cadline_web/www_archline_hu
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request 'fix(baseline): catch .htaccess php-enable persistence in the safety-net' (#8) from fix/htaccess-safety-net into main

Browse Source 
Reviewed-on: #8
This commit is contained in:
Imre Lázár 2026-07-23 07:24:47 +02:00
commit 24f8e95c92
3 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
build-baseline.sh
View File

@ -102,4 +102,14 @@ if [ -f "$ROOT/malware-iocs.paths" ]; then
done < "$ROOT/malware-iocs.paths" done < "$ROOT/malware-iocs.paths"
fi fi
# (d) .htaccess-based PHP-enable persistence — apache-config droppers the
# content/extension filters above miss (no <?php tag, not *.php.json).
# Mirrors the malware_htaccess_php_enable YARA rule (illusion/hids#183).
log "exclude: .htaccess-based php-enable persistence"
find "$OUT" -type f \( -name '.htaccess' -o -name '.htaccess.*' \) 2>/dev/null | while IFS= read -r h; do
if grep -IlqE 'Add(Type|Handler)[[:space:]]+application/x-httpd-php[0-9]?[[:space:]]+\.(json|jpe?g|png|gif|txt|ico|css|html?|xml|svg|bak|log)|php_flag[[:space:]]+engine[[:space:]]+on' "$h" 2>/dev/null; then
log " drop (htaccess-php-enable): ${h#"$OUT"/}"; rm -f "$h"
fi
done
log "baseline built at: $OUT ($(find "$OUT" -type f | wc -l) files)" log "baseline built at: $OUT ($(find "$OUT" -type f | wc -l) files)"

4
deployed/helix3/templates/shaper_helix3/.htaccess.json
View File

@ -1,4 +0,0 @@
Options +ExecCGI
AddType application/x-httpd-php .json
AddHandler application/x-httpd-php .json
AddHandler application/x-httpd-php5 .json

1
malware-iocs.paths
View File

@ -47,3 +47,4 @@ templates/shaper_helix3/layout/_hxprobeoa31x6.json
templates/shaper_helix3/layout/_hxprobet7sh3r.json templates/shaper_helix3/layout/_hxprobet7sh3r.json
templates/shaper_helix3/layout/jftest.json templates/shaper_helix3/layout/jftest.json
templates/shaper_helix3/layout/nxtest.json templates/shaper_helix3/layout/nxtest.json
templates/shaper_helix3/.htaccess.json