Malicious

A simple, lightweight framework to detect potential suspicious/malicious PHP Code and few other commons sources of problems. Fully extensible with plugins (Check & Report) support...

@copyright Ackwa.fr - 2014

Usage

via HTTP

http://mydomain.com/Malicious/index.php?s=mysecretkey

via CLI

php index.php -s=mysecretkey

Plugins

Active plugins are defined in config.phpviaMCS_PLUGINS(Check) andMCS_REPORTS` (Report) constants:

define('MCS_PLUGINS'  , 'readable,big');
define('MCS_REPORTS'  , 'echo');

You can declare more than one configuration :

define('MCS_PLUGINS_1'  , 'readable,exec,eval');
define('MCS_REPORTS_1'  , 'echo,log');

And use this new configuration with c and r parameters :

http://mydomain.com/Malicious/index.php?s=mysecretkey&c=1&r=1

Check Plugins

Name | Description ----------- | ----------------------------------- readable | Check if files are readable writable | Check if files are writable updated | Check if files has been updated since last check shelldb | Track PHP files in regards of PHP Shell Detector database eval | Track PHP files with suspect "eval()" exec | Track PHP files with exec(), system()... longline | Track PHP files with very long lines big | Track big files and files larger "than post_max_size" hidden | Track hidden files and directories (.xxx) empty | Track empty files cms | In progress image | In progress syntax | In progress metrics | In progress change | In progress footprint | In progress perm | In progress token | In progress ini | In progress htaccess | In progress mime | In progress

Report Plugins

Name | Description ----------- | ----------------------------------- echo | Display results to browser / screen log | Log results in malicious.log Mail | Send results via e-mail html | In progress pdf | In progress sms | In progress Analytics | In progress

Resources

inspiration

• Malicious Code Scanner
• PHP Shell Detector
• Obfuscalp
• Tripwire

Security informations

• How to Tell if Your PHP Site has been Hacked or Compromised
• Exploitable PHP functions
• Code injection – a simple PHP virus carried in a JPEG image
• Webshell

TODO

• More plugins
• Documentation

Disclaimer

This software is provided "as is" without warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability and fitness for a particular purpose. In no event shall the author be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if the author has been advised of the possibility of such damages.