duanni5726 2013-10-10 22:10
浏览 371

使用PHP连接的base64_decode的正则表达式(正则表达式)匹配

So i've been trying to build a regex for the past couple hours and i'm starting to go crazy in thinking if this is even possible or worth wild.

I have a script that scans PHP files checking MD5 sum for known malicious files, and certain strings. Most recently i've come across files where instead of using base64_decode in the PHP file, they are using variables and concatenating it so the scanner doesn't pick it up.

As an example here's the latest one I found:

$a='bas'.'e6'.'4_d'.'ecode';eval($a

So because the scanner searches for base64_decode this file wasn't picked up as they are using PHP to concatenate base64_decode in a variable, and then call the variable.

Forgive me because i've just started with regex, but is it even possible to search for something like this using regex? I mean, I understand and was able to get a regex that would match that exact one, but what about if they used this instead:

$a='b'.'ase'.'64_d'.'ecode';eval($a

It wouldn't be picked up because the regex was looking for ' then b then a, etc etc.

I've already added

(eval)\(\$[a-z]

To send me an email as a notice to check the file, i'll have to let it run for a couple days and see how many false positives show up, but my main concern is with the base64_decode

If someone could please shed some light on this for me and maybe point me in the right direction, I would greatly appreciate it.

Thanks!!

  • 写回答

1条回答 默认 最新

  • duanli0453 2013-10-10 22:15
    关注

    You can use this regexp:

    b\W*a\W*s\W*e\W*6\W4\W*_\W*d\W*e\W*c\W*o\W*d\W*e
    

    It searches for base64_decode with any non-alphanumeric characters interspersed.

    评论

报告相同问题?

悬赏问题

  • ¥15 matlab数字图像处理频率域滤波
  • ¥15 在abaqus做了二维正交切削模型,给刀具添加了超声振动条件后输出切削力为什么比普通切削增大这么多
  • ¥15 ELGamal和paillier计算效率谁快?
  • ¥15 file converter 转换格式失败 报错 Error marking filters as finished,如何解决?
  • ¥15 ubuntu系统下挂载磁盘上执行./提示权限不够
  • ¥15 Arcgis相交分析无法绘制一个或多个图形
  • ¥15 关于#r语言#的问题:差异分析前数据准备,报错Error in data[, sampleName1] : subscript out of bounds请问怎么解决呀以下是全部代码:
  • ¥15 seatunnel-web使用SQL组件时候后台报错,无法找到表格
  • ¥15 fpga自动售货机数码管(相关搜索:数字时钟)
  • ¥15 用前端向数据库插入数据,通过debug发现数据能走到后端,但是放行之后就会提示错误