From 14ae253b7a3ca969cae773e6204b31cf9f8f2097 Mon Sep 17 00:00:00 2001
From: Caleb Mazalevskis <maikuolan@gmail.com>
Date: Tue, 21 May 2024 17:04:55 +0800
Subject: [PATCH] Modules update.

---
 modules/module_botua.php  |  7 ++++---
 modules/module_extras.php | 27 ++++++++++++---------------
 modules/modules.dat       |  8 ++++----
 3 files changed, 20 insertions(+), 22 deletions(-)

diff --git a/modules/module_botua.php b/modules/module_botua.php
index b3f5659..7119352 100644
--- a/modules/module_botua.php
+++ b/modules/module_botua.php
@@ -8,7 +8,7 @@
  * License: GNU/GPLv2
  * @see LICENSE.txt
  *
- * This file: Bot user agents module (last modified: 2024.05.12).
+ * This file: Bot user agents module (last modified: 2024.05.21).
  *
  * False positive risk (an approximate, rough estimate only): « [ ]Low [x]Medium [ ]High »
  */
@@ -236,7 +236,8 @@
     ), 'Malware UA'); // 2017.04.23
 
     $Trigger(preg_match(
-        '~\.buzz|(?<!amazona)dbot/|^m$|(?:\W|^)(?:cu|pe)rl(?:\W|$)|^(?!linkedinbot).*http-?(?:agent|client)|#boss#|' .
+        '~\.buzz|(?<!amazona)dbot/|(?:\W|^)(?:cu|pe)rl(?:\W|$)|#boss#|' .
+        '^(?:[aim]$|(?!linkedinbot).*http-?(?:agent|client))|' .
         'a(?:bonti|ccserver|cme.spider|dreview/\d|jbaxy|nthill$|nyevent-http|ppengine)|' .
         'b(?:abbar\.tech|igbozz|lackbird|logsearch|logbot|salsa)|' .
         'c(?:astlebot|atexplorador|lickagy|liqzbot|ontextad|orporama|ortex/\d|rowsnest|yberpatrol)|' .
@@ -262,7 +263,7 @@
     ) || preg_match(
         '~^Mozilla/5\.0( [A-Za-z]{2,5}/0\..)?$~',
         $CIDRAM['BlockInfo']['UA']
-    ), 'Unauthorised'); // 2023.09.15 mod 2024.05.12
+    ), 'Unauthorised'); // 2023.09.15 mod 2024.05.21
 
     $Trigger(preg_match(
         '~^(?:bot|java|msie|windows-live-social-object-extractor)|\\((?:java|\w:\d{2,})~',
diff --git a/modules/module_extras.php b/modules/module_extras.php
index 3a6b653..67b0a5b 100644
--- a/modules/module_extras.php
+++ b/modules/module_extras.php
@@ -8,7 +8,7 @@
  * License: GNU/GPLv2
  * @see LICENSE.txt
  *
- * This file: Optional security extras module (last modified: 2024.05.19).
+ * This file: Optional security extras module (last modified: 2024.05.21).
  *
  * False positive risk (an approximate, rough estimate only): « [ ]Low [x]Medium [ ]High »
  */
@@ -101,32 +101,29 @@
 
         /** Probing for webshells/backdoors. */
         if ($Trigger(preg_match(
-            '~^/{3,}wp-|(?:^|[/?])(?:' .
-            'old/wp-admin/install\.php|shell\?cd|' .
-            'test/wp-includes/wlwmanifest\.xml|' .
-            '(?:' .
+            '~^/{3,}wp-|(?:^|[/?])(?:shell\?cd|test/wp-includes/wlwmanifest\.xml|(?:' .
             '\+theme\+/(?:error|index)|' .
             '\.w(?:ell-known|p-cli)/.*(?:a(?:bout|dmin)[\da-z]*|fierza[\da-z]*|install[\da-z]*|moon[\da-z]*|shell[\da-z]*|wp-login[\da-z]*|x)|\.?rxr(?:_[\da-z]+)?|' .
             '\d{3,5}[a-z]{3,5}|\d+-?backdoor|0byte|0x|10+|991176|' .
-            'admin-heade\d*|adminfuns|ahhygskn|alfa(?:-rex|_data|a?cgiapi|ioxi|new)?\d*|anjas|apismtp|axx|' .
+            'a(?:dmin-heade\d*|dminfuns|hhygskn|lfa(?:-rex|_data|a?cgiapi|ioxi|new)?\d*|njas|pismtp|xx)|' .
             'b0|b3d2acc621a0|bak|bala|' .
-            'c(?:9|10)\d+|casper[\da-z]+|cd(?:.*tmp.*rm-rf|chmod.*\d{3,})|cfom[-_]files|(?:cgi-bin|css)/(?:luci/;|moon|newgolden|radio|stok=/|uploader|well-known|wp-login)|cjfuns|classsmtps|colors/blue/uploader|' .
+            'c(?:(?:9|10)\d+|asper[\da-z]+|d(?:.*tmp.*rm-rf|chmod.*\d{3,})|fom[-_]files|(?:gi-bin|ss)/(?:luci/;|moon|newgolden|radio|sgd|stok=/|uploader|well-known|wp-login)|jfuns|lasssmtps|olors/blue/uploader|ong)|' .
             'd7|deadcode\d*|dkiz|' .
             'ee|' .
             'fddqradz|' .
-            'gh[0o]st|glab-rare|gzismexv|' .
+            'gel4y|gh[0o]st|glab-rare|gzismexv|' .
             'h[4a]x+[0o]r|h6ss|hanna1337|hehehe|htmlawedtest|' .
-            'i\d{3,}[a-z]{2,}|icesword|indoxploit|ioptimize|ir7szrsouep|itsec|' .
+            'i(?:\d{3,}[a-z]{2,}|cesword|ndoxploit|optimize|r7szrsouep|itsec)|' .
             'lock0?360|lufix(?:-shell)?|' .
             'miin|my1|' .
-            'orvx(?:-shell)?|' .
+            'old/wp-admin/install|orvx(?:-shell)?|' .
             'perl\.alfa|php(?:1|_niu_\d+)|(?:plugins|themes)/(?:ccx|ioptimization|yyobang)|poison|priv8|pzaiihfi|' .
-            'session91|sh[3e]llx?\d*|shrift|sidwso|silic|skipper(?:shell)?|sonarxleetxd|spammervip|src/util/php/(?:eval(?:-stdin)?|kill)|' .
+            's(?:ession91|h[3e]llx?\d*|hrift|idwso|ilic|kipper(?:shell)?|onarxleetxd|pammervip|rc/util/php/(?:eval(?:-stdin)?|kill))|' .
             't62|tenda\.sh.*tenda\.sh|themes/(?:finley/min|pridmag/db|universal-news/www)|tinymce/(?:langs/about|plugins/compat3x/css/index)|tk(?:_dencode_\d+)?|(?:tmp|wp-content)/vuln|topxoh/(?:drsx|wdr)|' .
-            'unisibfu|upfile(?:_\\(\d\\))?|uploader_by_cloud7_agath|utchiha(?:_uploader)?|' .
+            'u(?:nisibfu|pfile(?:_\\(\d\\))?|ploader_by_cloud7_agath|tchiha(?:_uploader)?)|' .
             'vzlateam|' .
-            'w0rdpr3ssnew|walker-nva|webshell-[a-z\d]+|widgets-nva|widwsisw|wloymzuk|' .
-            'wp[-_](?:2019|22|(?:admin(?:/images)?|content|css(?:/colors)?|includes(?:/ixr|/customize|/pomo)?|js(?:/widgets)?|network)/(?:cong|dropdown|install|r(?:andom_compat/class_api|equests/class_api|epeater)|simple|text/about|themes/hello-element/footer)|conflg|content/plugins/(?:backup-backup/includes/hro|cache/dropdown|contact-form-7/.+styles-rtl|contus-hd-flv-player/uploadvideo|dzs-zoomsounds/savepng|fix/up|wordpresscore/include|wp-file-manager/lib/php/connector\.minimal)|filemanager|setups|sigunq|p)|' .
+            'w(?:0rdpr3ssnew|alker-nva|ebshell-[a-z\d]+|idgets-nva|idwsisw|loymzuk)|' .
+            'wp[-_](?:2019|22|(?:admin(?:/images)?|content|css(?:/colors)?|includes(?:/ixr|/customize|/pomo)?|js(?:/widgets)?|network)/(?:dropdown|fgertreyersd|install|js/privacy-tools\.min|r(?:andom_compat/class_api|equests/class_api|epeater)|simple|text/about|themes/hello-element/footer|wp-login)|conflg|content/plugins/(?:backup-backup/includes/hro|cache/dropdown|contact-form-7/.+styles-rtl|contus-hd-flv-player/uploadvideo|dzs-zoomsounds/savepng|fix/up|wordpresscore/include|wp-file-manager/lib/php/connector\.minimal)|filemanager|setups|sigunq|sts|p)|' .
             'ws[ou](?:yanz)?(?:[\d.]*|[\da-z]{4,})|wwdv|' .
             'x{3,}|xiaom|xichang/x|x+l(?:\d+|eet(?:mailer|-shell)?x?)|xm(?:lrpcs|lrpz|rlpc)|xw|' .
             'yanz|yyobang/mar|' .
@@ -136,7 +133,7 @@
             $LCNrURI
         ), 'Probing for webshells/backdoors')) {
             $CIDRAM['Reporter']->report([15, 20, 21], ['Caught probing for webshells/backdoors. Host might be compromised.'], $CIDRAM['BlockInfo']['IPAddr']);
-        } // 2023.08.18 mod 2024.05.19
+        } // 2023.08.18 mod 2024.05.21
 
         /** Probing for webshells/backdoors. */
         if ($Trigger(preg_match(
diff --git a/modules/modules.dat b/modules/modules.dat
index 6b6d4b3..3cc762b 100644
--- a/modules/modules.dat
+++ b/modules/modules.dat
@@ -197,7 +197,7 @@ module_bgpview.php:
 module_botua.php:
  Name: "Bot user agents module"
  False Positive Risk: "Medium"
- Version: "2024.132.0"
+ Version: "2024.141.0"
  Dependencies:
   PHP: "^5.4|^7|^8"
   CIDRAM Core: "^1.13.1|^2.0.1"
@@ -209,7 +209,7 @@ module_botua.php:
   To:
    - "module_botua.php"
   Checksum:
-   - "edcf9ac9fbc57e6b456b050b93f2e81e361831a495e6900b72babebd828f0ba0:26196"
+   - "04a7bbd0dcd2d683cb76aeaacbb301c662fb38ab1c7dc34a7503908b8104d79d:26216"
  Used with: "modules"
  Reannotate: "modules.dat"
 module_cookies.php:
@@ -233,7 +233,7 @@ module_cookies.php:
 module_extras.php:
  Name: "Optional security extras module"
  False Positive Risk: "Medium"
- Version: "2024.139.0"
+ Version: "2024.141.0"
  Dependencies:
   PHP: "^5.4|^7|^8"
   CIDRAM Core: "^1.13.1|^2.0.1"
@@ -248,7 +248,7 @@ module_extras.php:
    - "module_extras.php"
    - "module_extras.yaml"
   Checksum:
-   - "8e72d1b643c30a9f884b0a03406e975ba32d0351b5b7a72a3f86a33e4bbb017d:27746"
+   - "cfab24db4ad605e22be30f1437d993808eb580e221f986422586c94bbe1632b5:27737"
    - "7b891d1fa4b1c52c410220bc758e8cb7064bd6040430fb149a5b60e9ae2e0838:890"
  Used with: "modules"
  Reannotate: "modules.dat"