cadline_web/www_archline_hu
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(baseline): catch .htaccess php-enable persistence in safety-net

Browse Source 
The malware safety-net missed .htaccess/.htaccess.json droppers that
enable PHP on non-.php extensions (AddType/AddHandler
application/x-httpd-php .json, php_flag engine on): they carry no
<?php tag and are not *.php.json, so filters (a)/(b)/(c) all skipped
them. One such file (deployed/helix3/.../shaper_helix3/.htaccess.json)
had entered the source repo and was built into the baseline (B:match),
blinding the detector against itself.

Add safety-net section (d) mirroring the malware_htaccess_php_enable
YARA rule (illusion/hids#183), remove the file from the source tree,
and add its path to malware-iocs.paths.

Ref: cadline/infra#180
This commit is contained in:
imre.agent 2026-07-22 07:52:52 +02:00
parent 974beee429
commit ca4d61d6c0
3 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
build-baseline.sh
View File

@ -102,4 +102,14 @@ if [ -f "$ROOT/malware-iocs.paths" ]; then
done < "$ROOT/malware-iocs.paths" done < "$ROOT/malware-iocs.paths"
fi fi
# (d) .htaccess-based PHP-enable persistence — apache-config droppers the
# content/extension filters above miss (no <?php tag, not *.php.json).
# Mirrors the malware_htaccess_php_enable YARA rule (illusion/hids#183).
log "exclude: .htaccess-based php-enable persistence"
find "$OUT" -type f \( -name '.htaccess' -o -name '.htaccess.*' \) 2>/dev/null | while IFS= read -r h; do
if grep -IlqE 'Add(Type|Handler)[[:space:]]+application/x-httpd-php[0-9]?[[:space:]]+\.(json|jpe?g|png|gif|txt|ico|css|html?|xml|svg|bak|log)|php_flag[[:space:]]+engine[[:space:]]+on' "$h" 2>/dev/null; then
log " drop (htaccess-php-enable): ${h#"$OUT"/}"; rm -f "$h"
fi
done
log "baseline built at: $OUT ($(find "$OUT" -type f | wc -l) files)" log "baseline built at: $OUT ($(find "$OUT" -type f | wc -l) files)"

4
deployed/helix3/templates/shaper_helix3/.htaccess.json
View File

@ -1,4 +0,0 @@
Options +ExecCGI
AddType application/x-httpd-php .json
AddHandler application/x-httpd-php .json
AddHandler application/x-httpd-php5 .json

1
malware-iocs.paths
View File

@ -47,3 +47,4 @@ templates/shaper_helix3/layout/_hxprobeoa31x6.json
templates/shaper_helix3/layout/_hxprobet7sh3r.json templates/shaper_helix3/layout/_hxprobet7sh3r.json
templates/shaper_helix3/layout/jftest.json templates/shaper_helix3/layout/jftest.json
templates/shaper_helix3/layout/nxtest.json templates/shaper_helix3/layout/nxtest.json
templates/shaper_helix3/.htaccess.json