cve-2019-0604

www.intruder.io

hosthere.com

github.com

unit42.paloaltonetworks.com

www.it145.com

cloud.tencent.com

www.secureworks.com

news.softpedia.com

gitee.com

www.mandiant.com

directive.page

git.oschina.net

youtube.com

response@securityjoes.com

2c9c048.php

1.py

pack.php

index.php

index_all.php

china-chopper-still-active-9-years-later.html

www.php

ssl.php

payload.php

payload.asp

koalabearguo

bclswl0827

beichendream

antswordproject

T1590.005

T1059.004

T1203

T1083

T1005

T1071.001

T1573.001

T1090

APT28

https://developer.mozilla.org/en-us/docs/web/http/headers/x-forwarded-for

https://www.cynet.com/attack-techniques-hands-on/china-chopper-observed-in-recent-ms-exchange-server-attacks

https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge

https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability

https://www.secureworks.com/research/samsam-ransomware-campaigns

https://github.com/koalabearguo/reverse-proxy-php

https://news.softpedia.com/news/new-made-in-china-web-shell-threatens-the-security-of-web-

https://gitee.com/atwal/php-simple-proxy/blob/master/simple_proxy.php

https://github.com/bclswl0827/goagent-php/blob/master/index.php

https://www.php.net/manual/en/function.file-get-contents.php

https://github.com/yitd/any-proxy

https://www.mandiant.com/resources/the-little-malware-that-could-detecting-and-defeating-the-

https://www.moregeek.xyz/i/502400954959

https://developer.mozilla.org/en-us/docs/web/http/headers/x-forwarded-

http://java.sun.com/jsp/page\"><jsp:directive.page

http://example.com

https://github.com/bclswl0827/goagent-php

rule neo_regeorg_proxy {
	meta:
		author = "Charles Lomboni - Security Joes"
		description = "Rules to detect neo-reGeorg proxy tool"
		date = "June, 2022"
		reference = "https://github.com/L-codes/Neo-reGeorg"
	strings:
		$neo_regeorg_en = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
		$neo_regeorg_de = "BASE64 CHARSLIST"
		$neo_regeorg_cmd = "X-CMD"
		$neo_regeorg_target = "X-TARGET"
		$neo_regeorg_error = "X-ERROR"
		$neo_regeorg_status = "X-STATUS"
		$neo_regeorg_phrase = "Georg says, 'All seems fine'"
		$neo_pass_php_1 = "if(version_compare(PHP_VERSION,'5.4.0','>='))@http_response_code(200);"
		$neo_pass_php_2 = "$mark = substr($cmd,0,22);"
		$neo_pass_php_3 = "$cmd = substr($cmd, 22);"
		$neo_pass_php_4 = "$writebuf = \"writebuf\".$mark;"
		$neo_pass_php_5 = "$readbuf = \"readbuf\".$mark;"
		$neo_pass_php_6 = "$target_ary = explode(\"|\", base64_decode(strtr($headers["
		$neo_pass_php_7 = "$_SESSION[$writebuf] .= base64_decode(strtr($rawPostData, $de, $en));"
		$neo_pass_jspx_1 = "<jsp:root version=\"2.0\"  
mlns:jsp=\"http://java.sun.com/JSP/Page\"><jsp:directive.page 
contentType=\"text/html\"/><jsp:directive.page pageEncoding=\"UTF-8\" 
trimDirectiveWhitespaces=\"true\"/>"
		$neo_pass_jspx_2 = "return super.defineClass(b, 0, b.length);"
		$neo_pass_jspx_3 = "Class clazz = new U(this.getClass().getClassLoader()).g(clazzBytes);"
		$neo_pass_jsp_1 = "<%@page pageEncoding=\"UTF-8\" trimDirectiveWhitespaces=\"true\"%>"
		$neo_pass_aspx_1 = "public String StrTr(string input, string frm, string to) {"
		$neo_pass_aspx_2 = "String en = 
\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";"
		$neo_pass_aspx_3 = "Uri u = new 
Uri(System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(StrTr(rUrl, de, en))));"
		$neo_pass_aspx_4 = "request.Headers.Add(key, Request.Headers.Get(key));"
		$neo_pass_aspx_5 = "if((c = Request.InputStream.Read(buff, 0, buff.Length)) > 0) {"
		$neo_pass_aspx_6 = "String mark = cmd.Substring(0,22);"
		$neo_pass_aspx_7 = "String target_str = 
System.Text.Encoding.Default.GetString(Convert.FromBase64String(StrTr(Request.Headers.Get("
	condition:
		($neo_regeorg_en and $neo_regeorg_de and $neo_regeorg_cmd and $neo_regeorg_target and $neo_regeorg_error and $neo_regeorg_status and $neo_regeorg_phrase) or ($neo_pass_php_1 and $neo_pass_php_2 and $neo_pass_php_3 and $neo_pass_php_4 and $neo_pass_php_5 and $neo_pass_php_6 and $neo_pass_php_7) or (($neo_pass_jspx_1 or $neo_pass_jsp_1) and $neo_pass_jspx_2 and $neo_pass_jspx_3) or ($neo_pass_aspx_1 and $neo_pass_aspx_2 and $neo_pass_aspx_3 and $neo_pass_aspx_4 and $neo_pass_aspx_5 and $neo_pass_aspx_6 and $neo_pass_aspx_7)
}

rule simple_php_proxy {
	meta:
		author = "Charles Lomboni - Security Joes"
		description = "Rules to detect Simple PHP Proxy tool"
		date = "June, 2022"
		reference = "https://github.com/cowboy/php-simple-proxy/"
	strings:
		$simple_php_proxy_git_osc = "git@osc"
		$simple_php_proxy_git_osc_url = "http://git.oschina.net/atwal/php-simple-proxy"
		$simple_php_proxy_comments = { E4 BC 98 E5 8C 96 E4 BF AE E6 94 B9 E7 82 B9 EF BC 9A E5 8A A0 E4 B8 8A E4 BA 86 E5 BC 82 E5 B8 B8 E5 A4 84 E7 90 86 EF BC 8C 62 61 73 65 75 72 6C E8 AE BE E7 BD AE EF BC 8C E4 BC 9A E6 9B B4 E5 AE 89 E5 85 A8 EF BC 8C E9 BB 98 E8 AE A4 E4 B8 BA 6A 73 6F 6E 70 E6 A0 BC E5 BC 8F }
		$simple_php_proxy_request_ex = "simple_proxy.php?url=http://example.com/"
		$simple_php_proxy_github = "http://github.com/cowboy/php-simple-proxy"
		$simple_php_proxy_config_comments = { E6 A0 B9 E6 8D AE E9 9C 80 E8 A6 81 E4 BF AE E6 94 B9 E4 B8 8B E9 9D A2 E7 9A 84 E9 85 8D E7 BD AE E9 A1 B9 EF BC 8C E9 85 8D E7 BD AE E9 A1 B9 E8 AF B4 E6 98 8E E8 A7 81 E4 B8 8A E9 9D A2 E7 9A 84 E8 AF B4 E6 98 8E E6 96 87 E5 AD 97 }
	condition:
		all of them
}