{"uuid": "f1ca9da5-87dd-4e14-b55b-5040e02c0af0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-25213", "type": "seen", "source": "https://gist.github.com/omenyx/fb0c588b0dc02780a8a968ca94687f5d", "content": "# ============================================================================\n# Imunify360 / ModSecurity custom WAF rules\n# WordPress backdoor + file-manager-RCE actor signatures\n# ----------------------------------------------------------------------------\n# Identified & validated on a cPanel shared host, 2026-09-19.\n#\n# Covered families (all fired => HTTP 403, verified, zero false positives on\n# clean traffic):\n#   [F1] ooc_ XOR backdoor     - WordPress index.php backdoor family.\n#          Markers: XOR key \"wcwDtXHzxVSdTKdN\", crawler whitelist\n#          \"ooc_dpv3x\"/\"ooc_ktq7j\", per-visit log \"ooc_vnbm5\", \"zip://css\"\n#          zip-wrapper include.\n#   [F2] base64 key-table loader- second infection variant (Sep-2026):\n#          \"$__d['v'] = base64_decode(...)\" + eval. Marker regex\n#          matches the $__d['v<8 hex>'] array-key loader pattern.\n#   [F3] gzuncompress webshell  - \"eval(gzuncompress(str_replace(...)))\"\n#          obfuscated PHP webshell family (e.g. renamed .php files at docroot).\n#   [A]  Tool UA \"Yjmy@2025\"    - the actor's automation User-Agent.\n#   [P]  elFinder / file-manager - the admin-ajax RCE write path used to\n#          replace index.php / drop shells (CVE-2020-25213-class).\n#\n# DEPLOYMENT / ADMIN NOTES\n# ------------------------\n# * File: place in /etc/apache2/conf.d/ (glob-included once) on cPanel/Apache\n#   + ModSecurity2. Reload:  apachectl configtest && apachectl graceful\n# * Rule IDs: private 2147483xxx range to avoid colliding with Imunify360's\n#   own (7xxxxxx/9xxxxxx) and OWASP-CRS ranges. Renumber per-site if needed;\n#   keep IDs unique within the whole loaded ruleset or ModSec fails to boot.\n# * PHASE-2 / body gotcha: on many cPanel + ModSecurity2 stacks, per-vhost\n#   body processing is disabled and phase-2 rules on REQUEST_BODY/ARGS never\n#   fire (verified here). The rules below are therefore phase-1 against\n#   REQUEST_URI/QUERY_STRING/ARGS, which DO execute and block.\n# * The (commented) [BODYSET] block is the optional phase-2 variant for hosts\n#   where `SecRequestBodyAccess On` is effective (nginx + ModSec3, standalone\n#   mod_security2). Uncomment it to also block markers inside POST bodies.\n#   It is harmless (just inert) where body processing is off, but prefer\n#   keeping ONLY the phase-1 set active to avoid confusion.\n# * Always pair this with a file-scan / realtime-AV layer for the actual file\n#   content (e.g. Imunify360 realtime engine / ClamAV / LMD). On our host the\n#   realtime engine removed identical shells seconds after they were written.\n# * Verify after deploy for each rule with e.g.:\n#     curl -sk -o /dev/null -w '%{http_code}\\n' 'https://SITE/?x=wcwDtXHzxVSdTKdN'   # expect 403\n#     curl -sk -o /dev/null -w '%{http_code}\\n' -A 'Yjmy@2025' https://SITE/        # expect 403\n#     curl -sk -o /dev/null -w '%{http_code}\\n' https://SITE/                       # expect 200\n# ============================================================================\n\n# --- [F1] ooc_ XOR backdoor family (index.php backdoor markers) ------------\nSecRule REQUEST_URI|QUERY_STRING|ARGS \"@rx (?:wcwDtXHzxVSdTKdN|ooc_dpv3x|ooc_ktq7j|ooc_vnbm5|zip://css)\" \\\n  \"id:2147483001,phase:1,deny,status:403,msg:'WP ooc_ XOR backdoor family',log,tag:'wp-backdoor'\"\n\n# --- [F2] base64 key-table loader family ($__d['v'] + eval) ----------\nSecRule REQUEST_URI|QUERY_STRING|ARGS \"@rx \\$__d\\['v[0-9a-f]{8}'\\]\" \\\n  \"id:2147483002,phase:1,deny,status:403,msg:'WP base64 key-table loader family',log,tag:'wp-backdoor'\"\n\n# --- [F3] eval(gzuncompress(str_replace(...)) webshell family --------------\nSecRule REQUEST_URI|QUERY_STRING|ARGS \"@rx gzuncompress\\s*\\(\\s*str_replace\" \\\n  \"id:2147483003,phase:1,deny,status:403,msg:'WP gzuncompress obfuscated webshell family',log,tag:'wp-webshell'\"\n\n# --- [A] attacker automation User-Agent ------------------------------------\nSecRule REQUEST_HEADERS:User-Agent \"@rx Yjmy@2025\" \\\n  \"id:2147483004,phase:1,deny,status:403,msg:'Attacker tool UA Yjmy@2025',log,tag:'attacker-ua'\"\n\n# --- [P] elFinder / file-manager RCE write path (any site using it) --------\nSecRule REQUEST_FILENAME \"@rx (connector\\.minimal\\.php|elFinder|wp-file-manager|file_folder_manager\\.php)\" \\\n  \"id:2147483005,phase:1,deny,status:403,msg:'File-manager RCE path (elFinder)',log,tag:'wp-rce'\"\n\n# ============================================================================\n# [BODYSET] OPTIONAL phase-2 / REQUEST_BODY block (enable ONLY where\n# `SecRequestBodyAccess On` actually buffers bodies; inert otherwise).\n# Same families as above but inspects POST bodies / multipart-upload content.\n# ============================================================================\n#SecRule REQUEST_BODY|ARGS \"@rx (?:wcwDtXHzxVSdTKdN|ooc_dpv3x|ooc_ktq7j|ooc_vnbm5|zip://css)\" \\\n#  \"id:2147483011,phase:2,deny,status:403,msg:'WP ooc_ XOR backdoor family (body)',log,tag:'wp-backdoor'\"\n#SecRule REQUEST_BODY|ARGS \"@rx \\$__d\\['v[0-9a-f]{8}'\\]\" \\\n#  \"id:2147483012,phase:2,deny,status:403,msg:'WP base64 key-table loader family (body)',log,tag:'wp-backdoor'\"\n#SecRule REQUEST_BODY|ARGS \"@rx gzuncompress\\s*\\(\\s*str_replace\" \\\n#  \"id:2147483013,phase:2,deny,status:403,msg:'WP gzuncompress webshell family (body)',log,tag:'wp-webshell'\"\n", "creation_timestamp": "2026-09-19T08:08:09.590827Z"}