getting running with yara
jdnrg opened this issue · 5 comments
jdnrg commented
Here is how I got it running,
and a small patch
git clone git@github.com:VirusTotal/yara.git
cd yara/
sudo yum install autoconf automake libtool openssl-devel.x86_64 flex bison
YACC=bison ./configure
make
setup finder
cd ..
git clone git@github.com:nbs-system/php-malware-finder.git
cd php-malware-finder/
~/GitHub/devops/yara/yara -r ./php-malware-finder/php.yar ~/GitHub/sourcetoscan/
Had to patch this (nocase was duplicate)
diff --git a/php-malware-finder/php.yar b/php-malware-finder/php.yar
index 6a93fe1..029aaf9 100644
--- a/php-malware-finder/php.yar
+++ b/php-malware-finder/php.yar
@@ -159,7 +159,7 @@ rule DangerousPhp
$ = "suhosin.executor.func.blacklist" nocase
$ = "unregister_tick_function" fullword nocase
$ = "win32_create_service" fullword nocase
- $ = "xmlrpc_decode" fullword nocase nocase
+ $ = "xmlrpc_decode" fullword nocase
$ = /ob_start\s*\(\s*[^\)]/ //ob_start('assert'); echo $_REQUEST['pass']; ob_end_flush();shaddai commented
thanks for submitting this typo, I fixed it and it will be merged soon :)
jvoisin commented
Thanks!
jdnrg commented
you might want to add my notes to the readme for the build instructions for aws amazon linux 2