Skip to content

JAT Shell Scanner v1.6.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Oct 18:58
v1.6.0
4f0698a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

JAT Shell Scanner

The plugin is now called JAT Shell Scanner everywhere, credited to Jeremy Anderson Tech:

  • WordPress.org slug and text domain jat-shell-scanner.
  • Menu: Tools → JAT Shell Scanner; the page address is now page=jat-shell-scanner, and alert emails say JAT Shell Scanner.
  • GitHub: the repository is now CptNope/JAT-Shell-Scanner (old links redirect), and the release zip is jat-shell-scanner.zip, with folder jat-shell-scanner and main file jat-shell-scanner.php.
  • WP-CLI: wp jat-shell. The old wp php2shell and wp wp2shell still work.

Copies installed from GitHub before 1.6 don't update to 1.6 by themselves, because the zip and folder names changed. Install 1.6 once by hand; the README explains how to keep your settings. Settings, scan history and fleet keys carry over.

Changes from the WordPress.org review

  • Quarantine moved into uploads. Flagged files now go into the plugin's own folder, uploads/jat-shell-scanner/quarantine-<random>/ (the main site's uploads on multisite), which is blocked from the web on Apache, LiteSpeed and IIS, has an empty index, and holds only renamed files that can't run. Nothing is written into wp-content itself any more. Items quarantined by earlier GitHub builds stay in the old wp-content folder and can still be restored or deleted from the Quarantine tab; uninstall removes both.
  • Folders from WordPress's functions. A new WP2SS_Paths class finds plugins (from the plugin's own location), must-use plugins (wp_get_mu_plugins()), themes (get_theme_root(), per theme), uploads (wp_upload_dir()) and the debug log (PHP's error_log setting). Only WordPress's core folder and the content folder, which have no function, come from ABSPATH and WP_CONTENT_DIR, read in that one class. Sites that moved wp-content, plugins or themes are scanned in the right places, and theme folders registered with register_theme_directory() are scanned too.
  • Fleet endpoints: the signature check now runs as the REST route's permission_callback.
  • Removed load_plugin_textdomain(); WordPress loads translations for the slug itself.

Hardening for the next review round

  • Every form and AJAX handler checks its nonce itself, right where it reads the request (no shared helper), and AJAX handlers check the capability first.
  • SQL table names go through %i placeholders, so WordPress 6.2 or newer is now required.
  • No more phpinfo(): PHP's build date comes from the date on PHP's own files.
  • No set_time_limit() (scans already run in slices within the server's limit), no base64 for stored paths (hex), the public get_dropins() instead of a private core function, and WordPress's list of removed core files is read as text instead of loading update-core.php.
  • wp_delete_file() and wp_is_writable() instead of unlink() and is_writable().
  • The WordPress.org build has no updater code at all: everything marked <github-only> (the GitHub updater and its checksum download) is removed by the build script.
  • The readme's External services section now lists everything a fleet member sends, including the hourly check-in.
Assets 5
Loading