CVE-2015-8562 and Emdivi decoders

USArmyResearchLab / Dshell

Dshell is a network forensic analysis framework.

Other

5.45k stars 1.14k forks source link

CVE-2015-8562 and Emdivi decoders #79

Closed wglodek closed 8 years ago

wglodek commented 8 years ago

Two decoders to detect/deobfuscate:

CVE-2015-8562 / Joomla exploit attempts
Emdivi decoders (based on worked by @JPCERTCC)

wglodek commented 8 years ago

Updated documentation to reflect the actual functionality of the decoder.

dev195 commented 8 years ago

While the decoders themselves look good, we have some concerns about the Emdivi decoder and its license. Because of its wording, we will need to get additional approval before accepting the pull request. This will take a certain amount of time.

The Joomla decoder seems fine, however. If you would prefer, you can split this pull request into two; we can accept the Joomla decoder while waiting to check the Emdivi decoder.