Continued:

[ctracker.git] / libs / lib_detector.php

diff --git a/libs/lib_detector.php b/libs/lib_detector.php
index eab50bbf04c6e7829f6addbc82c5c2d5256b9b53..1a932ba40a253422b1f4722204704cff098c57cd 100644 (file)
--- a/libs/lib_detector.php
+++ b/libs/lib_detector.php
@@ -91,8 +91,10 @@ function initCrackerTrackerArrays () {
 
                // Compiler/interpreter
                'bin/g++ ', 'bin/c++ ', 'cc ', 'bin/python', 'bin/python', 'bin/tclsh',
-               'bin/tclsh', 'bin/nasm', '/perl', 'cmd.exe',
-               'nc.exe', 'ftp.exe',
+               'bin/tclsh', 'bin/nasm', '/perl',
+
+               // Windows-related
+               'cmd.exe', 'nc.exe', 'ftp.exe', 'powershell', 'system.net.webclient',
 
                // php.ini settings
                'allow_url_fopen', 'allow_url_include', 'auto_prepend_file', 'disable_functions', 'safe_mode',
@@ -101,6 +103,7 @@ function initCrackerTrackerArrays () {
                // PHP commands/scripts
                'fopen', 'fwrite', 'phpinfo()', '\<?', '?\>', 'base64_decode', 'file_put_contents',
                'set_magic_quotes_runtime', 'set_magic_quotes_runtime', 'display_errors', 'passthru',
+               'call_user_func',
 
                // Typical PHP script remote-inclusions and typical include file names
                '.inc.php', '.lib.php', '.class.php', 'config.php', '.inc', '_php',
@@ -148,17 +151,53 @@ function initCrackerTrackerArrays () {
                // MySQL internal functions
                'name_const',
 
+               // Server configuration (e.g. Apache)
+               'application/x-httpd-php', 'addtype', 'server-info', 'server-status',
+
+               // Annoying script name
+               'vuln.php',
+
                // @TODO Misc/unsorted
                'cgi-', '.eml', '$_request', '$_get', '$request', '$get', '.system',
                '&aim', 'new_password', '&icq', '.conf', 'motd ', 'HTTP/1.',
                'window.open', 'img src', 'img src', '.jsp', 'servlet', 'org.apache',
-               'wwwacl', 'server-info', 'server-status', '/servlet/con', 'http_',
-               'secure_site, ok', 'chunked', '<script', 'mod_gzip_status', '.system',
-               'uol.com', ',0x', '(0x', 'INSERT_RANDOM_NUMBER_HERE',
+               'wwwacl', '/servlet/con', 'http_', 'secure_site, ok', 'chunked',
+               '<script', 'mod_gzip_status', '.system', 'uol.com', ',0x', '(0x',
+               'INSERT_RANDOM_NUMBER_HERE',
        ];
 
        // BLock these words found in User-Agent
        $GLOBALS['ctracker_ua_blacklist'] = [
+               // Compiler/interpreter
+               'bin/g++ ', 'bin/c++ ', 'cc ', 'bin/python', 'bin/python', 'bin/tclsh',
+               'bin/tclsh', 'bin/nasm', '/perl', 'wget ', 'system(', 'curl ',
+
+               // Windows-related
+               'cmd.exe', 'nc.exe', 'ftp.exe', 'powershell', 'system.net.webclient',
+
+               // php.ini settings
+               'allow_url_fopen', 'allow_url_include', 'auto_prepend_file', 'disable_functions', 'safe_mode',
+
+               // PHP commands/scripts
+               'fopen', 'fwrite', 'phpinfo()', '\<?', '?\>', 'base64_decode', 'file_put_contents',
+               'set_magic_quotes_runtime', 'set_magic_quotes_runtime', 'display_errors', 'passthru',
+
+               // Typical PHP script remote-inclusions and typical include file names
+               '.inc.php', '.lib.php', '.class.php', 'config.php', '.inc', '_php',
+               'php_', 'class_', '_class.php', 'db_mysql.inc',
+
+               // PHP arrays
+               '_phplib', '__callbackparam',
+
+               // Request header being inserted
+               'content-type',
+
+               // /proc/ and other forbidden paths
+               'proc/self/environ',
+       ];
+
+       // BLock these words found in User-Agent
+       $GLOBALS['ctracker_ua_blacklist'] = array(
                // Compiler/interpreter
                'bin/g++ ', 'bin/c++ ', 'cc ', 'bin/python', 'bin/python', 'bin/tclsh',
                'bin/tclsh', 'bin/nasm', '/perl', 'cmd.exe',
@@ -171,6 +210,9 @@ function initCrackerTrackerArrays () {
                'fopen', 'fwrite', 'phpinfo()', '\<?', '?\>', 'base64_decode', 'file_put_contents',
                'set_magic_quotes_runtime', 'set_magic_quotes_runtime', 'display_errors', 'passthru',
 
+               // Server configuration (e.g. Apache)
+               'application/x-httpd-php',
+
                // Typical PHP script remote-inclusions and typical include file names
                '.inc.php', '.lib.php', '.class.php', 'config.php', '.inc', '_php',
                'php_', 'class_', '_class.php', 'db_mysql.inc',
@@ -183,14 +225,23 @@ function initCrackerTrackerArrays () {
 
                // /proc/ and other forbidden paths
                'proc/self/environ',
-       ];
+       );
 
        // Block these words found in POST requests
        $GLOBALS['ctracker_post_blacklist'] = [
                // This line is for detecting hidden link spam in wikis, forums, guestbooks, etc.
                ' style=', 'overflow:auto', 'height:1px', 'width:1px', 'display:hidden', 'style.display',
 
-               // "Common" login names from VHCS exploiters ;-)
+               // Windows-related
+               'cmd.exe', 'nc.exe', 'ftp.exe', 'powershell', 'system.net.webclient',
+
+               // Server configuration (e.g. Apache)
+               'application/x-httpd-php',
+
+               // Annoying script name
+               'vuln.php',
+
+               // "Common" login names from VHCS exploiters
                'starhack', 'DeLiMehmet', 'hisset', 'Hisset', 'delimert', 'MecTruy'
        ];