
+
+               // /proc/ and other forbidden paths
+               'proc/self/environ',
+       );
+
        // Block these words found in POST requests
        $GLOBALS['ctracker_post_blacklist'] = array(
                // This line is for detecting hidden link spam in wikis, forums, guestbooks, etc.
@@ -160,6 +190,9 @@ function initCrackerTrackerArrays () {
                'starhack', 'DeLiMehmet', 'hisset', 'Hisset', 'delimert', 'MecTruy'
        );
 
+       // Also block these requests (mostly you don't want CONNECT to some SMTP sites)
+       $GLOBALS['ctracker_blocked_requests'] = array('CONNECT' => TRUE);
+
        // Init more elements
        $GLOBALS['ctracker_post_track']   = '';
        $GLOBALS['ctracker_checked_get']  = '';
@@ -170,8 +203,8 @@ function initCrackerTrackerArrays () {
 // Checks for worms
 function isCrackerTrackerWormDetected () {
        // Check against the whole list
-       $GLOBALS['ctracker_checked_get'] = urldecode(str_ireplace($GLOBALS['ctracker_get_blacklist'], '*', crackerTrackerQueryString()));
-       $GLOBALS['ctracker_checked_ua']  = urldecode(str_ireplace($GLOBALS['ctracker_get_blacklist'], '*', crackerTrackerUserAgent()));
+       $GLOBALS['ctracker_checked_get'] = urldecode(str_ireplace($GLOBALS['ctracker_get_blacklist'], '*', crackerTrackerQueryString(TRUE)));
+       $GLOBALS['ctracker_checked_ua']  = urldecode(str_ireplace($GLOBALS['ctracker_ua_blacklist'], '*', crackerTrackerUserAgent(TRUE)));
 
        /*
         * If it differs to original and the *whole* request string is not in
@@ -179,12 +212,14 @@ function isCrackerTrackerWormDetected () {
         */
        $isWorm = (
                (
-                       $GLOBALS['ctracker_checked_get'] != crackerTrackerQueryString() && (!in_array(crackerTrackerQueryString(), $GLOBALS['ctracker_whitelist']))
+                       $GLOBALS['ctracker_checked_get'] != crackerTrackerQueryString(TRUE) && (!in_array(crackerTrackerQueryString(TRUE), $GLOBALS['ctracker_whitelist']))
+               ) || (
+                       $GLOBALS['ctracker_checked_ua'] != crackerTrackerUserAgent(TRUE)
                ) || (
-                       $GLOBALS['ctracker_checked_ua'] != crackerTrackerUserAgent()
+                       isset($GLOBALS['ctracker_blocked_requests'][crackerTrackerRequestMethod()])
                )
        );
-       //* DEBUG-DIE: */ die('isWorm='.intval($isWorm).PHP_EOL.'get="'.$GLOBALS['ctracker_checked_get'].'"'.PHP_EOL.'"'.crackerTrackerQueryString().'"'.PHP_EOL.'ua="'.$GLOBALS['ctracker_checked_ua'].'"'.PHP_EOL.'"'.crackerTrackerUserAgent().'"'.PHP_EOL);
+       //* DEBUG-DIE: */ die('isWorm='.intval($isWorm).PHP_EOL.'get='.PHP_EOL.'"'.$GLOBALS['ctracker_checked_get'].'"'.PHP_EOL.'"'.crackerTrackerQueryString().'"'.PHP_EOL.'ua='.PHP_EOL.'"'.$GLOBALS['ctracker_checked_ua'].'"'.PHP_EOL.'"'.crackerTrackerUserAgent().'"'.PHP_EOL);
 
        // Return it
        return $isWorm;
@@ -196,10 +231,10 @@ function isCrackerTrackerPostAttackDetected () {
        $GLOBALS['ctracker_post_track'] = urldecode(implode_r('&', $_POST));
 
        // Check for suspicious POST data
-       $GLOBALS['ctracker_checked_post'] = urldecode(str_ireplace($GLOBALS['ctracker_post_blacklist'], '*', $GLOBALS['ctracker_post_track']));
+       $GLOBALS['ctracker_checked_post'] = urldecode(str_ireplace($GLOBALS['ctracker_post_blacklist'], '*', crackerTrackerSanitize($GLOBALS['ctracker_post_track'])));
 
        // Is it detected?
-       return ((isCrackerTrackerWormDetected()) || ($GLOBALS['ctracker_checked_post'] != $GLOBALS['ctracker_post_track']));
+       return ((isCrackerTrackerWormDetected()) || ($GLOBALS['ctracker_checked_post'] != crackerTrackerSanitize($GLOBALS['ctracker_post_track'])));
 }
 
 // Prepares a mail and send it out
@@ -248,7 +283,7 @@ function crackerTrackerSendMail ($mail, $recipient = NULL, $subject = NULL) {
        $rowData = array(
                'remote_addr' => determineCrackerTrackerRealRemoteAddress(),
                'proxy_addr'  => getenv('REMOTE_ADDR'),
-               'check_worm'  => $GLOBALS['ctracker_checked_get'],
+               'check_get'   => $GLOBALS['ctracker_checked_get'],
                'server_name' => crackerTrackerServerName()
        );
 
@@ -288,16 +323,16 @@ function sendCrackerTrackerPostMail () {
        // Mail text
        $mail = 'POST-Attack detected:
 -----------------------------------------------------
-Remote-IP            : '.determineCrackerTrackerRealRemoteAddress().'
-User-Agent           : '.crackerTrackerUserAgent().'
-Request-string       : '.crackerTrackerQueryString().'
-Filtered string      : '.$GLOBALS['ctracker_checked_get'].'
-Server               : '.crackerTrackerServerName().'
-Script               : '.crackerTrackerScriptName().'
-Referrer             : '.crackerTrackerReferer().'
+Remote-IP            : ' . determineCrackerTrackerRealRemoteAddress() . '
+User-Agent           : ' . crackerTrackerUserAgent() . '
+Request-string       : ' . crackerTrackerQueryString() . '
+Filtered string      : ' . $GLOBALS['ctracker_checked_get'] . '
+Server               : ' . crackerTrackerServerName() . '
+Script               : ' . crackerTrackerScriptName() . '
+Referrer             : ' . crackerTrackerReferer() . '
 -----------------------------------------------------
-POST string          : '.$GLOBALS['ctracker_post_track'].'
-Filtered POST string : '.$GLOBALS['ctracker_checked_post'].'
+POST string          : ' . $GLOBALS['ctracker_post_track'] . '
+Filtered POST string : ' . $GLOBALS['ctracker_checked_post'] . '
 -----------------------------------------------------
 ';
 
@@ -352,7 +387,8 @@ function crackerTrackerLogAttack () {
                'user_agent'     => crackerTrackerUserAgent(),
                'get_data'       => crackerTrackerQueryString(),
                'post_data'      => $GLOBALS['ctracker_post_track'],
-               'check_worm'     => $GLOBALS['ctracker_checked_get'],
+               'check_ua'       => $GLOBALS['ctracker_checked_ua'],
+               'check_get'      => $GLOBALS['ctracker_checked_get'],
                'check_post'     => $GLOBALS['ctracker_checked_post'],
                'server_name'    => crackerTrackerServerName(),
                'script_name'    => crackerTrackerScriptName(),
@@ -389,6 +425,3 @@ function crackerTrackerAlertCurrentUser () {
        // And stop here
        die();
 }
-
-// [EOF]
-?>