/**
* @param wfScanEngine $forkObj
* @return array
*/
public function scan($forkObj)
{
$this->scanEngine = $forkObj;
$loader = $this->scanEngine->getKnownFilesLoader();
if (!$this->startTime) {
$this->startTime = microtime(true);
}
if (!$this->lastStatusTime) {
$this->lastStatusTime = microtime(true);
}
$db = new wfDB();
$lastCount = 'whatever';
$excludePattern = self::getExcludeFilePattern(self::EXCLUSION_PATTERNS_USER & self::EXCLUSION_PATTERNS_MALWARE);
while (true) {
$thisCount = $db->querySingle("select count(*) from " . $db->prefix() . "wfFileMods where oldMD5 != newMD5 and knownFile=0");
if ($thisCount == $lastCount) {
//count should always be decreasing. If not, we're in an infinite loop so lets catch it early
break;
}
$lastCount = $thisCount;
$res1 = $db->querySelect("select filename, filenameMD5, hex(newMD5) as newMD5 from " . $db->prefix() . "wfFileMods where oldMD5 != newMD5 and knownFile=0 limit 500");
if (sizeof($res1) < 1) {
break;
}
foreach ($res1 as $rec1) {
$db->queryWrite("update " . $db->prefix() . "wfFileMods set oldMD5 = newMD5 where filenameMD5='%s'", $rec1['filenameMD5']);
//A way to mark as scanned so that if we come back from a sleep we don't rescan this one.
$file = $rec1['filename'];
if ($excludePattern && preg_match($excludePattern, $file)) {
continue;
}
$fileSum = $rec1['newMD5'];
if (!file_exists($this->path . $file)) {
continue;
}
$fileExt = '';
if (preg_match('/\\.([a-zA-Z\\d\\-]{1,7})$/', $file, $matches)) {
$fileExt = strtolower($matches[1]);
}
$isPHP = false;
if (preg_match('/\\.(?:php(?:\\d+)?|phtml)(\\.|$)/i', $file)) {
$isPHP = true;
}
$dontScanForURLs = false;
if (!wfConfig::get('scansEnabled_highSense') && (preg_match('/^(?:\\.htaccess|wp\\-config\\.php)$/', $file) || $file === ini_get('user_ini.filename'))) {
$dontScanForURLs = true;
}
$isScanImagesFile = false;
if (!$isPHP && preg_match('/^(?:jpg|jpeg|mp3|avi|m4v|gif|png|sql|js|tbz2?|bz2?|xz|zip|tgz|gz|tar|log|err\\d+)$/', $fileExt)) {
if (wfConfig::get('scansEnabled_scanImages')) {
$isScanImagesFile = true;
} else {
continue;
}
}
$isHighSensitivityFile = false;
if (strtolower($fileExt) == 'sql') {
if (wfConfig::get('scansEnabled_highSense')) {
$isHighSensitivityFile = true;
} else {
continue;
}
}
if (wfUtils::fileTooBig($this->path . $file)) {
//We can't use filesize on 32 bit systems for files > 2 gigs
//We should not need this check because files > 2 gigs are not hashed and therefore won't be received back as unknowns from the API server
//But we do it anyway to be safe.
wordfence::status(2, 'error', "Encountered file that is too large: {$file} - Skipping.");
continue;
}
wfUtils::beginProcessingFile($file);
$fsize = filesize($this->path . $file);
//Checked if too big above
if ($fsize > 1000000) {
$fsize = sprintf('%.2f', $fsize / 1000000) . "M";
} else {
$fsize = $fsize . "B";
}
if (function_exists('memory_get_usage')) {
wordfence::status(4, 'info', "Scanning contents: {$file} (Size:{$fsize} Mem:" . sprintf('%.1f', memory_get_usage(true) / (1024 * 1024)) . "M)");
} else {
wordfence::status(4, 'info', "Scanning contents: {$file} (Size: {$fsize})");
}
$stime = microtime(true);
$fh = @fopen($this->path . $file, 'r');
if (!$fh) {
continue;
}
$totalRead = 0;
$dataForFile = $this->dataForFile($file);
while (!feof($fh)) {
$data = fread($fh, 1 * 1024 * 1024);
//read 1 megs max per chunk
$totalRead += strlen($data);
if ($totalRead < 1) {
break;
}
$extraMsg = '';
if ($isScanImagesFile) {
$extraMsg = ' This file was detected because you have enabled "Scan images, binary, and other files as if they were executable", which treats non-PHP files as if they were PHP code. This option is more aggressive than the usual scans, and may cause false positives.';
} else {
if ($isHighSensitivityFile) {
$extraMsg = ' This file was detected because you have enabled HIGH SENSITIVITY scanning. This option is more aggressive than the usual scans, and may cause false positives.';
}
}
if ($isPHP || wfConfig::get('scansEnabled_scanImages')) {
if (strpos($data, '$allowed' . 'Sites') !== false && strpos($data, "define ('VER" . "SION', '1.") !== false && strpos($data, "TimThum" . "b script created by") !== false) {
if (!$this->isSafeFile($this->path . $file)) {
$this->addResult(array('type' => 'file', 'severity' => 1, 'ignoreP' => $this->path . $file, 'ignoreC' => $fileSum, 'shortMsg' => "File is an old version of TimThumb which is vulnerable.", 'longMsg' => "This file appears to be an old version of the TimThumb script which makes your system vulnerable to attackers. Please upgrade the theme or plugin that uses this or remove it." . $extraMsg, 'data' => array_merge(array('file' => $file), $dataForFile)));
break;
}
} else {
if (strpos($file, 'lib/wordfenceScanner.php') === false) {
// && preg_match($this->patterns['sigPattern'], $data, $matches)){
$regexMatched = false;
foreach ($this->patterns['rules'] as $rule) {
if (preg_match('/(' . $rule[2] . ')/i', $data, $matches)) {
if (!$this->isSafeFile($this->path . $file)) {
$this->addResult(array('type' => 'file', 'severity' => 1, 'ignoreP' => $this->path . $file, 'ignoreC' => $fileSum, 'shortMsg' => "File appears to be malicious: " . esc_html($file), 'longMsg' => "This file appears to be installed by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The text we found in this file that matches a known malicious file is: <strong style=\"color: #F00;\">\"" . esc_html(strlen($matches[1]) > 200 ? substr($matches[1], 0, 200) . '...' : $matches[1]) . "\"</strong>. The infection type is: <strong>" . esc_html($rule[3]) . '</strong>' . $extraMsg, 'data' => array_merge(array('file' => $file), $dataForFile)));
$regexMatched = true;
break;
}
}
}
if ($regexMatched) {
break;
}
}
}
if (wfConfig::get('scansEnabled_highSense')) {
$badStringFound = false;
if (strpos($data, $this->patterns['badstrings'][0]) !== false) {
for ($i = 1; $i < sizeof($this->patterns['badstrings']); $i++) {
if (strpos($data, $this->patterns['badstrings'][$i]) !== false) {
$badStringFound = $this->patterns['badstrings'][$i];
break;
}
}
}
if ($badStringFound) {
if (!$this->isSafeFile($this->path . $file)) {
$this->addResult(array('type' => 'file', 'severity' => 1, 'ignoreP' => $this->path . $file, 'ignoreC' => $fileSum, 'shortMsg' => "This file may contain malicious executable code: " . esc_html($this->path . $file), 'longMsg' => "This file is a PHP executable file and contains the word 'eval' (without quotes) and the word '" . esc_html($badStringFound) . "' (without quotes). The eval() function along with an encoding function like the one mentioned are commonly used by hackers to hide their code. If you know about this file you can choose to ignore it to exclude it from future scans. This file was detected because you have enabled HIGH SENSITIVITY scanning. This option is more aggressive than the usual scans, and may cause false positives.", 'data' => array_merge(array('file' => $file), $dataForFile)));
break;
}
}
}
if (!$dontScanForURLs) {
$this->urlHoover->hoover($file, $data);
}
} else {
if (!$dontScanForURLs) {
$this->urlHoover->hoover($file, $data);
}
}
if ($totalRead > 2 * 1024 * 1024) {
break;
}
}
fclose($fh);
$this->totalFilesScanned++;
if (microtime(true) - $this->lastStatusTime > 1) {
$this->lastStatusTime = microtime(true);
$this->writeScanningStatus();
}
$forkObj->forkIfNeeded();
}
}
$this->writeScanningStatus();
wordfence::status(2, 'info', "Asking Wordfence to check URL's against malware list.");
$hooverResults = $this->urlHoover->getBaddies();
if ($this->urlHoover->errorMsg) {
$this->errorMsg = $this->urlHoover->errorMsg;
return false;
}
$this->urlHoover->cleanup();
$siteURL = get_site_url();
$siteHost = parse_url($siteURL, PHP_URL_HOST);
foreach ($hooverResults as $file => $hresults) {
$dataForFile = $this->dataForFile($file, $this->path . $file);
foreach ($hresults as $result) {
if (preg_match('/wfBrowscapCache\\.php$/', $file)) {
continue;
}
if (empty($result['URL'])) {
continue;
}
$url = $result['URL'];
$urlHost = parse_url($url, PHP_URL_HOST);
if (strcasecmp($siteHost, $urlHost) === 0) {
continue;
}
if ($result['badList'] == 'goog-malware-shavar') {
if (!$this->isSafeFile($this->path . $file)) {
$this->addResult(array('type' => 'file', 'severity' => 1, 'ignoreP' => $this->path . $file, 'ignoreC' => md5_file($this->path . $file), 'shortMsg' => "File contains suspected malware URL: " . esc_html($this->path . $file), 'longMsg' => "This file contains a suspected malware URL listed on Google's list of malware sites. Wordfence decodes " . esc_html($this->patterns['word3']) . " when scanning files so the URL may not be visible if you view this file. The URL is: " . esc_html($result['URL']) . " - More info available at <a href=\"http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=" . urlencode($result['URL']) . "&client=googlechrome&hl=en-US\" target=\"_blank\">Google Safe Browsing diagnostic page</a>.", 'data' => array_merge(array('file' => $file, 'badURL' => $result['URL'], 'gsb' => 'goog-malware-shavar'), $dataForFile)));
}
} else {
if ($result['badList'] == 'googpub-phish-shavar') {
if (!$this->isSafeFile($this->path . $file)) {
$this->addResult(array('type' => 'file', 'severity' => 1, 'ignoreP' => $this->path . $file, 'ignoreC' => md5_file($this->path . $file), 'shortMsg' => "File contains suspected phishing URL: " . esc_html($this->path . $file), 'longMsg' => "This file contains a URL that is a suspected phishing site that is currently listed on Google's list of known phishing sites. The URL is: " . esc_html($result['URL']), 'data' => array_merge(array('file' => $file, 'badURL' => $result['URL'], 'gsb' => 'googpub-phish-shavar'), $dataForFile)));
}
}
}
}
}
wfUtils::endProcessingFile();
return $this->results;
}
private function processFile($realFile)
{
$file = substr($realFile, $this->striplen);
if (!$this->stoppedOnFile && microtime(true) - $this->startTime > $this->engine->maxExecTime) {
//max X seconds but don't allow fork if we're looking for the file we stopped on. Search mode is VERY fast.
$this->stoppedOnFile = $file;
wordfence::status(4, 'info', "Calling fork() from wordfenceHash::processFile with maxExecTime: " . $this->engine->maxExecTime);
$this->engine->fork();
//exits
}
$exclude = wordfenceScanner::getExcludeFilePattern(wordfenceScanner::EXCLUSION_PATTERNS_USER);
if ($exclude && preg_match($exclude, $realFile)) {
return;
}
//Put this after the fork, that way we will at least scan one more file after we fork if it takes us more than 10 seconds to search for the stoppedOnFile
if ($this->stoppedOnFile && $file != $this->stoppedOnFile) {
return;
} else {
if ($this->stoppedOnFile && $file == $this->stoppedOnFile) {
$this->stoppedOnFile = false;
//Continue scanning
}
}
if (wfUtils::fileTooBig($realFile)) {
wordfence::status(4, 'info', "Skipping file larger than max size: {$realFile}");
return;
}
if (function_exists('memory_get_usage')) {
wordfence::status(4, 'info', "Scanning: {$realFile} (Mem:" . sprintf('%.1f', memory_get_usage(true) / (1024 * 1024)) . "M)");
} else {
wordfence::status(4, 'info', "Scanning: {$realFile}");
}
wfUtils::beginProcessingFile($file);
$wfHash = self::wfHash($realFile);
if ($wfHash) {
$md5 = strtoupper($wfHash[0]);
$shac = strtoupper($wfHash[1]);
$knownFile = 0;
if ($this->malwareEnabled && $this->isMalwarePrefix($md5)) {
$this->possibleMalware[] = array($file, $md5);
}
$knownFileExclude = wordfenceScanner::getExcludeFilePattern(wordfenceScanner::EXCLUSION_PATTERNS_KNOWN_FILES);
$allowKnownFileScan = true;
if ($knownFileExclude) {
$allowKnownFileScan = !preg_match($knownFileExclude, $realFile);
}
if ($allowKnownFileScan) {
if ($this->coreUnknownEnabled && !$this->alertedOnUnknownWordPressVersion && empty($this->knownFiles['core'])) {
require ABSPATH . 'wp-includes/version.php';
//defines $wp_version
$this->alertedOnUnknownWordPressVersion = true;
$this->haveIssues['coreUnknown'] = true;
$this->engine->addIssue('coreUnknown', 2, 'coreUnknown' . $wp_version, 'coreUnknown' . $wp_version, 'Unknown WordPress core version: ' . $wp_version, "The core files scan will not be run because this version of WordPress is not currently indexed by Wordfence. This may be due to using a prerelease version or because the servers are still indexing a new release. If you are using an official WordPress release, this issue will automatically dismiss once the version is indexed and another scan is run.", array());
}
if (isset($this->knownFiles['core'][$file])) {
if (strtoupper($this->knownFiles['core'][$file]) == $shac) {
$knownFile = 1;
} else {
if ($this->coreEnabled) {
$localFile = ABSPATH . '/' . preg_replace('/^[\\.\\/]+/', '', $file);
$fileContents = @file_get_contents($localFile);
if ($fileContents && !preg_match('/<\\?' . 'php[\\r\\n\\s\\t]*\\/\\/[\\r\\n\\s\\t]*Silence is golden\\.[\\r\\n\\s\\t]*(?:\\?>)?[\\r\\n\\s\\t]*$/s', $fileContents)) {
//<?php
if (!$this->isSafeFile($shac)) {
$this->haveIssues['core'] = true;
$this->engine->addIssue('file', 1, 'coreModified' . $file . $md5, 'coreModified' . $file, 'WordPress core file modified: ' . $file, "This WordPress core file has been modified and differs from the original file distributed with this version of WordPress.", array('file' => $file, 'cType' => 'core', 'canDiff' => true, 'canFix' => true, 'canDelete' => false));
}
}
}
}
} else {
if (isset($this->knownFiles['plugins'][$file])) {
if (in_array($shac, $this->knownFiles['plugins'][$file])) {
$knownFile = 1;
} else {
if ($this->pluginsEnabled) {
if (!$this->isSafeFile($shac)) {
$itemName = $this->knownFiles['plugins'][$file][0];
$itemVersion = $this->knownFiles['plugins'][$file][1];
$cKey = $this->knownFiles['plugins'][$file][2];
$this->haveIssues['plugins'] = true;
$this->engine->addIssue('file', 2, 'modifiedplugin' . $file . $md5, 'modifiedplugin' . $file, 'Modified plugin file: ' . $file, "This file belongs to plugin \"{$itemName}\" version \"{$itemVersion}\" and has been modified from the file that is distributed by WordPress.org for this version. Please use the link to see how the file has changed. If you have modified this file yourself, you can safely ignore this warning. If you see a lot of changed files in a plugin that have been made by the author, then try uninstalling and reinstalling the plugin to force an upgrade. Doing this is a workaround for plugin authors who don't manage their code correctly. [See our FAQ on www.wordfence.com for more info]", array('file' => $file, 'cType' => 'plugin', 'canDiff' => true, 'canFix' => true, 'canDelete' => false, 'cName' => $itemName, 'cVersion' => $itemVersion, 'cKey' => $cKey));
}
}
}
} else {
if (isset($this->knownFiles['themes'][$file])) {
if (in_array($shac, $this->knownFiles['themes'][$file])) {
$knownFile = 1;
} else {
if ($this->themesEnabled) {
if (!$this->isSafeFile($shac)) {
$itemName = $this->knownFiles['themes'][$file][0];
$itemVersion = $this->knownFiles['themes'][$file][1];
$cKey = $this->knownFiles['themes'][$file][2];
$this->haveIssues['themes'] = true;
$this->engine->addIssue('file', 2, 'modifiedtheme' . $file . $md5, 'modifiedtheme' . $file, 'Modified theme file: ' . $file, "This file belongs to theme \"{$itemName}\" version \"{$itemVersion}\" and has been modified from the original distribution. It is common for site owners to modify their theme files, so if you have modified this file yourself you can safely ignore this warning.", array('file' => $file, 'cType' => 'theme', 'canDiff' => true, 'canFix' => true, 'canDelete' => false, 'cName' => $itemName, 'cVersion' => $itemVersion, 'cKey' => $cKey));
}
}
}
} else {
if ($this->coreUnknownEnabled && !$this->alertedOnUnknownWordPressVersion) {
//Check for unknown files in system directories
$restrictedWordPressFolders = array(ABSPATH . 'wp-admin/', ABSPATH . WPINC . '/');
foreach ($restrictedWordPressFolders as $path) {
if (strpos($realFile, $path) === 0) {
$this->haveIssues['coreUnknown'] = true;
$this->engine->addIssue('file', 2, 'coreUnknown' . $file . $md5, 'coreUnknown' . $file, 'Unknown file in WordPress core: ' . $file, "This file is in a WordPress core location but is not distributed with this version of WordPress. This is usually due to it being left over from a previous WordPress update, but it may also have been added by another plugin or a malicious file added by an attacker.", array('file' => $file, 'cType' => 'core', 'canDiff' => false, 'canFix' => false, 'canDelete' => true));
}
}
}
}
}
}
}
// knownFile means that the file is both part of core or a known plugin or theme AND that we recognize the file's hash.
// we could split this into files who's path we recognize and file's who's path we recognize AND who have a valid sig.
// But because we want to scan files who's sig we don't recognize, regardless of known path or not, we only need one "knownFile" field.
$this->db->queryWrite("insert into " . $this->db->prefix() . "wfFileMods (filename, filenameMD5, knownFile, oldMD5, newMD5) values ('%s', unhex(md5('%s')), %d, '', unhex('%s')) ON DUPLICATE KEY UPDATE newMD5=unhex('%s'), knownFile=%d", $file, $file, $knownFile, $md5, $md5, $knownFile);
//Now that we know we can open the file, lets update stats
if (preg_match('/\\.(?:js|html|htm|css)$/i', $realFile)) {
$this->linesOfJCH += sizeof(file($realFile));
} else {
if (preg_match('/\\.php$/i', $realFile)) {
$this->linesOfPHP += sizeof(file($realFile));
}
}
$this->totalFiles++;
$this->totalData += filesize($realFile);
//We already checked if file overflows int in the fileTooBig routine above
if ($this->totalFiles % 100 === 0) {
wordfence::status(2, 'info', "Analyzed " . $this->totalFiles . " files containing " . wfUtils::formatBytes($this->totalData) . " of data so far");
}
} else {
//wordfence::status(2, 'error', "Could not gen hash for file (probably because we don't have permission to access the file): $realFile");
}
wfUtils::endProcessingFile();
}
