cadline_web/www_archline_hu
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: purge planted malware from baseline + content-based IOC filter

Browse Source 
The "clean" baseline unintentionally shipped ~34 planted webshells/backdoors
plus sbtrack (a third-party SEO-cloaking proxy) and inert scanner probes,
carried in from the vetted-live Helix3 template. They survived because the IOC
safety net keyed on extension ('*.php.json') while the attacker disguised one
webshell under ~20 fake extensions (.inc.json/.phar.json/.php[3-5].json/
.php.json.json) plus plain-.json defacements.

- History rewritten (git filter-repo) to remove all 48 files from every commit.
- build-baseline.sh step 6 is now CONTENT-based: any templates/**/*.json with a
  PHP open tag is dropped (legit Helix3 presets are pure JSON).
- malware-iocs.paths extended with plain-.json defacements, probe artifacts and
  non-.json droppers a content grep cannot key on.

Found by the imrcli HIDS YARA union layer during baseline integration (the
baseline-diff alone would have marked them baseline-match).

Assisted-by: claude-code@claude-opus-4-8
This commit is contained in:
imre.agent 2026-07-16 15:21:49 +02:00
parent 9a585c1439
commit 5603690a72
2 changed files with 48 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
build-baseline.sh
View File

@ -73,11 +73,27 @@ fi
# the live divergence until live is re-deployed or the drift is reconciled.
# Line-ending normalization is intentionally left to the verifier, not applied here.
# 6) Safety net — malware IOC + scan artifacts must never appear in the baseline
# (the sources above already exclude them; this is defensive, documented in
# malware-iocs.md / malware-iocs.paths).
log "exclude: malware IOC + scan artifacts"
# 6) Safety net — CONTENT-based malware exclusion. The constituent sources above
# are vetted clean, but this catches a planted file regardless of its extension
# disguise. The 2026 incident planted one webshell under ~20 fake extensions
# (.inc.json / .phar.json / .php[3-5].json / .php.json.json) plus plain-.json
# defacements — an extension allowlist (the old '*.php.json' filter) missed ALL
# of them. The robust signal is CONTENT, not extension.
log "exclude: content-based malware safety net"
# (a) Any .json under templates/ carrying a PHP open tag is NOT a legit Helix3
# layout preset (those are pure JSON) — it is a disguised dropper. This closes
# the .json-disguise gap deterministically.
if [ -d "$OUT/templates" ]; then
find "$OUT/templates" -type f -name '*.json' 2>/dev/null | while IFS= read -r j; do
if grep -Ilq -m1 -E '<\?php|<\?=' "$j" 2>/dev/null; then
log " drop (php-in-json): ${j#"$OUT"/}"; rm -f "$j"
fi
done
fi
# (b) Legacy extension patterns (belt-and-suspenders; harmless if already gone).
find "$OUT" \( -name '*.php.json' -o -name '*.phtml.json' -o -name 'h3x_*' -o -name '_h3x_*' \) -delete 2>/dev/null || true
# (c) Explicit IOC path list (docroot-relative) — the plain-.json defacements,
# probe artifacts and non-.json droppers that a content grep cannot key on.
if [ -f "$ROOT/malware-iocs.paths" ]; then
while IFS= read -r ioc; do
[ -z "$ioc" ] && continue

28
malware-iocs.paths
View File

@ -19,3 +19,31 @@ components/com_joml_incf
administrator/components/com_joml_incf
components/com_sys_rom
administrator/components/com_sys_rom
# --- 2026 incidens: a vetted-live Helix3-ból behozott, kiterjesztés-álcázott
# droppek/defacementek/probe-k + sbtrack cloaking-proxy (security-cleanup).
# A PHP-tagos .json droppeket a build-baseline.sh step 6/(a) tartalom-alapon fogja;
# az alábbiak (plain-.json defacement/probe + non-.json .php) explicit listán.
language/en-GB/en-GB.php
modules/mod_jsnusers/tmpl/index.php
sbtrack.php
templates/beez3/info.php
templates/shaper_helix3/cox.json
templates/shaper_helix3/layout/5ce342d1feeb3297_xri6l4eq.json
templates/shaper_helix3/layout/6etar.json
templates/shaper_helix3/layout/8a38e129e76e80ff_d3h48ag1.json
templates/shaper_helix3/layout/9cb22468b5254cb4_zaaafntq.json
templates/shaper_helix3/layout/cox.json
templates/shaper_helix3/layout/_d1337_vuln_probe.json
templates/shaper_helix3/layout/dummy.json
templates/shaper_helix3/layout/_hxep1rur.json
templates/shaper_helix3/layout/_hxepn2vl.json
templates/shaper_helix3/layout/_hxepqjbw.json
templates/shaper_helix3/layout/_hxepqvk3.json
templates/shaper_helix3/layout/_hxeptiha.json
templates/shaper_helix3/layout/_hxepx62d.json
templates/shaper_helix3/layout/_hxprobe8myf1c.json
templates/shaper_helix3/layout/_hxprobeoa31x6.json
templates/shaper_helix3/layout/_hxprobet7sh3r.json
templates/shaper_helix3/layout/jftest.json
templates/shaper_helix3/layout/nxtest.json