scanners: close #9

mandiant · Mar 25, 2020 · b4064d1 · b4064d1
1 parent 0ca9caf
commit b4064d1
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 3 deletions.
diff --git a/build.sh b/build.sh
@@ -22,7 +22,7 @@ set -o errexit;
 # ref: https://stackoverflow.com/a/4774063/87207
 readonly current_directory="$( cd "$(dirname "$0")" ; pwd -P )"
 
-# generate a version file with GIT metadata
+# generate a version file with git metadata
 version_file="$current_directory/version.sh";
 if [ -f "$version_file" ]; then
     rm "$version_file";

diff --git a/scanners/netscaler-content.sh b/scanners/netscaler-content.sh
@@ -35,7 +35,9 @@ ns_content_blacklist[19]="xp_eternalblue.replay";
 # match filename `ld.sh` without matching `build.sh`
 ns_content_blacklist[20]="[^i]ld.sh";
 ns_content_blacklist[21]="piz.Lan";
-ns_content_blacklist[22]="de.py";
+# match filename `de.py` without matching `upgrade.py`
+# see #9
+ns_content_blacklist[22]="[^a]de.py";
 ns_content_blacklist[23]=".new.zip";
 ns_content_blacklist[24]="/tmp/rAgn";
 # other activity

diff --git a/scanners/shell-history.sh b/scanners/shell-history.sh
@@ -35,7 +35,8 @@ shell_history_blacklist[23]="x86.dll"
 shell_history_blacklist[24]="xp_eternalblue.replay"
 shell_history_blacklist[25]="ld.sh"
 shell_history_blacklist[26]="piz.Lan"
-shell_history_blacklist[27]="de.py"
+# disabled due to #9
+# shell_history_blacklist[27]="de.py"
 shell_history_blacklist[28]=".new.zip"
 shell_history_blacklist[29]="/tmp/rAgn"
 shell_history_blacklist[30]="/tmp/.init/httpd"