ULTRA [ dhmd.unla.ac.id ]

Linux unla-WEB 3.19.0-80-generic #88~14.04.1-Ubuntu SMP Fri Jan 13 14:54:07 UTC 2017 x86_64

Apache/2.4.7 (Ubuntu)

103.184.53.210 | Your IP: 192.168.112.121

Cant read [ /etc/named.conf ]

[ drwxr-xr-x ]

/ usr / share / modsecurity-crs / base_rules /

Home Upload Mass Deface Mass Delete Back Connect Notify

modsecurity_crs_45_trojans.conf

# ---------------------------------------------------------------
# Core ModSecurity Rule Set ver.2.2.8
# Copyright (C) 2006-2012 Trustwave All rights reserved.
#
# The OWASP ModSecurity Core Rule Set is distributed under 
# Apache Software License (ASL) version 2
# Please see the enclosed LICENCE file for full details.
# ---------------------------------------------------------------

# The trojan access detection rules detects access to known Trojans already 
# installed on a server. Uploading of Trojans is part of the Anti-Virus rules 
# and uses external Anti Virus program when uploading files.
#
# Detection of Trojans access is especially important in a hosting environment
# where the actual Trojan upload may be done through valid methods and not
# through hacking.
# --
# 
# NOTE Trojans detection is based on checking elements controlled by the client. 
#      A determined attacked can bypass those checks. We are working on 
#      enchaining the checks so it would require a major change in the Trojan
#      to overcome.
#      
# NOTE We found out that Trojan horses are not detected easily by Anti-Virus 
#      software when uploading as the signature set of AV software is not tuned
#      for this purpose. We are working on adding signature tuned to detect
#      Trojans upload to file uploading inspection. 
#

SecRule REQUEST_HEADERS_NAMES "x_(?:key|file)\b" "phase:2,rev:'2',ver:'OWASP_CRS/2.2.8',maturity:'9',accuracy:'9',t:none,t:lowercase,ctl:auditLogParts=+E,block,msg:'Backdoor access',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',capture,id:'950110',tag:'OWASP_CRS/MALICIOUS_SOFTWARE/TROJAN',tag:'WASCTC/WASC-01',tag:'OWASP_TOP_10/A7',tag:'PCI/5.1.1',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.trojan_score=+1,setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-OWASP_CRS/MALICIOUS_SOFTWARE/TROJAN-%{matched_var_name}=%{matched_var}"
SecRule REQUEST_FILENAME "root\.exe" \
        "phase:2,rev:'2',ver:'OWASP_CRS/2.2.8',maturity:'9',accuracy:'9',t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E,block,msg:'Backdoor access',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',capture,id:'950921',tag:'OWASP_CRS/MALICIOUS_SOFTWARE/TROJAN',tag:'WASCTC/WASC-01',tag:'OWASP_TOP_10/A7',tag:'PCI/5.1.1',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.trojan_score=+1,setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-OWASP_CRS/MALICIOUS_SOFTWARE/TROJAN-%{matched_var_name}=%{matched_var}"
SecRule RESPONSE_BODY "(?:<title>[^<]*?(?:\b(?:(?:c(?:ehennemden|gi-telnet)|gamma web shell)\b|imhabirligi phpftp)|(?:r(?:emote explorer|57shell)|aventis klasvayv|zehir)\b|\.::(?:news remote php shell injection::\.| rhtools\b)|ph(?:p(?:(?: commander|-terminal)\b|remoteview)|vayv)|myshell)|\b(?:(?:(?:microsoft windows\b.{0,10}?\bversion\b.{0,20}?\(c\) copyright 1985-.{0,10}?\bmicrosoft corp|ntdaddy v1\.9 - obzerve \| fux0r inc)\.|(?:www\.sanalteror\.org - indexer and read|haxplor)er|php(?:konsole| shell)|c99shell)\b|aventgrup\.<br>|drwxr))" \
        "phase:4,rev:'2',ver:'OWASP_CRS/2.2.8',maturity:'8',accuracy:'8',t:none,ctl:auditLogParts=+E,block,msg:'Backdoor access',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',capture,id:'950922',tag:'OWASP_CRS/MALICIOUS_SOFTWARE/TROJAN',tag:'WASCTC/WASC-01',tag:'OWASP_TOP_10/A7',tag:'PCI/5.1.1',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.trojan_score=+1,setvar:tx.anomaly_score=+%{tx.error_anomaly_score},setvar:tx.%{rule.id}-OWASP_CRS/MALICIOUS_SOFTWARE/TROJAN-%{matched_var_name}=%{matched_var}"

Name	Type	Size	Owner/Group	Permission	Last Modified	Actions
.	dir	-	root/root	drwxr-xr-x	2022-09-05 04:23:27
..	dir	-	root/root	drwxr-xr-x	2024-07-06 10:39:28
modsecurity_35_bad_robots.data	text/x-pascal	1.92 KB	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_35_scanners.data	text/plain	386 B	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_40_generic_attacks.data	text/x-c	3.84 KB	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_50_outbound.data	text/html	2.17 KB	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_50_outbound_malware.data	text/plain	55.38 KB	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_crs_20_protocol_violations.conf	text/plain	22.33 KB	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_crs_21_protocol_anomalies.conf	text/plain	6.75 KB	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_crs_23_request_limits.conf	text/plain	3.7 KB	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_crs_30_http_policy.conf	text/plain	6.77 KB	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_crs_35_bad_robots.conf	text/plain	5.28 KB	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_crs_40_generic_attacks.conf	text/plain	19.99 KB	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_crs_41_sql_injection_attacks.conf	text/plain	42.63 KB	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_crs_41_xss_attacks.conf	text/html	94.44 KB	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_crs_42_tight_security.conf	text/plain	1.75 KB	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_crs_45_trojans.conf	text/html	3.57 KB	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_crs_47_common_exceptions.conf	text/plain	2.19 KB	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_crs_48_local_exceptions.conf.example	text/plain	2.72 KB	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_crs_49_inbound_blocking.conf	text/plain	1.79 KB	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_crs_50_outbound.conf	text/plain	21.81 KB	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_crs_59_outbound_blocking.conf	text/plain	1.41 KB	root/root	-rw-r--r--	2013-07-13 12:23:15
modsecurity_crs_60_correlation.conf	text/plain	2.61 KB	root/root	-rw-r--r--	2013-07-13 12:23:15