Skip to content
This repository has been archived by the owner on Feb 11, 2024. It is now read-only.

Commit

Permalink
add more whitelists (magento2, phpmyadmin, prestashop, symfony)
Browse files Browse the repository at this point in the history
  • Loading branch information
Mathieu Deous committed Jul 28, 2016
1 parent 6720ad7 commit 1003fba
Show file tree
Hide file tree
Showing 5 changed files with 701 additions and 95 deletions.
107 changes: 12 additions & 95 deletions php-malware-finder/whitelist.yar
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,66 +4,13 @@
Please make sure that you're calling those rules after all the others.
*/

private rule Symfony : Blog
{
condition:
hash.sha1(0, filesize) == "3006ce2ddce200e1c66185b95065dc7f9d224465" or // vendor/twig/twig/lib/Twig/Node/Macro.php
hash.sha1(0, filesize) == "39bae7f6aa0f4affe06a0d7b7d8306e1e27e441e" or // vendor/doctrine/common/lib/Doctrine/Common/Proxy/ProxyGenerator.php
hash.sha1(0, filesize) == "4848d9582a2205c1b037a542faa5ed1b755d6620" or // vendor/phpoffice/phpword/src/PhpWord/Shared/PCLZip/pclzip.lib.php
hash.sha1(0, filesize) == "85a49736e0df50f8aaad652c517f4f230726f73c" or // vendor/mouf/mouf/vendor/twig/twig/test/Twig/Tests/Node/MacroTest.php
hash.sha1(0, filesize) == "8954260cbb93f46da59cff358c824679395664c2" or // vendor/twig/twig/lib/Twig/Node/CheckSecurity.php
hash.sha1(0, filesize) == "9b2834dabbb7331a02a158b91fdb48f73e8bc0ea" or // vendor/dompdf/dompdf/include/page_cache.cls.php
hash.sha1(0, filesize) == "a3e936e90a73ece5637a10cd7c26f047d0d5a820" or // vendor/dompdf/dompdf/include/attribute_translator.cls.php
hash.sha1(0, filesize) == "b4cbea1458132e156327f20810cf2a2d1f961869" or // vendor/doctrine/inflector/lib/Doctrine/Common/Inflector/Inflector.php
hash.sha1(0, filesize) == "beea13bcbd977cb7ee29fdf4bca36c9c19e5a562" or // vendor/dompdf/dompdf/include/cellmap.cls.php
hash.sha1(0, filesize) == "da96d532cc2f930449a4e19a0e280d759366a8de" or // vendor/dompdf/dompdf/include/style.cls.php
hash.sha1(0, filesize) == "e4b9be9277626f5377ecb3306fd4f2fb7a99508f" // vendor/swiftmailer/swiftmailer/lib/classes/Swift/Transport/SimpleMailInvoker.php
}

private rule Wordpress : Blog
{
condition:
/* Wordpress 4.4.1 */
hash.sha1(0, filesize) == "7db1719874b1415e54981c6f1ed698274abffd28" or // wp-includes/formatting.php
hash.sha1(0, filesize) == "ccd23ef96a588840943fba081bfa6f88531c4abc" or // wp-admin/includes/class-pclzip.php
/* Wordpress 4.2.3 */
hash.sha1(0, filesize) == "f1c4697ae04da5eb19847c8f1296edce2ad3cec9" or // wp-includes/formatting.php
hash.sha1(0, filesize) == "e7caf1f66c38bb119fe709ade012a989d8610f07" or // wp-admin/includes/class-pclzip.php
hash.sha1(0, filesize) == "8ddb9eff06105b9699c6b03db54472291abcb823" or // wp-includes/taxonomy.php
hash.sha1(0, filesize) == "9dd666651f57ef6e704310fe37ffce7dfd2322e4" or // wp-includes/comment.php
include "whitelists/drupal.yar"
include "whitelists/wordpress.yar"
include "whitelists/symfony.yar"
include "whitelists/phpmyadmin.yar"
include "whitelists/magento2.yar"
include "whitelists/prestashop.yar"

/* Wordpress 3.9 */
hash.sha1(0, filesize) == "b20e3d401b0ab935ed6401392233b36966523e20" or // wp-includes/class-pop3.php
hash.sha1(0, filesize) == "3748c7a2150a9da2d2dda10062b00d34982b3d87" or // wp-includes/taxonomy.php
hash.sha1(0, filesize) == "1a4e6932523c34d95f050960e7c3d082adb28156" or // wp-includes/ID3/getid3.php
hash.sha1(0, filesize) == "48a3dab94dc548169700bb411148c6fbf30274c3" or // wp-includes/ID3/getid3.lib.php
hash.sha1(0, filesize) == "c605d1224cf4b24ad2457dd87885de9030e20731" or // wp-includes/SimplePie/File.php
hash.sha1(0, filesize) == "005f02927a6904c4e7f3b88ebdd9feaa6221790b" or // wp-includes/class-phpmailer.php
hash.sha1(0, filesize) == "12b433cc24cca9747b1fcb1132ffb6b1e6ab75b0" or // wp-includes/comment.php
/* Wordpress 3.5.1 */
hash.sha1(0, filesize) == "833281b4d1113180e4d1ca026f5e85a680d52662" or // wp-includes/class-phpmailer.php
hash.sha1(0, filesize) == "b4e4b88f2be38ed9c3147b77c2f3a7f929caba2c" or // wp-admin/includes/menu.php
/* Wordpress 3.2.1 */
hash.sha1(0, filesize) == "b4f53b8c360f9e47cc63047305a0ce2e3ff6a251" or // wp-includes/functions.php
hash.sha1(0, filesize) == "ac8298df16a560c80fb213ef3f51f90df8ef5292" or // wp-includes/class-phpmailer.php
hash.sha1(0, filesize) == "232e4705e3aa28269c4d5e4a4a700bb7a2d06f24" or // wp-admin/includes/menu.php
/* Wordpress 4.4 */
hash.sha1(0, filesize) == "2fdf93ae88735d062a8635ac1d22a6904cb89ab8" or // wp-includes/formatting.php
hash.sha1(0, filesize) == "ccd23ef96a588840943fba081bfa6f88531c4abc" // wp-admin/includes/class-pclzip.php
}

private rule Prestashop : ECommerce
{
condition:
/* Prestashop 1.6.1.0 */
hash.sha1(0, filesize) == "544cd822e2195ac162c9f0387031709042a72cfd" or // tools/htmlpurifier/HTMLPurifier.standalone.php
hash.sha1(0, filesize) == "bb8c0d735809b9412265729906016329f3e681ff" or // classes/webservice/WebserviceOutputJSON.php
hash.sha1(0, filesize) == "15da986fccdc7104f9d4e8c344f332db5ae9a32b" // classes/Tools.php
}

private rule Magento : ECommerce
{
Expand All @@ -82,30 +29,7 @@ private rule Magento : ECommerce
/* Magento 1.4.1.1 */
hash.sha1(0, filesize) == "0b74f4b259c63c01c74fb5913c3ada87296107c8" or // lib/Zend/Session.php
hash.sha1(0, filesize) == "951a4639e49c6b2ad8adeb38481e2290297c8e70" or // lib/Zend/Ldap/Converter.php
hash.sha1(0, filesize) == "44ba7a5b685f4a52113559f366aaf6e9a22ae21e" // app/code/core/Mage/Adminhtml/Model/Url.php
}

private rule Drupal : Blog
{
condition:
/* Drupal 7.38 */
hash.sha1(0, filesize) == "ad7587ce735352b6a55526005c05c280e9d41822" or // modules/system/system.admin.inc
hash.sha1(0, filesize) == "dfa67a40daeb9c1dd28f3fab00097852243258ed" or // modules/system/system.module
/* Drupal 7.33 */
hash.sha1(0, filesize) == "19c45985dfee7dc27a3a275542dee7c8fc7ebd6d" or // modules/simpletest/drupal_web_test_case.php
hash.sha1(0, filesize) == "e53ae29f02d7bd8667ce701b6d13ca71249e6598" or // modules/contrib/simplenews/tests/d6_simplenews_61.php
hash.sha1(0, filesize) == "5e1093b4d8bcb438b07e8a428957bd3f79c1042c" or // modules/contrib/simplenews/tests/d6_simplenews_62.php
hash.sha1(0, filesize) == "1335f535e2b20634fa8be3e95411921dfe47041d" or // modules/socials/og/og_migrate/tests/drupal-6.og.database.php
hash.sha1(0, filesize) == "c748f376cccb982448e99dee184dfec3a1979f44" or // modules/socials/og/tests/drupal-7.og.update_7001.database.php
hash.sha1(0, filesize) == "1335f535e2b20634fa8be3e95411921dfe47041d" or // modules/socials/og/tests/drupal-6.og.database.php
hash.sha1(0, filesize) == "10aa23f49747970a204c5df98d4c36e64e354760" or // modules/socials/og/og_ui/tests/drupal-6.og-ui.database.php
/* Drupal 7.15 */
hash.sha1(0, filesize) == "23cc0e2c6eebe94fe189e258a3658b40b0005891" or // modules/simpletest/tests/upgrade/drupal-6.bare.database.php
hash.sha1(0, filesize) == "8cb36d865b951378c3266dca7d5173a303e8dcff" or // modules/simpletest/tests/upgrade/drupal-6.filled.database.php
hash.sha1(0, filesize) == "6c9c01bef14f8f64ef0af408f7ed764791531cc6" or // modules/system/system.module
hash.sha1(0, filesize) == "ad03ed890400cf319f713ee0b4b6a62a5710f580" // modules/system/system.admin.inc
hash.sha1(0, filesize) == "44ba7a5b685f4a52113559f366aaf6e9a22ae21e" // app/code/core/Mage/Adminhtml/Model/Url.php
}

private rule Roundcube
Expand All @@ -118,7 +42,7 @@ private rule Roundcube
/* Roundcube 1.0.6 */
hash.sha1(0, filesize) == "76d55f05f2070f471ba977b5b0f690c91fa8cdab" or // program/lib/Roundcube/rcube_utils.php
hash.sha1(0, filesize) == "c68319e3e1adcd3e22cf2338bc79f12fd54f6d4a" // program/include/rcmail_output_html.php
hash.sha1(0, filesize) == "c68319e3e1adcd3e22cf2338bc79f12fd54f6d4a" // program/include/rcmail_output_html.php
}

private rule Concrete5
Expand All @@ -127,7 +51,7 @@ private rule Concrete5
/* concrete5 7.4.2 */
hash.sha1(0, filesize) == "927bbd60554ae0789d4688738b4ae945195a3c1c" or // concrete/vendor/oyejorge/less.php/lib/Less/Tree/Dimension.php
hash.sha1(0, filesize) == "67f07022dae5fa39e8a37c09d67cbcb833e10d1f" or // concrete/vendor/oyejorge/less.php/lib/Less/Tree/Unit.php
hash.sha1(0, filesize) == "e1dcbc7b05e8ba6cba392f8fd44a3564fcad3666" // concrete/vendor/doctrine/inflector/lib/Doctrine/Common/Inflector/Inflector.php
hash.sha1(0, filesize) == "e1dcbc7b05e8ba6cba392f8fd44a3564fcad3666" // concrete/vendor/doctrine/inflector/lib/Doctrine/Common/Inflector/Inflector.php
}

private rule Dotclear : Blog
Expand All @@ -141,7 +65,7 @@ private rule Dotclear : Blog
hash.sha1(0, filesize) == "192126b08c40c5ca086b5e4d7433e982f708baf3" or // inc/public/class.dc.template.php
hash.sha1(0, filesize) == "51e6810ccd3773e2bd453e97ccf16059551bae08" or // inc/libs/clearbricks/common/lib.date.php
hash.sha1(0, filesize) == "4172e35e7c9ce35de9f56fb8dfebe8d453f0dee4" or // inc/libs/clearbricks/template/class.template.php
hash.sha1(0, filesize) == "cf65db6ae55486f51370f87c4653aaed56903ccc" // inc/core/class.dc.modules.php
hash.sha1(0, filesize) == "cf65db6ae55486f51370f87c4653aaed56903ccc" // inc/core/class.dc.modules.php
}

private rule Owncloud
Expand All @@ -152,15 +76,7 @@ private rule Owncloud
hash.sha1(0, filesize) == "463627a4064dc05e93e6f9fc5605d4c8a4e09200" or // 3rdparty/jeremeamia/SuperClosure/src/SerializableClosure.php
hash.sha1(0, filesize) == "5346cb6817a75c26a6aad86e0b4ffb1d5145caa5" or // 3rdparty/symfony/process/Symfony/Component/Process/Process.php
hash.sha1(0, filesize) == "c8a6d4292448c7996e0092e6bfd38f90c34df090" or // core/doc/admin/_images/oc_admin_app_page.png
hash.sha1(0, filesize) == "acc7af31d4067c336937719b9a9ad7ac8497561e" // core/doc/admin/_sources/configuration_server/performance_tuning.txt
}

private rule Phpmyadmin
{
condition:
/* phpmyadmin 4.4.11 */
hash.sha1(0, filesize) == "52afd26f6d38e76d7d92b96809f98e526e45c021" or // libraries/DatabaseInterface.class.php
hash.sha1(0, filesize) == "398507962b9dd89b0352f2ea9c648152fe932475" // libraries/DBQbe.class.php
hash.sha1(0, filesize) == "acc7af31d4067c336937719b9a9ad7ac8497561e" // core/doc/admin/_sources/configuration_server/performance_tuning.txt
}

private rule Misc
Expand All @@ -177,6 +93,7 @@ private rule IsWhitelisted
Wordpress or
Prestashop or
Magento or
Magento2 or
Drupal or
Roundcube or
Concrete5 or
Expand Down
45 changes: 45 additions & 0 deletions php-malware-finder/whitelists/magento2.yar
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
import "hash"

private rule Magento2 : ECommerce
{
meta:
generated = "2016-07-27T19:16:30.428376"

condition:
/* Magento2 2.0 */
hash.sha1(0, filesize) == "a46cd4176871076df0e7d9edd4d469cdc5414833" or // lib/internal/Magento/Framework/Shell.php
hash.sha1(0, filesize) == "fcdadb38653801c605180fa7bc3da5ffe7a78108" or // app/code/Magento/Catalog/Model/Product/Image.php
hash.sha1(0, filesize) == "a04c54d0bdd22c2033cc50a06866845763b18b51" or // dev/tests/static/testsuite/Magento/Test/Legacy/ObsoleteCodeTest.php
hash.sha1(0, filesize) == "fffb094a2d2f8f4e0f2f1ece46839055c3e5bcdd" or // dev/tests/api-functional/framework/bootstrap.php
hash.sha1(0, filesize) == "571c65fda0b3baea7206430a87cbfcbba45e8f26" or // dev/tests/static/testsuite/Magento/Test/Legacy/_files/obsolete_classes.php
hash.sha1(0, filesize) == "0bcbc44d143cba85713ffd3d6638294accb3cdba" or // lib/internal/Magento/Framework/Api/Code/Generator/ExtensionAttributesGenerator.php
hash.sha1(0, filesize) == "f3fd57943825e6195963c1ebbbc73744cc997ca3" or // app/code/Magento/Backend/Model/Url.php
hash.sha1(0, filesize) == "6b1207354e632ed5ff9d997673b1b8b7491e4830" or // dev/tests/integration/framework/bootstrap.php
hash.sha1(0, filesize) == "381606c98428f5f1f1688861b9bb5b86573882ae" or // dev/tests/js/JsTestDriver/run_js_tests.php
hash.sha1(0, filesize) == "2662ccbbd8c5841a0d5112038d8157fd5af61242" or // lib/web/extjs/resources/images/default/basic-dialog/btn-arrow.gif
hash.sha1(0, filesize) == "073be1c00c938479a0daa737e8a2db25c051b33f" or // dev/tests/integration/testsuite/Magento/Framework/Image/Adapter/InterfaceTest.php
hash.sha1(0, filesize) == "0eaa652145e3212563cfc960be6953b384ffe998" or // lib/web/prototype/windows/themes/lighting/spinner.gif
/* Magento2 2.0.0 */
hash.sha1(0, filesize) == "664fa0e4fa71b881e313cd0ee10ef39cd2d58e65" or // lib/internal/Magento/Framework/Shell.php
hash.sha1(0, filesize) == "2d9966b5c02e42eedd670f12fff2d92969973eae" or // app/code/Magento/Catalog/Model/Product/Image.php
hash.sha1(0, filesize) == "dcc5b6e3b86d741dd55eb9e0b8c337157eedd6e8" or // dev/tests/static/testsuite/Magento/Test/Legacy/ObsoleteCodeTest.php
hash.sha1(0, filesize) == "ade287d950958ff32c35d8243139bd3605fe992b" or // dev/tests/api-functional/framework/bootstrap.php
hash.sha1(0, filesize) == "81bacb155d372b44c86205af20156ddfb59efab9" or // dev/tests/static/testsuite/Magento/Test/Legacy/_files/obsolete_classes.php
hash.sha1(0, filesize) == "f0c3ea5c50c763aec35ee7db0e27e9cad7eff01e" or // lib/internal/Magento/Framework/Api/Code/Generator/ExtensionAttributesGenerator.php
hash.sha1(0, filesize) == "cd1002f845b67164d3cda344124f1f7d9d22019e" or // app/code/Magento/Backend/Model/Url.php
hash.sha1(0, filesize) == "a3eaabc2edf427e480b62029b89d61643a0c19fa" or // dev/tests/integration/framework/bootstrap.php
hash.sha1(0, filesize) == "75f7eee0f3d16e2b415bb2866b22df71d209c38b" or // dev/tests/js/JsTestDriver/run_js_tests.php
hash.sha1(0, filesize) == "690cfdb0e5273fa0ec92463ba1356b84edeb2359" or // dev/tests/integration/testsuite/Magento/Framework/Image/Adapter/InterfaceTest.php
/* Magento2 2.0.1 */
hash.sha1(0, filesize) == "add333a8137ccbb305ecf60c3e55e28768c0f237" or // dev/tests/static/testsuite/Magento/Test/Legacy/_files/obsolete_classes.php
/* Magento2 2.1 */
hash.sha1(0, filesize) == "181aac8d1a67fe106fa750933e6d2fe2194c889e" or // dev/tests/static/testsuite/Magento/Test/Legacy/ObsoleteCodeTest.php
hash.sha1(0, filesize) == "25d56e294e9852fbddbbb377cc55dc46fa0d2976" or // dev/tests/static/testsuite/Magento/Test/Legacy/_files/obsolete_classes.php
hash.sha1(0, filesize) == "7ac6acb23d445922fbed93d4e19f14517ea710f9" or // lib/internal/Magento/Framework/Api/Code/Generator/ExtensionAttributesGenerator.php
hash.sha1(0, filesize) == "64459becc8ec0520996804beba4aaba8fa18e558" or // app/code/Magento/Backend/Model/Url.php
hash.sha1(0, filesize) == "92f71e0f24fbb82eb1c761102930594d0299717e" // lib/internal/Magento/Framework/Shell/Driver.php
}
63 changes: 63 additions & 0 deletions php-malware-finder/whitelists/phpmyadmin.yar
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
import "hash"

private rule Phpmyadmin
{
meta:
generated = "2016-07-27T18:00:53.795037"

condition:
/* Phpmyadmin 4.0.0 */
hash.sha1(0, filesize) == "9947802a97a9c265bdf5209a2b4b03e4897d3819" or // import.php
hash.sha1(0, filesize) == "13b9bdea5990a2105c7438574e4935062c89f88d" or // libraries/DBQbe.class.php
hash.sha1(0, filesize) == "4ca3a6ea8816dc3cddd460d99694bcc235c3705e" or // doc/setup.rst
hash.sha1(0, filesize) == "55e152b410eca610f2dcdc54cd75f6335bf0d8cb" or // prefs_manage.php
hash.sha1(0, filesize) == "027633c8a6f14355ad0a66b4a8d8b96bb90eb2d2" or // libraries/tcpdf/tcpdf.php
hash.sha1(0, filesize) == "f75b5155e55cf69b83fdc046a4f70f1861fc7d3a" or // libraries/sqlparser.lib.php
hash.sha1(0, filesize) == "fdfe4c742df3925616f07939d5cad3b932f97a50" or // libraries/database_interface.lib.php
hash.sha1(0, filesize) == "7ba1fca4654dbcfce4ea289c1570e181cd86d28f" or // doc/doctrees/setup.doctree
hash.sha1(0, filesize) == "4ca3a6ea8816dc3cddd460d99694bcc235c3705e" or // doc/html/_sources/setup.txt
hash.sha1(0, filesize) == "2d162d8637f30da6e7c07d4d72eb310b98a67bb3" or // libraries/plugins/auth/AuthenticationCookie.class.php
/* Phpmyadmin 4.0.1 */
hash.sha1(0, filesize) == "285e32978c85283b3eb60dc8622376ff625b0863" or // import.php
hash.sha1(0, filesize) == "9ee02b385fcc2bbfd7f135cea21eb25f26dbb31a" or // doc/doctrees/setup.doctree
/* Phpmyadmin 4.0.2 */
hash.sha1(0, filesize) == "c8cc27ffb129d02f346e21dbe365c7c7d8e45e89" or // import.php
hash.sha1(0, filesize) == "71adc462b0a212e23863b3423928ec98bec8934b" or // libraries/DBQbe.class.php
hash.sha1(0, filesize) == "7857f155634e4837665f8d27579fbf866725d5f3" or // doc/doctrees/setup.doctree
/* Phpmyadmin 4.0.3 */
hash.sha1(0, filesize) == "4360afbf0b092e2f1d9630eb6b6967c243d2b2c9" or // libraries/database_interface.lib.php
hash.sha1(0, filesize) == "87b8fe7d28c2c0f71f28d76f86f9d2f36431ba70" or // doc/doctrees/setup.doctree
hash.sha1(0, filesize) == "c4e4f20e324ebd00bb95a9e76bfe0c27852e7651" or // libraries/plugins/auth/AuthenticationCookie.class.php
/* Phpmyadmin 4.0.4 */
hash.sha1(0, filesize) == "3edc241b5ff6effc001181a84a25fba9b554282e" or // doc/doctrees/setup.doctree
/* Phpmyadmin 4.0.5 */
hash.sha1(0, filesize) == "8a92831c458b2ccfd68f470d2852a0276208a383" or // import.php
hash.sha1(0, filesize) == "78de4ed948310063e083264396faf1e4e9eab1ed" or // libraries/database_interface.lib.php
hash.sha1(0, filesize) == "0f75a26e15014bda7ce92e98e1856aa3e45b1140" or // doc/doctrees/setup.doctree
/* Phpmyadmin 4.0.6 */
hash.sha1(0, filesize) == "2cb0c93cafe9ed060dc3f2c8246e21b3ba6f055a" or // import.php
hash.sha1(0, filesize) == "20b30953db8f4e75748c6e26aff9495dfda41181" or // doc/doctrees/setup.doctree
/* Phpmyadmin 4.0.7 */
hash.sha1(0, filesize) == "437b19687a4a1f7f5acd2c05c3ab3aba02f1efa7" or // libraries/database_interface.lib.php
hash.sha1(0, filesize) == "7051c9127d5188c9b38e0a39129fa563cf12d35f" or // doc/doctrees/setup.doctree
/* Phpmyadmin 4.0.8 */
hash.sha1(0, filesize) == "9c7aba43bf2657426de0031932f9e692120afba5" or // doc/doctrees/setup.doctree
/* Phpmyadmin 4.0.9 */
hash.sha1(0, filesize) == "34dddb060e39472f1ec13935fca3119dda880744" or // libraries/sqlparser.lib.php
hash.sha1(0, filesize) == "830693d6d2aeb1079918af2efdcb097fa677d2cf" or // doc/doctrees/setup.doctree
/* Phpmyadmin 4.0.10 */
hash.sha1(0, filesize) == "7a4b5cc17045f6bc9332a26958200c34c3882f97" or // doc/setup.rst
hash.sha1(0, filesize) == "0c64f07f7b870341821ac6146f5cd7ed582a2d0b" or // doc/doctrees/setup.doctree
hash.sha1(0, filesize) == "7a4b5cc17045f6bc9332a26958200c34c3882f97" // doc/html/_sources/setup.txt
}
Loading

0 comments on commit 1003fba

Please sign in to comment.