cadline_web/www_archline_hu
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
61d176fb5e
www_archline_hu/malware-iocs.paths
imre.agent 61d176fb5e feat(archlinexp.eu): add clean deployable baseline on Joomla 3.9.2 
Build the archlinexp.eu/www baseline from clean sources on a dedicated
site branch, per the web-baseline deploy model: vanilla Joomla 3.9.2 core
plus the developer-sourced own-code plus a vetted module layer, with the
Cadline core delta applied on the 3.9.2 base. The generator is reused
unchanged: build-baseline.sh is site-agnostic, only the content differs.

Layers:
- core/      vanilla Joomla 3.9.2 official package (installer removed)
- cadline/   own-code from the developer source (beiratkozas, maintenance,
             mod_al_*, mod_alusers, mod_course_list) plus 11 assets that
             the developer source lacks
- deployed/  third-party module slugs taken from live, vetted
- overrides/ the 5 genuine Cadline core modifications, on the 3.9.2 base

The live core carried 31 stale com_users files: the updater skipped the
customized ones, so the version string said 3.9.2 while the code did not.
Taking vanilla 3.9.2 plus the 2 real deltas fixes that silently.

Vetting caught two items that content-based YARA did not flag. Both come
from a structural rule: an extra file on a core-component path that is
not a template override is not a module -- it is a leftover or a plant.
Both are excluded through malware-iocs.paths:
- components/com_mailto/mail.php: an unauthenticated file-write webshell
  (POST save_file + file_content -> fopen/fwrite, no auth check at all),
  present on live since 2021-07-26
- administrator/components/com_joomlaupdate/restoration.php: an Akeeba
  Kickstart leftover carrying a security password (known RCE vector)

Verification: build-baseline.sh -> out/ = 12284 files; YARA (16 rules) on
every source layer and on the built tree = 0 hits; none of the 291 IOC
paths present; no disguised .json dropper; core verified as 3.9.2; the
only extra file left on a core path is the legit Google reCAPTCHA library.

Assisted-by: claude-code@claude-opus-4-8
2026-07-17 12:18:26 +02:00

297 lines
8.1 KiB
Plaintext
Raw Blame History

# archlinexp.eu — malware/planted paths (docroot-relative), excluded from the baseline.
# Generated from the live-vs-vanilla-3.9.2 diff (2026-07-17). Content-based .json
# droppers under templates/ are additionally caught by build-baseline.sh step 6/(a).
.htaccess.json
1337.php.json
1337p.php.json
4faas4yn3dn0.phar.json
4faas4yn3dn0.php.json
4faas4yn3dn0.php5.json
4faas4yn3dn0.php7.json
4faas4yn3dn0.phtml.json
70pv0kju.php.json
70pv0kju.php5.json
70pv0kju.phtml.json
7days.json
8060lgz1cqeu.gif.json
8060lgz1cqeu.gif.php.json
8060lgz1cqeu.jpeg.json
8060lgz1cqeu.jpeg.php.json
8060lgz1cqeu.jpg.json
8060lgz1cqeu.jpg.php.json
8060lgz1cqeu.phar.json
8060lgz1cqeu.php.json
8060lgz1cqeu.php5.json
8060lgz1cqeu.phtml.json
8060lgz1cqeu.png.json
8060lgz1cqeu.png.php.json
8j7txp50.php%00.jpg.json
8j7txp50.php%00.txt.json
8j7txp50.php.bak.json
8j7txp50.php.jpg.json
8j7txp50.php.json
8j7txp50.php.txt.json
8j7txp50.php4.json
8j7txp50.php5.json
8j7txp50.phtml.json
_h3x_0tc4t3dy.php.json
_h3x_19b8fmhn.php.json.json
_h3x_2xbk7ug3.php.json
_h3x_672ba9cf.php.json
_h3x_6h0804r6.php.json
_h3x_8nom65ew.php.json
_h3x_ajhdpqok.php.json
_h3x_fiqbuwjw.php.json.json
_h3x_kgetu0xr.php.json
_h3x_kgqxc7tj.php.json
_h3x_knton7qj.php.json
_h3x_m28547fv.php.json
_h3x_qdjyeroc.php.json
_h3x_r02w559c.php.json
_h3x_v6hzbjh8.php.json
_h3x_vimcjrhc.php.json.json
_h3x_vunx1gid.php.json
_h3x_y6oge9dr.php.json
administrator/4faas4yn3dn0.php.json
administrator/8060lgz1cqeu.php.json
administrator/8j7txp50.php.json
administrator/cache/c_03e0fd55.php.json
administrator/cache/c_7f0b46f9.php.json
administrator/cache/f46vc3nzn1qw.php.json
administrator/components/f46vc3nzn1qw.php.json
administrator/f46vc3nzn1qw.php.json
administrator/index.php.json
administrator/ko6h7s5e9kak.php.json
administrator/language/f46vc3nzn1qw.php.json
administrator/ntxvq7b4jper.php.json
administrator/templates/hathor/index.php.json
administrator/templates/isis/index.php.json
administrator/yhajxaav.php.json
bdkr28.json
bexkn.php.json
blackleets.json
boss.json
c_03e0fd55.php.json
c_7f0b46f9.php.json
cache/8j7txp50.php.json
cache/_h3x_9zbnowsb.php.json.json
cache/_h3x_e4pk161f.php.json.json
cache/_h3x_r16oprou.php.json.json
cache/c_03e0fd55.php.json
cache/c_7f0b46f9.php.json
cache/d6g30n.php.json
cache/f46vc3nzn1qw.php.json
cache/info.php.json
cache/p8xu5l.php.json
cache/shell.php.json
cache/yhajxaav.php.json
captain.json
cbdjs.json
cernunnos.json
components/com_content/f46vc3nzn1qw.php.json
components/com_joomgallery/views/image/view.jpg.php
components/f46vc3nzn1qw.php.json
configuration.php
cox.json
cyberdjs.json
d6g30n.php.json
es6jo0xq.php.json
es6jo0xq.php5.json
es6jo0xq.phtml.json
f46vc3nzn1qw.php.json
f46vc3nzn1qw.php5.json
f46vc3nzn1qw.php7.json
f46vc3nzn1qw.phtml.json
files/_h3x_2hjfdfr5.php.json.json
files/_h3x_aqjg408i.php.json.json
files/_h3x_vp8mjkv7.php.json.json
flamy.json
flamy.php.json
friska.php.json
ghosthaxor.json
h0rn3t.json
h3x_49822__php.json
hwlyroez.json
hwlyroez.php.json
hwlyroez.phtml.json
images/4faas4yn3dn0.php.json
images/4faas4yn3dn0.phtml.json
images/6iyo68ipsz.php.json
images/8060lgz1cqeu.phar.json
images/8060lgz1cqeu.php.json
images/8060lgz1cqeu.phtml.json
images/8j7txp50.php.json
images/_h3x_6h0804r6.php.json
images/_h3x_6h0804r6.php5.json
images/_h3x_6h0804r6.phtml.json
images/_h3x_ajhdpqok.php.json
images/_h3x_ajhdpqok.php5.json
images/_h3x_ajhdpqok.phtml.json
images/_h3x_hzba1jvm.php.json.json
images/_h3x_je0zgowm.php.json.json
images/_h3x_kgqxc7tj.php.json
images/_h3x_kgqxc7tj.php5.json
images/_h3x_kgqxc7tj.phtml.json
images/_h3x_ott0201u.php.json.json
images/_h3x_qdjyeroc.php.json
images/_h3x_qdjyeroc.php5.json
images/_h3x_qdjyeroc.phtml.json
images/_h3x_v6hzbjh8.php.json
images/_h3x_v6hzbjh8.php5.json
images/_h3x_v6hzbjh8.phtml.json
images/_php_baeda0.php.json
images/backup.f46vc3nzn1qw.php.json
images/c_03e0fd55.php.json
images/c_7f0b46f9.php.json
images/d6g30n.php.json
images/d_96ac.php.json
images/f46vc3nzn1qw.php.json
images/h3x_2i8n13gl.php.json
images/h3x_33dbxlod.phtml.json
images/h3x_9997u119.php.json
images/h3x_e88bc62u.phtml.json
images/h3x_g3rhd4hx.php.json
images/h3x_gp0vatrc.php.json
images/h3x_irj8ng6m.php.json
images/h3x_jaynjuu6.phtml.json
images/h3x_jhd6r2bk.php.json
images/h3x_lk6pzgbt.phtml.json
images/h3x_p29ivhj8.php.json
images/h3x_r1mc7roy.php.json
images/h3x_rbaryhg8.php.json
images/h3x_rgzfvyoc.phtml.json
images/h3x_s23jezbz.php.json
images/h3x_v82n3yod.phtml.json
images/h3x_vvpvaj6o.php.json
images/h3x_xzw4q6cs.php.json
images/ko6h7s5e9kak.php.json
images/ko6h7s5e9kak.phtml.json
images/ntxvq7b4jper.php.json
images/ntxvq7b4jper.phtml.json
images/p8xu5l.php.json
images/shell.php.json
images/temp.f46vc3nzn1qw.php.json
images/uo89i5.php.json
images/yhajxaav.php.json
info.php.json
joth73.json
ko6h7s5e9kak.phar.json
ko6h7s5e9kak.php.json
ko6h7s5e9kak.php5.json
ko6h7s5e9kak.php7.json
ko6h7s5e9kak.phtml.json
kvjrvsep.json
language/f46vc3nzn1qw.php.json
logs/8j7txp50.php.json
logs/_h3x_hzuz4jb8.php.json.json
logs/_h3x_nbmlj4wd.php.json.json
logs/_h3x_nyg1j0r2.php.json.json
logs/f46vc3nzn1qw.php.json
logs/yhajxaav.php.json
loopenx.json
lumup.php.json
lx.html.json
maintht.json
media/4faas4yn3dn0.phtml.json
media/8060lgz1cqeu.phtml.json
media/8j7txp50.php.json
media/_h3x_hn5jabjv.php.json.json
media/_h3x_qkrfp39e.php.json.json
media/_h3x_sp89teja.php.json.json
media/c_03e0fd55.php.json
media/c_7f0b46f9.php.json
media/d6g30n.php.json
media/f46vc3nzn1qw.php.json
media/ko6h7s5e9kak.phtml.json
media/ntxvq7b4jper.php.json
media/p8xu5l.php.json
media/shell.php.json
media/yhajxaav.php.json
modules/f46vc3nzn1qw.php.json
modules/mod_custom/f46vc3nzn1qw.php.json
night.html.json
ntxvq7b4jper.php.json
ntxvq7b4jper.phtml.json
nxproof.php.json
p8xu5l.php.json
phpinfo.php.json
shadow.php.json
shell.json
smok.json
smok3r.json
stfu.json
templates/.htaccess.json
templates/_h3x_672ba9cf.json
templates/_h3x_672ba9cf.php.json
templates/beez3/f46vc3nzn1qw.php.json
templates/beez3/index.php.json
templates/cox.json
templates/d6g30n.php.json
templates/f46vc3nzn1qw.php.json
templates/index.php.json
templates/lx.html.json
templates/night.html.json
templates/ntxvq7b4jper.php.json
templates/nxproof.php.json
templates/p8xu5l.php.json
templates/protostar/f46vc3nzn1qw.php.json
templates/protostar/index.php.json
templates/shaper_helix3/layout/default.json
templates/shaper_helix3/layout/uploader_8kykulyz.php.json.json
templates/shaper_helix3/layout/uploader_g1jujsa9.php.json.json
templates/shaper_helix3/layout/uploader_q1z4oez8.php.json.json
templates/shaper_helix3/layout/uploader_uwqytc5i.php.json.json
templates/shaper_helixultimate/.htaccess.json
templates/shaper_helixultimate/_h3x_672ba9cf.json
templates/shaper_helixultimate/_h3x_672ba9cf.phar.json
templates/shaper_helixultimate/_h3x_672ba9cf.php.json
templates/shaper_helixultimate/_h3x_672ba9cf.php5.json
templates/shaper_helixultimate/_h3x_672ba9cf.phtml.json
templates/shaper_helixultimate/_hxte7rcz9e.php.json
templates/shaper_helixultimate/_hxter275wt.php.json
templates/shaper_helixultimate/_hxtes04s5q.php.json
templates/shaper_helixultimate/_hxtes3fimi.php.json
templates/shaper_helixultimate/cox.json
templates/shaper_helixultimate/lx.html.json
templates/shaper_helixultimate/night.html.json
templates/shaper_helixultimate/nxproof.php.json
templates/shaper_helixultimate/options.json
templates/shaper_helixultimate/up.php.json
templates/up.php.json
tmp/8j7txp50.php.json
tmp/_h3x_axg1w8kw.php.json.json
tmp/_h3x_ipxvztce.php.json.json
tmp/_h3x_ul3ooiwi.php.json.json
tmp/c_03e0fd55.php.json
tmp/c_7f0b46f9.php.json
tmp/f46vc3nzn1qw.php.json
tmp/shell.php.json
tmp/wirrd.php.json
tmp/yhajxaav.php.json
up.php.json
uploaded.json.php.json
uploader.json
vile.json
vile.json.json
vile.php.json
vile.php.json.json
wp-blog.php.json
wp-blog.php.json.json
x9.json
x9txt.json
yetixx.json
yhajxaav.php%00.jpg.json
yhajxaav.php%00.txt.json
yhajxaav.php.bak.json
yhajxaav.php.jpg.json
yhajxaav.php.json
yhajxaav.php.txt.json
yhajxaav.php4.json
yhajxaav.php5.json
yhajxaav.phtml.json
zyfnar.php.json
# --- Strukturális szűrés (2026-07-17): extra fájl CORE-komponens útvonalán,
# ami nem template-override. A tartalmi YARA egyiket sem fogta.
components/com_mailto/mail.php
administrator/components/com_joomlaupdate/restoration.php
Reference in New Issue View Git Blame Copy Permalink