WordPress.org
Get WordPress

Plugin Directory

Changeset 3380286


Ignore:
Timestamp:
10/17/2025 05:48:37 PM (4 months ago)
Author:
wpfixit
Message:

Added new infection patterns to find bad files

Location:
folder-auditor
Files:
73 added
4 edited

Legend:

Unmodified
Added
Removed

  • folder-auditor/trunk/folder-auditor.php

    r3379504 r3380286  
    33 * Plugin Name: Guard Dog Security & Site Lock
    44 * Description: Helps WordPress administrators take full control of their site. It scans critical areas including the root directory, wp-content, plugins, themes, uploads, and .htaccess files to detect anything suspicious such as orphaned folders, leftover files, or hidden PHP in uploads. From the WordPress dashboard, you can safely review, download, or remove items that don’t belong, with built-in protection to ensure required resources remain untouched. In addition, Guard Dog Security lets you lock all files and folders as read-only, preventing unauthorized changes, additions, or deletions to your WordPress installation.
    5  * Version: 4.3
     5 * Version: 4.4
    66 * Author: WP Fix It
    77 * Author URI: https://www.wpfixit.com

  • folder-auditor/trunk/includes/helpers/reports/Guard-Dog-Security-Report.html

    r3379504 r3380286  
    15731573        <div class="fa-export-header-details">
    15741574      <h1>WP Fix It Sandbox - Guard Dog Security Report</h1>
    1575       <div class="fa-export-meta">October 16, 2025 8:36 am</div>
     1575      <div class="fa-export-meta">October 17, 2025 7:03 am</div>
    15761576    </div>
    15771577  </div>
    … …  
    16641664    </div>
    16651665    <div class="fa-desc">
    1666   28 installed • 3 active</div>
     1666  28 installed • 4 active</div>
    16671667  </div>
    16681668  <div class="fa-badges">
    … …  
    17311731  <!-- Icon -->
    17321732  <div class="fa-sitelock-icon" aria-hidden="true">
    1733     <span class="dashicons dashicons-unlock"></span>
     1733    <span class="dashicons dashicons-lock"></span>
    17341734  </div>
    17351735  <!-- Title + status + desc -->
    … …  
    17371737    <div class="fa-sitelock-titleline">
    17381738      <strong class="fa-sitelock-title">Site Lock Status - </strong>
    1739       <span class="fa-chip" style="background:#f54545;color:#fff;">
    1740         Unlocked      </span>
     1739      <span class="fa-chip" style="background:#1ab06f;color:#fff;">
     1740        Locked      </span>
    17411741    </div>
    1742     <p class="fa-sitelock-desc">Software updates, installs and removals are allowed. Turn on your Site Lock to harden file changes.</p>
     1742    <p class="fa-sitelock-desc">You have enabled Site Lock and below is the list of items that are locked and read only.</p>
    17431743  </div>
    17441744  <!-- CTA -->
    17451745  <div class="fa-sitelock-cta">
    17461746    <a href="https://test.wpfixithosting.com/wp-admin/admin.php?page=guard-dog-security&#038;tab=security#site-lock" class="wpfa-sexy-btn">
    1747       Enable Site Lock →
     1747      Open Site Lock Settings →
    17481748    </a>
    17491749  </div>
    … …  
    17511751  <div class="fa-locked-section">
    17521752              <div class="fa-locked-row">
     1753          <h4 class="fa-locked-title">Folders Locked (12)</h4>
     1754          <div class="fa-pill-wrap">
     1755                          <span class="fa-pill fa-pill-success">
     1756                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1757                <span class="fa-pill-label">error_log</span>
     1758              </span>
     1759                          <span class="fa-pill fa-pill-success">
     1760                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1761                <span class="fa-pill-label">mu-plugins</span>
     1762              </span>
     1763                          <span class="fa-pill fa-pill-success">
     1764                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1765                <span class="fa-pill-label">New directory</span>
     1766              </span>
     1767                          <span class="fa-pill fa-pill-success">
     1768                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1769                <span class="fa-pill-label">plugins</span>
     1770              </span>
     1771                          <span class="fa-pill fa-pill-success">
     1772                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1773                <span class="fa-pill-label">Some-Folder</span>
     1774              </span>
     1775                          <span class="fa-pill fa-pill-success">
     1776                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1777                <span class="fa-pill-label">themes</span>
     1778              </span>
     1779                          <span class="fa-pill fa-pill-success">
     1780                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1781                <span class="fa-pill-label">upgrade</span>
     1782              </span>
     1783                          <span class="fa-pill fa-pill-success">
     1784                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1785                <span class="fa-pill-label">upgrade-temp-backup</span>
     1786              </span>
     1787                          <span class="fa-pill fa-pill-success">
     1788                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1789                <span class="fa-pill-label">uploads</span>
     1790              </span>
     1791                          <span class="fa-pill fa-pill-success">
     1792                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1793                <span class="fa-pill-label">wp-admin</span>
     1794              </span>
     1795                          <span class="fa-pill fa-pill-success">
     1796                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1797                <span class="fa-pill-label">wp-content</span>
     1798              </span>
     1799                          <span class="fa-pill fa-pill-success">
     1800                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1801                <span class="fa-pill-label">wp-includes</span>
     1802              </span>
     1803                      </div>
     1804        </div>
     1805                    <div class="fa-locked-row">
     1806          <h4 class="fa-locked-title">Files Locked (20)</h4>
     1807          <div class="fa-pill-wrap">
     1808                          <span class="fa-pill fa-pill-success">
     1809                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1810                <span class="fa-pill-label">file-1.php</span>
     1811              </span>
     1812                          <span class="fa-pill fa-pill-success">
     1813                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1814                <span class="fa-pill-label">file-2.php</span>
     1815              </span>
     1816                          <span class="fa-pill fa-pill-success">
     1817                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1818                <span class="fa-pill-label">file-3.php</span>
     1819              </span>
     1820                          <span class="fa-pill fa-pill-success">
     1821                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1822                <span class="fa-pill-label">index.php</span>
     1823              </span>
     1824                          <span class="fa-pill fa-pill-success">
     1825                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1826                <span class="fa-pill-label">license.txt</span>
     1827              </span>
     1828                          <span class="fa-pill fa-pill-success">
     1829                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1830                <span class="fa-pill-label">readme.html</span>
     1831              </span>
     1832                          <span class="fa-pill fa-pill-success">
     1833                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1834                <span class="fa-pill-label">wp-activate.php</span>
     1835              </span>
     1836                          <span class="fa-pill fa-pill-success">
     1837                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1838                <span class="fa-pill-label">wp-blog-header.php</span>
     1839              </span>
     1840                          <span class="fa-pill fa-pill-success">
     1841                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1842                <span class="fa-pill-label">wp-comments-post.php</span>
     1843              </span>
     1844                          <span class="fa-pill fa-pill-success">
     1845                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1846                <span class="fa-pill-label">wp-config-sample.php</span>
     1847              </span>
     1848                          <span class="fa-pill fa-pill-success">
     1849                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1850                <span class="fa-pill-label">wp-config.php</span>
     1851              </span>
     1852                          <span class="fa-pill fa-pill-success">
     1853                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1854                <span class="fa-pill-label">wp-cron.php</span>
     1855              </span>
     1856                          <span class="fa-pill fa-pill-success">
     1857                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1858                <span class="fa-pill-label">wp-links-opml.php</span>
     1859              </span>
     1860                          <span class="fa-pill fa-pill-success">
     1861                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1862                <span class="fa-pill-label">wp-load.php</span>
     1863              </span>
     1864                          <span class="fa-pill fa-pill-success">
     1865                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1866                <span class="fa-pill-label">wp-login.php</span>
     1867              </span>
     1868                          <span class="fa-pill fa-pill-success">
     1869                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1870                <span class="fa-pill-label">wp-mail.php</span>
     1871              </span>
     1872                          <span class="fa-pill fa-pill-success">
     1873                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1874                <span class="fa-pill-label">wp-settings.php</span>
     1875              </span>
     1876                          <span class="fa-pill fa-pill-success">
     1877                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1878                <span class="fa-pill-label">wp-signup.php</span>
     1879              </span>
     1880                          <span class="fa-pill fa-pill-success">
     1881                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1882                <span class="fa-pill-label">wp-trackback.php</span>
     1883              </span>
     1884                          <span class="fa-pill fa-pill-success">
     1885                <span class="dashicons dashicons-lock" aria-hidden="true"></span>
     1886                <span class="fa-pill-label">xmlrpc.php</span>
     1887              </span>
     1888                      </div>
     1889        </div>
     1890        <div class="fa-locked-row">
    17531891        <h4 class="fa-locked-title">
    17541892      Folder Lock Exclusions (2)    </h4>

  • folder-auditor/trunk/includes/helpers/scanner/scanner.php

    r3374418 r3380286  
    4141
    4242    protected function wpfa_list_files( string $directory, array $opts = [] ) : array {
    43     $allowed_ext = '/(?:\.(?:php|html|txt|md|js|css|scss|less|json|xml|svg|htaccess|ini|user\.ini)$)/i';
     43    //$allowed_ext = '/(?:\.(?:php|html|txt|md|js|css|scss|less|json|xml|svg|htaccess|ini|user\.ini)$)/i';
     44    $allowed_ext = '/(?:\.(?:php|html|txt|md|js|css|scss|less|json|xml|svg|htaccess|ini|user\.ini)$|(?:\/[^\/\.]+$))/i';
    4445
    4546        // Resolve common WP paths (same as in your scanner)
    … …  
    107108                        continue;
    108109                    }
    109                     $path = wp_normalize_path( $fileinfo->getPathname() );
    110 
    111                     // Only allowed extensions / names / .well-known subtree
    112                     if ( ! preg_match( $allowed_ext, $path ) ) {
    113                         continue;
    114                     }
    115                     $files[] = $path;
     110            $path = wp_normalize_path( $fileinfo->getPathname() );
     111
     112$bn = basename( $path );
     113
     114// If no extension, peek at first few bytes so we can still catch ELF/MZ/Mach-O
     115if ( strpos( $bn, '.' ) === false ) {
     116    $head = @file_get_contents( $path, false, null, 0, 4 );
     117    if ( $head !== false ) {
     118        // If header matches known binary magics, force it into the scan list
     119        if ( $head === "\x7FELF" || $head === "MZ" || $head === "\xCF\xFA\xED" ) {
     120            $files[] = $path;
     121            continue;
     122        }
     123    }
     124}
     125
     126            // --- HARD GUARDS to keep "Full" scans from choking on giant/no-ext files ---
     127
     128// 1) Skip symlinks (can loop or point out of tree)
     129if ( $fileinfo->isLink() ) {
     130    continue;
     131}
     132
     133// 2) Skip very large files (logs, dumps, backups with no extension)
     134$size = @filesize( $path );
     135if ( $size !== false && $size > 20 * 1024 * 1024 ) { // 20MB cap; raise/lower if you want
     136    continue;
     137}
     138
     139// 3) If the filename has NO extension (allowed by your regex), quickly sniff for binary.
     140//    Binary / blob files (often huge) will contain NUL bytes and should be skipped.
     141$bn = basename( $path );
     142if ( ! preg_match( '/\.[A-Za-z0-9]+$/', $bn ) ) {
     143    $head = @file_get_contents( $path, false, null, 0, 512 );
     144    if ( $head !== false && strpos( $head, "\0" ) !== false ) {
     145        continue; // looks binary
     146    }
     147
     148    // Also skip very common extensionless log names that get huge
     149    if ( in_array( $bn, [ 'error_log', 'php_errors', 'php_errors.log', 'slow_query_log' ], true ) ) {
     150        continue;
     151    }
     152}
     153
     154
     155// 4) (Optional but recommended) skip known heavy dirs that never contain PHP you care about
     156$path_lc = strtolower( $path );
     157if (
     158    strpos( $path_lc, '/wp-content/cache/' ) !== false ||
     159    strpos( $path_lc, '/node_modules/' ) !== false ||
     160    strpos( $path_lc, '/.git/' ) !== false ||
     161    strpos( $path_lc, '/.svn/' ) !== false
     162) {
     163    continue;
     164}
     165           
     166            // NEW: skip the scanner file itself so it never enters the queue
     167            $scanner_file = wp_normalize_path( __FILE__ );
     168            if ( realpath( $path ) === realpath( $scanner_file ) ) {
     169                continue;
     170            }
     171           
     172            // Only allowed extensions / names / .well-known subtree
     173            if ( ! preg_match( $allowed_ext, $path ) ) {
     174                continue;
     175            }
     176            $files[] = $path;
    116177                }
    117178            } catch ( Throwable $e ) {
    … …  
    240301            }
    241302   
    242             $path = array_shift( $state['queue'] );
    243             $state['done']++;
    244    
    245             $contents = @file_get_contents( $path );
     303        $path = array_shift( $state['queue'] );
     304        $state['done']++;
     305       
     306        // NEW: skip the scanner file itself
     307        $scanner_file = wp_normalize_path( __FILE__ );
     308        if ( realpath( $path ) === realpath( $scanner_file ) ) {
     309            $processed_this_step++;
     310            continue;
     311        }
     312       
     313        $contents = @file_get_contents( $path );
     314
    246315            if ( $contents === false ) {
    247316                $processed_this_step++;
    … …  
    350419        // Build file body
    351420        $lines   = [];
    352         $lines[] = 'WP Folder Auditor — Scan Report';
     421        $lines[] = 'Guard Dog Security — Scan Report';
    353422        $lines[] = 'Generated: ' . gmdate( 'm-d-Y H:i:s' ) . '';
    354423        $lines[] = 'Site: ' . ( isset( $_SERVER['HTTP_HOST'] ) ? esc_url_raw( wp_unslash( $_SERVER['HTTP_HOST'] ) ) : '' );
    … …  
    378447
    379448        $body     = implode( "\r\n", $lines ) . "\r\n";
    380         $filename = 'Folder-Auditor-Scan-Report-' . gmdate( 'm-d-Y' ) . '.txt';
     449        $filename = 'Guard-Dog-Security-Scan-Report-' . gmdate( 'm-d-Y' ) . '.txt';
    381450
    382451        // Output download
    … …  
    408477        }
    409478        if ( empty( $scopes ) ) {
    410             $scopes = [ 'themes' ]; // safe default
     479            $scopes = [ 'full' ]; // safe default
    411480        }
    412481        $opts = [ 'scopes' => array_values( array_unique( $scopes ) ) ];
    … …  
    451520   
    452521        // Allowlist (same as wpfa_list_files)
    453         $allowed_ext = '/(?:\.(?:php|phtml|php7|pht|phtm|phar|html|css|js|htaccess|env|json|xml|lock|txt|md|po|mo|pot|log|ini|sql|csv)$'
     522        //$allowed_ext = '/(?:\.(?:php|phtml|php7|pht|phtm|phar|html|css|js|htaccess|env|json|xml|lock|txt|md|po|mo|pot|log|ini|sql|csv)$'
     523            //. '|(?:composer\.json|composer\.lock|package\.json|package-lock\.json|yarn\.lock|\.user\.ini|\.gitignore|\.gitattributes|\.editorconfig)$'
     524            //. '|\/\.well-known\/)/i';
     525            $allowed_ext = '/(?:\.(?:php|phtml|php7|pht|phtm|phar|html|css|js|htaccess|env|json|xml|lock|txt|md|po|mo|pot|log|ini|sql|csv)$'
    454526            . '|(?:composer\.json|composer\.lock|package\.json|package-lock\.json|yarn\.lock|\.user\.ini|\.gitignore|\.gitattributes|\.editorconfig)$'
    455527            . '|\/\.well-known\/)/i';
    … …  
    510582                    }
    511583   
    512                     $path = wp_normalize_path( $fileinfo->getPathname() );
    513    
    514                     // Only allowed extensions / names / .well-known subtree
    515                     if ( ! preg_match( $allowed_ext, $path ) ) {
    516                         continue;
    517                     }
    518    
     584            $path = wp_normalize_path( $fileinfo->getPathname() );
     585           
     586            // NEW: skip the scanner file itself
     587            $scanner_file = wp_normalize_path( __FILE__ );
     588            if ( realpath( $path ) === realpath( $scanner_file ) ) {
     589                continue;
     590            }
     591           
     592            // Only allowed extensions / names / .well-known subtree
     593            if ( ! preg_match( $allowed_ext, $path ) ) {
     594                continue;
     595            }
    519596                    // meta counts
    520597                    $__files_seen++;
    … …  
    589666        $lc = $contents;
    590667        $filename = basename( $path );
     668       
     669        // Quick binary header detection
     670$head = @file_get_contents( $path, false, null, 0, 4 );
     671if ( $head === "\x7FELF" || $head === "MZ" || $head === "\xCF\xFA\xED" ) {
     672    return true; // flag immediately
     673}
    591674
    592675        // --- Whitelist common safe libs to cut false positives
    … …  
    772855        return [ $raw, $norm ];
    773856    }
    774    
    775     protected function wpfa_get_raw_patterns() : array {
    776         // comment-aware (used on $raw) — flags even if disabled in comments
    777        
    778     return [
    779         '\beval\s*\(\s*base64_decode\s*\(',
    780         '\bpreg_replace\s*\(\s*([\'"])\s*([^\w\s\\])(?:\\.|(?!\2).)*\2(?=[A-Za-z]*e[A-Za-z]*\1)',
    781         '\b(?:include|require|include_once|require_once)\s*(?:\(\s*)?[\'"]https?:\/\/',
    782         '\b(?:exec|shell_exec|system|passthru|proc_open|popen|pcntl_exec)\s*\([^)]*\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\b',
    783         'shell_exec\s*\([^)]*\$_REQUEST',
    784         '\b(?:file_put_contents|fopen|fwrite|fputs)\s*\(\s*\$[A-Za-z_]\w*\s*,\s*base64_decode\s*\(',
    785         '[\'"]\s*e\s*[\'"]\s*\.\s*[\'"]\s*val\s*[\'"]',
    786         '[\'"]\s*base\s*[\'"]\s*\.\s*[\'"]\s*64\s*[\'"]\s*\.\s*[\'"]\s*decode\s*[\'"]',
    787         '\$\w+\s*=\s*[\'"][a-z]{1,3}[\'"]\s*;\s*\$\w+\s*=\s*[\'"][a-z]{1,3}[\'"]\s*;\s*\$\w+\s*=\s*\$\w+\s*\.\s*\$\w+\s*\.\s*[\'"](tem|val|sert)[\'"]\s*;',
    788         'ob_implicit_flush\s*\(\s*true\s*\)\s*;[\s\S]{0,160}\bob_end_flush\s*\(',
    789         '(?s)(?:OPENSSL_RAW_DATA.*substr\s*\(\s*hash\s*\(\s*[\'"]sha256[\'"]|substr\s*\(\s*hash\s*\(\s*[\'"]sha256[\'"].*OPENSSL_RAW_DATA|[\'"]<\s*\/?\s*scr?\s*[\'"]\s*\.\s*[\'"]r?ipt\s*>[\'"])',
    790         '(?s)\$[A-Za-z_]\w*\s*=\s*\$_(?:POST|REQUEST)\s*;.*?isset\s*\(\s*\$[A-Za-z_]\w*\s*\[[\'"][a-z0-9_]{3,}[\'"]\]\s*\).*?\$\w+\s*\(\s*\.\.\.\$\w+\s*\)',
    791         '(?s)readfile\s*\(\s*base64_decode\s*\(\s*["\'][^"\']{8,}["\']\s*\)\s*\)\s*;.*?eval\s*\(\s*.*?ob_get_clean\s*\(\s*\)\s*\)\s*;',
    792         'function\s*uPqmvR\s*\(',
    793         'function\s*yh1\s*\(',
    794         '\bUpVwwHRQ\s*\(',
    795         'array_map\(\s*[\'"]md5[\'"]\s*,\s*\$_COOKIE',
    796         '\$gi6\[\d+\]\s*\(\s*\$_(?:COOKIE|POST|REQUEST)',
    797         'include\s*\(\s*base64_decode\s*\(\s*\$[A-Za-z_]\w*\s*\)\s*(?:\.\s*)?\)\s*;',
    798         'call_user_func\s*\(\s*new\s+LiteSpeedMetaDataStore'
    799     ];
    800 
    801     }
    802    
    803     protected function wpfa_get_patterns() : array {
    804         // normalized patterns (used on $norm)
    805         return [
    806             '\b(?:fopen|fwrite|fputs|file_put_contents|file_get_contents|fclose|chmod|unlink)\s*\([^)]*base64_decode\s*\(',
    807             'basename\s*\(\s*__FILE__\s*,\s*base64_decode\s*\(',
    808             '\b(?:exec|shell_exec|system|passthru|proc_open|popen|pcntl_exec)\s*\([^)]*base64_decode\s*\(',
    809             '\b(?:exec|shell_exec|system|passthru|proc_open|popen|pcntl_exec)\s*\(\s*\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\b',
    810             '>\s*\/dev\/null\s*2>\s*\/dev\/null\s*&',
    811             '(?:base64_encode\s*\(\s*){2,}[^)]*\)',
    812             '(?:base64_decode\s*\(\s*){2,}[^)]*\)',
    813             'openssl_(?:en|de)crypt\s*\([^,]+,\s*[\'"]?\s*aes\s*[-_ ]?(?:128|192|256)\s*[-_ ]?cbc[\'"]?\s*,[^)]*hash\s*\(\s*[\'"]sha256[\'"]\s*,\s*[\'"][^\'"]{8,}[\'"]\s*,\s*true\s*\)[^)]*\)',
    814             'substr\s*\(\s*hash\s*\(\s*[\'"]sha256[\'"]\s*,\s*[\'"][^\'"]{8,}[\'"]\s*,\s*true\s*\)\s*,\s*0\s*,\s*16\s*\)',
    815             '\b(?:include|require|include_once|require_once)\s*\(\s*base64_decode\s*\(',
    816             '\b(?:include|require|include_once|require_once|file_get_contents|fopen)\s*\([^)]*(?:php:\/\/input|php:\/\/filter|data:\/\/)',
    817             'md5\s*\(\s*uniqid\s*\([^)]*\)\s*\)\s*\.\s*[\'"]\.(?:php|phtml)\b',
    818             'curl_init\s*\([^)]*\)\s*;[^;]*CURLOPT_(?:HTTPHEADER|COOKIE)[^;]*(?:Authorization|Cookie)[^;]*token\s*=\s*',
    819             'wp_remote_request\s*\([^)]*\bheaders\b[^)]*(?:Authorization|Cookie)[\'"]\s*=>\s*[\'"][^\'"]*token=',
    820             '`[^`]{1,200}`',
    821             '[\'"]<\s*sc[\'"]\s*\.\s*[\'"]ript\s*>[\'"]',
    822             '[\'"]<\/\s*scr[\'"]\s*\.\s*[\'"]ipt\s*>[\'"]',
    823             'array\s*\(\s*(?:\s*[\'"][a-z0-9][\'"]\s*,){3,}\s*[\'"][a-z0-9][\'"]\s*\)',
    824             '\$[A-Za-z_]\w*\s*=\s*\$\w+\s*\.\s*\$\w+\s*\.\s*[\'"](tem|xec)[\'"]',
    825             '(?s)readfile\s*\(\s*base64_decode\s*\(.*?\)\s*\).*?eval\s*\(\s*.*?ob_get_clean\s*\(\s*\).*?\)',
    826             '\$[A-Za-z_]\w*\s*=\s*\$[A-Za-z_]\w*\s*\[[\'"][a-z0-9_]{3,}[\'"]\]\s*;.*\$\w+\s*\(\s*\.\.\.\$\w+\s*\)',
    827         'function\s*uPqmvR\s*\(',
    828         'function\s*yh1\s*\(',
    829         '\bUpVwwHRQ\s*\(',
    830         'array_map\(\s*[\'"]md5[\'"]\s*,\s*\$_COOKIE',
    831         '\$gi6\[\d+\]\s*\(\s*\$_(?:COOKIE|POST|REQUEST)',
    832         'include\s*\(\s*base64_decode\s*\(\s*\$[A-Za-z_]\w*\s*\)\s*(?:\.\s*)?\)\s*;',
    833         'call_user_func\s*\(\s*new\s+LiteSpeedMetaDataStore'
    834         ];
    835     }
     857protected function wpfa_get_raw_patterns() : array {
     858    return [
     859        '^\x7fELF',
     860        '^MZ',
     861        '^\xCF\xFA\xED',
     862        '\b(?:require|require_once|include|include_once)\s*\(?\s*(?:@?\s*)?(?:base64_decode|str_rot13|gzinflate|gzuncompress)\s*\(',
     863        'error_reporting\\s*\\(\\s*0\\s*\\)\\s*;\\s*\\$LlCam\\s*=\\s*array\\(\\s*\"\\\\x5f\\\\107\\\\x45\\\\x54\"\\s*\\)\\s*;',
     864        '\\$\\{\\s*\\$LlCam\\s*\\[\\s*0\\s*\\]\\s*\\}',
     865        '@?require_once\\s*[\'"](?:\\\\x7a\\\\x69\\\\x70)[^\'"]*[\'"]',
     866        '\\\\x65\\\\x64\\\\x31\\\\x31\\\\x30\\\\x62\\\\x65\\\\x62\\\\x63\\\\x65\\\\x39\\\\x2e\\\\x74\\\\x6d\\\\x70',
     867        'ycycsUnT3uBLqyUrzfdIDg23r',
     868        '\beval\s*\(\s*base64_decode\s*\(',
     869        '\bpreg_replace\s*\(\s*([\'"])\s*([^\w\s\\])(?:\\.|(?!\2).)*\2(?=[A-Za-z]*e[A-Za-z]*\1)',
     870        '\b(?:include|require|include_once|require_once)\s*(?:\(\s*)?[\'"]https?:\/\/',
     871        '\b(?:exec|shell_exec|system|passthru|proc_open|popen|pcntl_exec)\s*\([^)]*\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\b',
     872        'shell_exec\s*\([^)]*\$_REQUEST',
     873        '\b(?:file_put_contents|fopen|fwrite|fputs)\s*\(\s*\$[A-Za-z_]\w*\s*,\s*base64_decode\s*\(',
     874        '[\'"]\s*e\s*[\'"]\s*\.\s*[\'"]\s*val\s*[\'"]',
     875        '[\'"]\s*base\s*[\'"]\s*\.\s*[\'"]\s*64\s*[\'"]\s*\.\s*[\'"]\s*decode\s*[\'"]',
     876        '\$\w+\s*=\s*[\'"][a-z]{1,3}[\'"]\s*;\s*\$\w+\s*=\s*[\'"][a-z]{1,3}[\'"]\s*;\s*\$\w+\s*=\s*\$\w+\s*\.\s*\$\w+\s*\.\s*[\'"](tem|val|sert)[\'"]\s*;',
     877        'ob_implicit_flush\s*\(\s*true\s*\)\s*;[\s\S]{0,160}\bob_end_flush\s*\(',
     878        '(?s)(?:OPENSSL_RAW_DATA.*substr\s*\(\s*hash\s*\(\s*[\'"]sha256[\'"]|substr\s*\(\s*hash\s*\(\s*[\'"]sha256[\'"].*OPENSSL_RAW_DATA|[\'"]<\s*\/?\s*scr?\s*[\'"]\s*\.\s*[\'"]r?ipt\s*>[\'"])',
     879        '(?s)\$[A-Za-z_]\w*\s*=\s*\$_(?:POST|REQUEST)\s*;.*?isset\s*\(\s*\$[A-Za-z_]\w*\s*\[[\'"][a-z0-9_]{3,}[\'"]\]\s*\).*?\$\w+\s*\(\s*\.\.\.\$\w+\s*\)',
     880        '(?s)readfile\s*\(\s*base64_decode\s*\(\s*["\'][^"\']{8,}["\']\s*\)\s*\)\s*;.*?eval\s*\(\s*.*?ob_get_clean\s*\(\s*\)\s*\)\s*;',
     881        'function\s*uPqmvR\s*\(',
     882        'function\s*yh1\s*\(',
     883        '\bUpVwwHRQ\s*\(',
     884        'array_map\(\s*[\'"]md5[\'"]\s*,\s*\$_COOKIE',
     885        '\$gi6\[\d+\]\s*\(\s*\$_(?:COOKIE|POST|REQUEST)',
     886        'include\s*\(\s*base64_decode\s*\(\s*\$[A-Za-z_]\w*\s*\)\s*(?:\.\s*)?\)\s*;',
     887        'call_user_func\s*\(\s*new\s+LiteSpeedMetaDataStore'
     888    ];
    836889}
     890
     891protected function wpfa_get_patterns() : array {
     892    return [
     893        '^\x7fELF',
     894        '^MZ',
     895        '^\xCF\xFA\xED',
     896        '\b(?:require|require_once|include|include_once)\s*\(?\s*(?:@?\s*)?(?:base64_decode|str_rot13|gzinflate|gzuncompress)\s*\(',
     897        'error_reporting\\s*\\(\\s*0\\s*\\)\\s*;\\s*\\$LlCam\\s*=\\s*array\\s*\\(',
     898        '\\$\\{\\s*\\$LlCam\\s*\\[\\s*0\\s*\\]\\s*\\}',
     899        '@?require_once\\s*[\\\'\\"][^\\\'\\\"]{3,256}[\\\'\\"]',
     900        'ed110bebce9\\.tmp',
     901        'ycycsUnT3uBLqyUrzfdIDg23r',
     902        '\b(?:fopen|fwrite|fputs|file_put_contents|file_get_contents|fclose|chmod|unlink)\s*\([^)]*base64_decode\s*\(',
     903        'basename\s*\(\s*__FILE__\s*,\s*base64_decode\s*\(',
     904        '\b(?:exec|shell_exec|system|passthru|proc_open|popen|pcntl_exec)\s*\([^)]*base64_decode\s*\(',
     905        '\b(?:exec|shell_exec|system|passthru|proc_open|popen|pcntl_exec)\s*\(\s*\$_(?:GET|POST|REQUEST|COOKIE|SERVER)\b',
     906        '>\s*\/dev\/null\s*2>\s*\/dev\/null\s*&',
     907        '(?:base64_encode\s*\(\s*){2,}[^)]*\)',
     908        '(?:base64_decode\s*\(\s*){2,}[^)]*\)',
     909        'openssl_(?:en|de)crypt\s*\([^,]+,\s*[\'"]?\s*aes\s*[-_ ]?(?:128|192|256)\s*[-_ ]?cbc[\'"]?\s*,[^)]*hash\s*\(\s*[\'"]sha256[\'"]\s*,\s*[\'"][^\'"]{8,}[\'"]\s*,\s*true\s*\)[^)]*\)',
     910        'substr\s*\(\s*hash\s*\(\s*[\'"]sha256[\'"]\s*,\s*[\'"][^\'"]{8,}[\'"]\s*,\s*true\s*\)\s*,\s*0\s*,\s*16\s*\)',
     911        '\b(?:include|require|include_once|require_once)\s*\(\s*base64_decode\s*\(',
     912        '\b(?:include|require|include_once|require_once|file_get_contents|fopen)\s*\([^)]*(?:php:\/\/input|php:\/\/filter|data:\/\/)',
     913        'md5\s*\(\s*uniqid\s*\([^)]*\)\s*\)\s*\.\s*[\'"]\.(?:php|phtml)\b',
     914        'curl_init\s*\([^)]*\)\s*;[^;]*CURLOPT_(?:HTTPHEADER|COOKIE)[^;]*(?:Authorization|Cookie)[^;]*token\s*=\s*',
     915        'wp_remote_request\s*\([^)]*\bheaders\b[^)]*(?:Authorization|Cookie)[\'"]\s*=>\s*[\'"][^\'"]*token=',
     916        '`[^`]{1,200}`',
     917        '[\'"]<\s*sc[\'"]\s*\.\s*[\'"]ript\s*>[\'"]',
     918        '[\'"]<\/\s*scr[\'"]\s*\.\s*[\'"]ipt\s*>[\'"]',
     919        'array\s*\(\s*(?:\s*[\'"][a-z0-9][\'"]\s*,){3,}\s*[\'"][a-z0-9][\'"]\s*\)',
     920        '\$[A-Za-z_]\w*\s*=\s*\$\w+\s*\.\s*\$\w+\s*\.\s*[\'"](tem|xec)[\'"]',
     921        '(?s)readfile\s*\(\s*base64_decode\s*\(.*?\)\s*\).*?eval\s*\(\s*.*?ob_get_clean\s*\(\s*\).*?\)',
     922        '\$[A-Za-z_]\w*\s*=\s*\$[A-Za-z_]\w*\s*\[[\'"][a-z0-9_]{3,}[\'"]\]\s*;.*\$\w+\s*\(\s*\.\.\.\$\w+\s*\)',
     923        'function\s*uPqmvR\s*\(',
     924        'function\s*yh1\s*\(',
     925        '\bUpVwwHRQ\s*\(',
     926        'array_map\(\s*[\'"]md5[\'"]\s*,\s*\$_COOKIE',
     927        '\$gi6\[\d+\]\s*\(\s*\$_(?:COOKIE|POST|REQUEST)',
     928        'include\s*\(\s*base64_decode\s*\(\s*\$[A-Za-z_]\w*\s*\)\s*(?:\.\s*)?\)\s*;',
     929        'call_user_func\s*\(\s*new\s+LiteSpeedMetaDataStore'
     930    ];
     931}
     932}

  • folder-auditor/trunk/readme.txt

    r3379504 r3380286  
    66Tested up to: 6.8
    77Requires PHP: 7.4
    8 Stable tag: 4.3
     8Stable tag: 4.4
    99License: GPLv2 or later
    1010License URI: https://www.gnu.org/licenses/gpl-2.0.html
    … …  
    9393== Changelog ==
    9494
     95= 4.4 =
     96* Added new infection patterns to find bad files
     97
    9598= 4.3 =
    9699* Setup MainWP bridge for unlock relock when running updates
    … …  
    195198== Upgrade Notice ==
    196199
     200= 4.4 =
     201* Added new infection patterns to find bad files
     202
    197203= 4.3 =
    198204* Setup MainWP bridge for unlock relock when running updates
Note: See TracChangeset for help on using the changeset viewer.