sorry, couldn't edit and add these things I thought of right after I hit the submit
so here it is with some extra info
jfkafka, on 06 December 2010, 14:31, said:
Howbout this, check the date of the 'virus.def' file and if it is different then it has been altered?
jk
After following your suggestion to comment:
//if (!check_defs('virus.def'))
//trigger_error("Virus.def vulnerable to overwrite, please change permissions", E_USER_ERROR);
I googled around and came up with a Plan B way to check the virus.def file,
in case anyone might find it useful or have any input on improving it
This works on my localhost machine using xxamp, php5.3 and VTS1_0_8
I haven't tried it on the hosted site yet
oh yeah USE AT YOUR OWN RISK
in admin/AV/ocvts.php
FIRST - BACKUP ocvts.php - FIRST!
I just rename the file ocvts
12510.php (add the date so I know when it was changed)
and save it
FIND
if (!check_defs('virus.def'))
trigger_error("Virus.def vulnerable to overwrite, please change permissions", E_USER_ERROR);
REPLACE WITH
//if (!check_defs('virus.def'))
//trigger_error("Virus.def vulnerable to overwrite, please change permissions", E_USER_ERROR);
// added new function to check the 'virus.def' File's Date Last Modified
filemtime_r('virus.def');
then add the new 'filemtime_r' function
FIND
# Updated to v.1.0.2 by sijo 220310
# Updated to v.1.0.3 by sijo 310310
# Updated to v.1.0.4 by sijo 230410
# Updated to v.1.0.5 by sijo 040510
# Updated to v.1.0.6 by sijo 190510
# Updated to v.1.0.7 by sijo 140910
# Updated to v.1.0.8 by sijo 260910
*/
ADD BELOW THAT
// 12-5-10 modified combination of code courtesy of:
// 1. avi at live dot com 02-Feb-2009 11:22 (
http://php.net/manual/en/function.filemtime.php)
// 2.
http://www.w3schools.com/PHP/func_filesystem_filemtime.asp
// 3.
http://w3schools.com/PHP/func_filesystem_clearstatcache.asp
// Only take into account those files whose extensions you want to show.
// (In this case the only allowed extension is def)
$allowedExtensions = array(
// 'zip',
// 'rar',
// 'pdf',
// 'txt',
'def'
);
function filemtime_r($path) {
global $allowedExtensions;
// testing echo ' in av/ocvts.php function filemtime_r and path = ' . $path;
if (!file_exists($path)) {
// testing echo ' in av/ocvts.php function filemtime_r and file doesn"t exist = ' . $path . '<br />';
exit('File: - ' . $path . ' - NOT FOUND in admin/AV Folder (need to add it)');
return 0;
}
$extension = end(explode(".", $path));
// testing echo ' in av/ocvts.php function filemtime_r and extension = ' . $extension . '<br />';
if (is_file($path) && in_array($extension, $allowedExtensions)) {
// testing echo ' in av/ocvts.php function filemtime_r and is file(path) and in array(extension, allowedExtensions) ' . $extension . '<br />';
$last_authorized_modified = 1291651410;
$last_file_modified = filemtime($path);
if ($last_file_modified != $last_authorized_modified) {
echo '<h1> File Authenticity Error! </h1>';
echo '<br />';
// testing echo "Last Authorized modified: ". date("F d Y H:i:s.",filemtime($last_authorized_modified));
// testing echo '<br />';
// testing echo "Last modified: ". date("F d Y H:i:s.",filemtime($path));
// testing echo '<br />';
echo 'Exiting until File - virus.def - Authenticity has been Verified (' . $last_file_modified . ')<br />'
. 'If this IS an Authorized new file,' . '<br />'
. ' (in admin/AV/ocVTS.php)'. '<br />'
. 'change this line TO - $last_authorized_modified = ' . $last_file_modified
. '<br />' . 'Otherwise REPLACE current - virus.def - with the <b>LAST Authorized</b> - virus.def - File.' .
'<br />' . 'This error indicates possible Site Security breach.';
exit();
} else { // AUTHENTICITY VERIFIED - ($last_file_modified = $last_authorized_modified)
// OK TO CONTINUE WITH SCAN
// testing echo filemtime($path);
// testing echo '<br />';
// testing echo 'File Authenticity Verified:';
// testing echo '<br />';
// testing echo 'Last modified: ' . date('F d Y H:i:s.',filemtime($path));
} // X if ($last_file_modified != $last_authorized_modified) {
// Note (from w3schools.com): The result of this function are cached. Use clearstatcache() to clear the cache.
clearstatcache();
} // X if (is_file($path) && in_array($extension, $allowedExtensions)) {
} // X function filemtime_r($path) {
// X 12-5-10 modified combination of code courtesy of: ...
---------- end of code -----------
NOW TO TEST IT:
1. go to admin/tools and click VTS Virus & Threat Scanner
2. Click ocVTS Scan your site using 'virus.def' and 'files.def' files
3. You should get an error Page with the message:
File Authenticity Error!
Exiting until File - virus.def - Authenticity has been Verified (1291651410)
If this IS an Authorized new file,
(in admin/AV/ocVTS.php)
change this line TO - $last_authorized_modified = 1291651410
Otherwise REPLACE current - virus.def - with the LAST Authorized - virus.def - File.
This error indicates possible Site Security breach.
4. Don't Panic- this is to show it's working
5. The message tells you what to do
6. for instance
If this IS an Authorized new file,
(in admin/AV/ocVTS.php)
change this line TO - $last_authorized_modified =
1291651410
NOTE: this number may be different for your version of virus.def,
I'm using the virus.def from VTS 1_0_8
Whatever that number is
change the line
in admin/AV/ocVTS.php to match it
just copy and paste that number from
$last_authorized_modified = WHATEVER NUMBER
over the existing number in the line
$last_authorized_modified = 1291651410
now run the scan again and it should pass the test
(now it matches the result of the filemtime($path) php function for the virus.def File
hope this all makes sense and doesn't cause drowsiness
and whenever this virus.def File is updated/replaced
go thru these steps again
I left the name of the function - filemtime_r($path), so anyone can check it from the first reference
1. avi at live dot com 02-Feb-2009 11:22 (
http://php.net/manual/en/function.filemtime.php)
(of course I modified it for this purpose)
Sijo, hope you don't mind my posting this - just wanted to share (as per your inspiring example!)
jk
0
