|
@@ -0,0 +1,36 @@
|
|
|
|
+using Moonlight.App.Database.Entities;
|
|
|
|
+using Moonlight.App.Models.Misc;
|
|
|
|
+using Moonlight.App.Services;
|
|
|
|
+
|
|
|
|
+namespace Moonlight.App.MalwareScans;
|
|
|
|
+
|
|
|
|
+public class ProxyScan : MalwareScan
|
|
|
|
+{
|
|
|
|
+ public override string Name => "Proxy software";
|
|
|
|
+ public override string Description => "Software to use nodes as a proxy";
|
|
|
|
+ public override async Task<MalwareScanResult?> Scan(Server server, IServiceProvider serviceProvider)
|
|
|
|
+ {
|
|
|
|
+ var serverService = serviceProvider.GetRequiredService<ServerService>();
|
|
|
|
+ var access = await serverService.CreateFileAccess(server, null!);
|
|
|
|
+
|
|
|
|
+ var files = await access.Ls();
|
|
|
|
+
|
|
|
|
+ foreach (var file in files.Where(x => x.Name.EndsWith(".sh")))
|
|
|
|
+ {
|
|
|
|
+ var fileContent = await access.Read(file);
|
|
|
|
+ var processableContent = fileContent.ToLower();
|
|
|
|
+
|
|
|
|
+ if (processableContent.Contains("t-e-s-tweb"))
|
|
|
|
+ {
|
|
|
|
+ return new MalwareScanResult()
|
|
|
|
+ {
|
|
|
|
+ Title = "Proxy software",
|
|
|
|
+ Description = "Software to use nodes as a proxy",
|
|
|
|
+ Author = "Marcel Baumgartner"
|
|
|
|
+ };
|
|
|
|
+ }
|
|
|
|
+ }
|
|
|
|
+
|
|
|
|
+ return null;
|
|
|
|
+ }
|
|
|
|
+}
|