RulesSpec.js

/* eslint-env jasmine */

const Promise = require('bluebird');
const fs      = Promise.promisifyAll(require('graceful-fs'));

const rules              = require('../lib/web_exploit_detector').rules;
const processRulesOnFile = require('../lib/web_exploit_detector').processRulesOnFile;

function setUpFileReadSpy(files) {
  spyOn(fs, 'readFileAsync')
    .and.callFake(function(file) {
      return files[file] ? Promise.resolve(files[file].content) : Promise.reject(new Error('File not found'));
    });
}

function assertRuleForFiles(files, rules) {
  return Promise.mapSeries(
    Object.keys(files).map(file => () =>
      processRulesOnFile(file, rules)
        .then(res => {
          expect(res.file).toBeDefined('Result of processing rules does not contain file name');
          expect(res.file).toBe(file, 'File name in result of processing rules should be ' + file);
          expect(res.matches).toBeDefined('Result of processing rules does not contain a "matches" array');
          expect(res.matches.length).toBe(files[file].match ? 1 : 0, 'Number of matches for this file should be ' + (files[file].match ? '1' : '0'));
          if (files[file].match)
          {
            expect(res.matches[0]).toBeDefined('As file matches rule, first match should be the current rule (' + file + ')');
            if (res.matches[0])
              expect(res.matches[0].id).toBe(rules[0].id, 'ID of matched rule does not match rule being tested');
            expect(fs.readFileAsync).toHaveBeenCalledWith(file);
          }

          return res;
        })
    ),
    thunk => thunk()
  );
}

describe('Rule list', function() {
  it('should contain > 0 rules', function() {
    expect(rules).toBeDefined();
    expect(rules.length).toBeGreaterThan(0);
  });

  it('should be an array of rules, each with a valid format', function() {
    expect(rules).toHaveAllValidRules();
  });

  it('should contain a list of rules, each with an unique ID', function() {
    expect(rules).toHaveUniqueRuleIDs();
  });

});


describe('Rule', function() {

  describe('P64:general:obfuscation:scripts_with_base64', function() {
    it('should match the correct set of files', function(done) {
      const ruleID = 'P64:general:obfuscation:scripts_with_base64';
      const activeRules = rules.filter(x => x.id === ruleID);
      const files = {
        'unmatched.php':                {match: false, content: 'unmatchedstring'},
        'unmatched.txt':                {match: false, content: 'd2ViX2V4cGxvaXRfZGV0ZWN0b3I='},
        'matched.php':                  {match: true,  content: 'd2ViX2V4cGxvaXRfZGV0ZWN0b3I='},
        'matched.ph3':                  {match: true,  content: 'd2ViX2V4cGxvaXRfZGV0ZWN0b3I='},
        'matched.ph4':                  {match: true,  content: 'd2ViX2V4cGxvaXRfZGV0ZWN0b3I='},
        'matched.php3':                 {match: true,  content: 'd2ViX2V4cGxvaXRfZGV0ZWN0b3I='},
        'matched.php4':                 {match: true,  content: 'd2ViX2V4cGxvaXRfZGV0ZWN0b3I='},
        'matched.js':                   {match: true,  content: 'd2ViX2V4cGxvaXRfZGV0ZWN0b3I='},
        'matched.asp':                  {match: true,  content: 'd2ViX2V4cGxvaXRfZGV0ZWN0b3I='},
        'matched.aspx':                 {match: true,  content: 'd2ViX2V4cGxvaXRfZGV0ZWN0b3I='},
        'matched2.php':                 {match: true,  content: '$var = base64_decode("d2ViX2V4cGxvaXRfZGV0ZWN0b3I=");'},
        'unmatched_invalid_base64.php': {match: false, content: 'abcd1234abcd1234abcd1234cd1234='},
        'unmatched_date.php':           {match: false, content: '2017-05-25'},
        'unmatched_file1.php':          {match: false, content: '/path/to/a/file/path/to/a/file/path'},
        'unmatched_file2.php':          {match: false, content: 'path/to/a/fi55le/path/to/a/file/path'},
        'unmatched_file3.php':          {match: false, content: '/path/to/a/file/path/to/a/file.php'},
        'unmatched_file4.php':          {match: false, content: 'a/path/to/a/file/path/to/a/file.php'},
        'unmatched_file5.php':          {match: false, content: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaa-test-file.php'},
        'unmatched_file6.php':          {match: false, content: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaa_test_file.php'},
        'unmatched_file7.php':          {match: false, content: '/filefilefilefilefilefilefilefilefile.php'},
        'unmatched_file8.php':          {match: false, content: 'filefilefilefilefilefilefilefilefile.php'},
        'unmatched_file9.php':          {match: false, content: 'filefilefilefilefilefilefilefilefile.php.'},
        'unmatched_list1.php':          {match: false, content: 'a,list,of,words,a,list,of,words,a,list'},
        'unmatched_list2.php':          {match: false, content: 'a,list,of,words=another,list'},
        'unmatched_snake_case.php':     {match: false, content: 'a_snake_case_var_a_snake_case_var_a_snake'},
        'unmatched_kebab_case.php':     {match: false, content: 'a-kebab-case-var-a-kebab-case-var-a-kebab'},
        'unmatched_class_static.php':   {match: false, content: 'AClassAClassAClass::AStaticVarAStaticAStatic'},
        'unmatched_dotted_name.php':    {match: false, content: 'a.list.of.words.a.list.of.words.a.list.of'},
        'unmatched_comments.php':       {match: false, content: '//comment\n//comment2\n//comment_with_spacers'},
        'unmatched_uris.php':           {match: false, content: 'http://test\nphp://test\ngit://test'},
        'unmatched_dunder.php':         {match: false, content: '__constructaaaaaaaaaaaaaaaaaaaaaaaaaaaa'},
        'unmatched_ellipsis.php':       {match: false, content: 'Loadingaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa...'},
        'unmatched_method_ref.php':     {match: false, content: 'window.encodeUriComponent\nwindow.encodeUriComponent,'},
        'unmatched_css.php':            {match: false, content: 'border:000000000000000000000000'},
        'unmatched_hex_num.php':        {match: false, content: '0xFFFFFFFF'},
        'unmatched_abcd1234_1.php':     {match: false, content: 'abcdefghijklmnopqrstuvwxyz1234567890'},
        'unmatched_abcd1234_2.php':     {match: false, content: 'abcdefghijklmnopqrstuvwxyz0123456789'},
        'unmatched_abcd1234_3.php':     {match: false, content: '0123456789abcdefghijklmnopqrstuvwxyz'},
        'unmatched_abcd1234_4.php':     {match: false, content: '1234567890abcdefghijklmnopqrstuvwxyz'},
        'unmatched_abcd1234_5.php':     {match: false, content: '1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'},
        'unmatched_abcd1234_6.php':     {match: false, content: '1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ+/'},
        'unmatched_abcd1234_7.php':     {match: false, content: '1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/+'},
        'unmatched_hex_string.php':     {match: false, content: '001a213b425c637d849ea5bfc6d0e7f1'},

        'matched_multiline.php': {match: true, content: 'YWFhYWFhYWFhYWFhY0FhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh\nYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYQo='},

      };
      setUpFileReadSpy(files);
      assertRuleForFiles(files, activeRules).then(done);
    });
  });

  describe('P64:general:obfuscation:scripts_with_escaped_ascii', function() {
    it('should match the correct set of files', function(done) {
      const ruleID = 'P64:general:obfuscation:scripts_with_escaped_ascii';
      const activeRules = rules.filter(x => x.id === ruleID);
      const files = {
        'unmatched.dat': {match: false, content: '\\x21\\x22\\x23\\x24'},
        'matched.php': {match: true, content: '\\x21\\x22\\x23\\x24'},
        'matched.js': {match: true, content: '\\x21\\x22\\x23\\x24'},
        'matched.aspx': {match: true, content: '\\x21\\x22\\x23\\x24'},
        'matched.asp': {match: true, content: '\\x21\\x22\\x23\\x24'},
        'unmatched_content.php': {match: false, content: '\\x21\\xff\\x22\\x23\\x24'},
        'classes/Swift/Mime/Headers/ParameterizedHeader.php': {match: false, content: '\\x21\\x22\\x23\\x24'},
        'Swift/Encoder/Rfc2231EncoderTest.php': {match: false, content: '\\x21\\x22\\x23\\x24'}
      };
      setUpFileReadSpy(files);
      assertRuleForFiles(files, activeRules).then(done);
    });
  });

  describe('P64:general:tags:hacked_by', function() {
    it('should match the correct set of files', function(done) {
      const ruleID = 'P64:general:tags:hacked_by';
      const activeRules = rules.filter(x => x.id === ruleID);
      const files = {
        'unmatched1.dat': {match: false, content: 'hacked by'},
        'unmatched1.php': {match: false, content: 'This is a temporary hack'},
        'unmatched2.php': {match: false, content: 'These are some hacks to'},
        'unmatched3.php': {match: false, content: 'The Haxe language x-haxe'},
        'unmatched4.php': {match: false, content: 'owned by'},
        'match1.php': {match: true, content: 'hacked by'},
        'match1.asp': {match: true, content: 'hacked by'},
        'match1.aspx': {match: true, content: 'hacked by'},
        'match1.js': {match: true, content: 'hacked by'},
        'match1.jsx': {match: true, content: 'hacked by'},
        'match1.htm': {match: true, content: 'hacked by'},
        'match1.html': {match: true, content: 'hacked by'},
        'match2.php': {match: true, content: 'H4x0r3D'},
        'match3.php': {match: true, content: 'l33t H4x'},
        'match4.php': {match: true, content: 'hack l33t'},
        'match5.php': {match: true, content: 'n00b'},
        'match6.php': {match: true, content: 'n00bz'},
        'match7.php': {match: true, content: '0wn3d'},
        'match8.php': {match: true, content: 'pwn3d'},
        'match9.php': {match: true, content: 'pwned'},
        'match10.php': {match: true, content: 'ownage'},
        'match11.php': {match: true, content: '0wnage'},
        'match12.php': {match: true, content: 'own3d'},
      };
      setUpFileReadSpy(files);
      assertRuleForFiles(files, activeRules).then(done);
    });
  });

  describe('P64:js:jquery:obfuscated_document_write', function() {
    it('should match the correct set of files', function(done) {
      const ruleID = 'P64:js:jquery:obfuscated_document_write';
      const activeRules = rules.filter(x => x.id === ruleID);
      const files = {
        'match/jquery.js':         {match: true, content: '\\x77\\x72\\x69\\x74\\x65'},
        'match/jquery.min.js':     {match: true, content: '\\x77\\x72\\x69\\x74\\x65'},
        'unmatched/jquery.js':     {match: false, content: 'document'},
        'unmatched/jquery.min.js': {match: false, content: 'document'},
      };
      setUpFileReadSpy(files);
      assertRuleForFiles(files, activeRules).then(done);
    });
  });

  describe('P64:php:cms:wordpress:php_in_uploads', function() {
    it('should match the correct set of files', function(done) {
      const ruleID = 'P64:php:cms:wordpress:php_in_uploads';
      const activeRules = rules.filter(x => x.id === ruleID);
      const files = {
        'wp-content/uploads/test.php': {match: true, content: '', size: 50},
        'wp-content/uploads/notphp.js': {match: false, content: '', size: 50},
        'wp-content/uploads/toosmall.php': {match: false, content: '', size: 28},
        'unmatched/notInUploads.php': {match: false, content: '', size: 50},
      };
      setUpFileReadSpy(files);

      // Test uses statAsync() so define a spy
      spyOn(fs, 'statAsync')
        .and.callFake(function(file) {
          return files[file] ? Promise.resolve({size: files[file].size}) : Promise.reject(new Error('File not found'));
        });

      assertRuleForFiles(files, activeRules).then(done);
    });
  });

  describe('P64:php:cms:wordpress:unknown_mail_function_call', function() {
    it('should match the correct set of files', function(done) {
      const ruleID = 'P64:php:cms:wordpress:unknown_mail_function_call';
      const activeRules = rules.filter(x => x.id === ruleID);
      const files = {
        'wp-content/uploads/test.php': {match: true, content: 'mail($to, $subject, $body)'},
        'wp-content/themes/test.php': {match: true, content: 'mail($to, $subject, $body)'},
        'wp-content/themes/lib/test.php': {match: true, content: 'mail($to, $subject, $body)'},
        'wp-includes/test.php': {match: false, content: 'mail($to, $subject, $body)'},
        'wp-content/uploads/commented.php': {match: false, content: '   //mail($to, $subject, $body)'},
        'wp-content/uploads/commented2.php': {match: false, content: ' //  mail($to, $subject, $body)'},
        'wp-content/uploads/testwp.php': {match: true, content: 'wp_mail($to, $subject, $body)'},
        'wp-content/themes/testwp.php': {match: true, content: 'wp_mail($to, $subject, $body)'},
        'wp-content/themes/lib/testwp.php': {match: true, content: 'wp_mail($to, $subject, $body)'},
        'wp-includes/testwp.php': {match: false, content: 'wp_mail($to, $subject, $body)'},
        'wp-content/uploads/commentedwp.php': {match: false, content: '   //wp_mail($to, $subject, $body)'},
        'wp-content/uploads/commentedwp2.php': {match: false, content: ' //  wp_mail($to, $subject, $body)'},
        'wp-content/uploads/unmatched.js': {match: false, content: 'mail($to, $subject, $body)'},
      };
      setUpFileReadSpy(files);
      assertRuleForFiles(files, activeRules).then(done);
    });
  });

  describe('P64:php:cms:wordpress:wp_cd_code', function() {
    it('should match the correct set of files', function(done) {
      const ruleID = 'P64:php:cms:wordpress:wp_cd_code';
      const activeRules = rules.filter(x => x.id === ruleID);
      const files = {
        'matched.php': {match: true, content: 'echo "";\nwp_cd_code="";\n'},
        'unmatched.js': {match: false, content: 'wp_cd_code'},
        'unmatched/nocode.php': {match: false, content: 'echo "test";'},
      };
      setUpFileReadSpy(files);
      assertRuleForFiles(files, activeRules).then(done);
    });
  });

  describe('P64:php:cms:wordpress:wso_webshell', function() {
    it('should match the correct set of files', function(done) {
      const ruleID = 'P64:php:cms:wordpress:wso_webshell';
      const activeRules = rules.filter(x => x.id === ruleID);
      const files = {
        'matched.php': {match: true, content: 'echo "";\necho wsoEx("");\n'},
        'wp-info.php': {match: true, content: ''},
        'unmatched.js': {match: false, content: 'wsoEx'},
        'unmatched/test1.php': {match: false, content: 'echo "test";'},
      };
      setUpFileReadSpy(files);
      assertRuleForFiles(files, activeRules).then(done);
    });
  });

  describe('P64:php:mod_infoslider_spam_mailer', function() {
    it('should match the correct set of files', function(done) {
      const ruleID = 'P64:php:mod_infoslider_spam_mailer';
      const activeRules = rules.filter(x => x.id === ruleID);
      const files = {
        'matched.php': {match: true, content: '$resp=mail($to, $subject, $body);\n$mailNRA'},
        'matched2.php': {match: true, content: '$resp = mail($to, $subject, $body);\n$mailNRA'},
        'matched3.php': {match: true, content: '$mailNRA="";\nmail($to, $subject, $body);'},
        'matched4.php': {match: true, content: '$mailNRB="";\nmail($to, $subject, $body);'},
        'matched5.php': {match: true, content: '$mailRNA="";\nmail($to, $subject, $body);'},
        'matched6.php': {match: true, content: '$mailRNB="";\nmail($to, $subject, $body);'},
        'mod_infoslider.php': {match: true, content: ''},
        'unmatched/mailonly.php': {match: false, content: 'mail($to, $subject, $body);'},
        'unmatched/nomail.php': {match: false, content: '$mailNRA = "";'},
      };
      setUpFileReadSpy(files);
      assertRuleForFiles(files, activeRules).then(done);
    });
  });

  describe('P64:php:obfuscated_fopo_comment', function() {
    it('should match the correct set of files', function(done) {
      const ruleID = 'P64:php:obfuscated_fopo_comment';
      const activeRules = rules.filter(x => x.id === ruleID);
      const files = {
        'unmatched.js': {match: false, content: 'fopo.com.ar'},
        'unmatched.php': {match: false, content: '<?php phpinfo(); ?>'},
        'matched.php': {match: true, content: 'fopo.com.ar'},
        'matched2.php': {match: true, content: 'Free online PHP obfuscator'},
        'matched3.php': {match: true, content: 'Obfuscation provided by FOPO'},
      };
      setUpFileReadSpy(files);
      assertRuleForFiles(files, activeRules).then(done);
    });
  });

  describe('P64:php:phpinfo', function() {
    it('should match the correct set of files', function(done) {
      const ruleID = 'P64:php:phpinfo';
      const activeRules = rules.filter(x => x.id === ruleID);
      const files = {
        'unmatched.js': {match: false, content: 'phpinfo()'},
        'matched.php': {match: true, content: 'phpinfo()'},
        'matched2.php': {match: true, content: '<?php\n  phpinfo();\n?>'},
        'matched3.php': {match: true, content: '<?php\n  phpinfo   (  ALL  );\n?>'},
        'unmatched/nocall.php': {match: false, content: '<?php phpinfo; ?>'},
        'unmatched/commented.php': {match: false, content: '<?php //phpinfo(); ?>'},
        'unmatched/commented2.php': {match: false, content: '<?php\n//phpinfo();\n?>'},

        'wp-includes/functions.php': {match: false, content: 'phpinfo()'},
        'wp-admin/includes/class-wp-filesystem-ssh2.php': {match: false, content: 'phpinfo()'},
        'wp-content/plugins/wordfence/lib/menu_tools_diagnostic.php': {match: false, content: 'phpinfo()'},
        'wp-content/plugins/wordfence/lib/sysinfo.php': {match: false, content: 'phpinfo()'},
        'wp-content/plugins/wordfence/lib/wordfenceClass.php': {match: false, content: 'phpinfo()'},
        'wp-content/plugins/updraftplus/central/modules/core.php': {match: false, content: 'phpinfo()'},
        'wp-content/plugins/updraftplus/includes/class-wpadmin-commands.php': {match: false, content: 'phpinfo()'},
        'wp-content/plugins/updraftplus/admin.php': {match: false, content: 'phpinfo()'},
        'wp-content/plugins/w3-total-cache/Support_AdminActions.php': {match: false, content: 'phpinfo()'},
        'wp-content/plugins/w3-total-cache/inc/options/install.php': {match: false, content: 'phpinfo()'},
        'phpseclib/Crypt/RSA.php': {match: false, content: 'phpinfo()'},
        'phpseclib/Math/BigInteger.php': {match: false, content: 'phpinfo()'},
        'symfony/process/Process.php': {match: false, content: 'phpinfo()'},
        'symfony/process/Tests/ProcessTest.php': {match: false, content: 'phpinfo()'},
      };
      setUpFileReadSpy(files);
      assertRuleForFiles(files, activeRules).then(done);
    });
  });

});