From 560119d213559db9af8d43bcceafdcc1473c7b67 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Roland=20H=C3=A4der?= Date: Thu, 28 Jul 2016 12:57:49 +0200 Subject: [PATCH] Checking against GET parameters is for the user-agent string not possible as ordinary UAs may get blocked. MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Signed-off-by: Roland Häder --- libs/lib_detector.php | 34 +++++++++++++++++++++++++++++++--- 1 file changed, 31 insertions(+), 3 deletions(-) diff --git a/libs/lib_detector.php b/libs/lib_detector.php index 02e4683..633d7d3 100644 --- a/libs/lib_detector.php +++ b/libs/lib_detector.php @@ -87,8 +87,8 @@ function initCrackerTrackerArrays () { '/chgrp', '/chown', '/chmod', 'chown ', 'chmod ', 'chgrp ', // Compiler/interpreter - 'g++ ', 'c++ ', 'cc ', 'bin/./python', 'bin/python', 'bin/tclsh', - 'bin/./tclsh', 'bin/nasm', 'bin/./nasm', '/perl', 'perl ', 'cmd.exe', + 'bin/g++ ', 'bin/c++ ', 'cc ', 'bin/python', 'bin/python', 'bin/tclsh', + 'bin/tclsh', 'bin/nasm', '/perl', 'cmd.exe', 'nc.exe', 'ftp.exe', // php.ini settings @@ -154,6 +154,34 @@ function initCrackerTrackerArrays () { 'uol.com', ',0x', '(0x' ); + // BLock these words found in User-Agent + $GLOBALS['ctracker_ua_blacklist'] = array( + // Compiler/interpreter + 'bin/g++ ', 'bin/c++ ', 'cc ', 'bin/python', 'bin/python', 'bin/tclsh', + 'bin/tclsh', 'bin/nasm', '/perl', 'cmd.exe', + 'nc.exe', 'ftp.exe', 'wget ', 'system(', 'curl ', + + // php.ini settings + 'allow_url_fopen', 'allow_url_include', 'auto_prepend_file', 'disable_functions', 'safe_mode', + + // PHP commands/scripts + 'fopen', 'fwrite', 'phpinfo()', '\', 'base64_decode', 'file_put_contents', + 'set_magic_quotes_runtime', 'set_magic_quotes_runtime', 'display_errors', 'passthru', + + // Typical PHP script remote-inclusions and typical include file names + '.inc.php', '.lib.php', '.class.php', 'config.php', '.inc', '_php', + 'php_', 'class_', '_class.php', 'db_mysql.inc', + + // PHP arrays + '_PHPLIB', + + // Request header being inserted + 'content-type', + + // /proc/ and other forbidden paths + 'proc/self/environ', + ); + // Block these words found in POST requests $GLOBALS['ctracker_post_blacklist'] = array( // This line is for detecting hidden link spam in wikis, forums, guestbooks, etc. @@ -174,7 +202,7 @@ function initCrackerTrackerArrays () { function isCrackerTrackerWormDetected () { // Check against the whole list $GLOBALS['ctracker_checked_get'] = urldecode(str_ireplace($GLOBALS['ctracker_get_blacklist'], '*', crackerTrackerQueryString(TRUE))); - $GLOBALS['ctracker_checked_ua'] = urldecode(str_ireplace($GLOBALS['ctracker_get_blacklist'], '*', crackerTrackerUserAgent(TRUE))); + $GLOBALS['ctracker_checked_ua'] = urldecode(str_ireplace($GLOBALS['ctracker_ua_blacklist'], '*', crackerTrackerUserAgent(TRUE))); /* * If it differs to original and the *whole* request string is not in -- 2.39.5