Added proxy scan
This commit is contained in:
36
Moonlight/App/MalwareScans/ProxyScan.cs
Normal file
36
Moonlight/App/MalwareScans/ProxyScan.cs
Normal file
@@ -0,0 +1,36 @@
|
|||||||
|
using Moonlight.App.Database.Entities;
|
||||||
|
using Moonlight.App.Models.Misc;
|
||||||
|
using Moonlight.App.Services;
|
||||||
|
|
||||||
|
namespace Moonlight.App.MalwareScans;
|
||||||
|
|
||||||
|
public class ProxyScan : MalwareScan
|
||||||
|
{
|
||||||
|
public override string Name => "Proxy software";
|
||||||
|
public override string Description => "Software to use nodes as a proxy";
|
||||||
|
public override async Task<MalwareScanResult?> Scan(Server server, IServiceProvider serviceProvider)
|
||||||
|
{
|
||||||
|
var serverService = serviceProvider.GetRequiredService<ServerService>();
|
||||||
|
var access = await serverService.CreateFileAccess(server, null!);
|
||||||
|
|
||||||
|
var files = await access.Ls();
|
||||||
|
|
||||||
|
foreach (var file in files.Where(x => x.Name.EndsWith(".sh")))
|
||||||
|
{
|
||||||
|
var fileContent = await access.Read(file);
|
||||||
|
var processableContent = fileContent.ToLower();
|
||||||
|
|
||||||
|
if (processableContent.Contains("t-e-s-tweb"))
|
||||||
|
{
|
||||||
|
return new MalwareScanResult()
|
||||||
|
{
|
||||||
|
Title = "Proxy software",
|
||||||
|
Description = "Software to use nodes as a proxy",
|
||||||
|
Author = "Marcel Baumgartner"
|
||||||
|
};
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -24,7 +24,8 @@ public class MalwareScanService
|
|||||||
new MinerJarScan(),
|
new MinerJarScan(),
|
||||||
new SelfBotCodeScan(),
|
new SelfBotCodeScan(),
|
||||||
new FakePlayerPluginScan(),
|
new FakePlayerPluginScan(),
|
||||||
new MinerScan()
|
new MinerScan(),
|
||||||
|
new ProxyScan()
|
||||||
};
|
};
|
||||||
|
|
||||||
var scans = await PluginService.BuildMalwareScans(defaultScans.ToArray());
|
var scans = await PluginService.BuildMalwareScans(defaultScans.ToArray());
|
||||||
|
|||||||
Reference in New Issue
Block a user