rule Exploit_Linux_Local_gen_B{
	meta:
		description = "Exploit:Linux/Local.gen!B,SIGNATURE_TYPE_ELFHSTR_EXT,09 00 09 00 02 00 00 "
		
	strings :
		$a_01_0 = {63 68 6f 77 6e 20 72 6f 6f 74 3a 72 6f 6f 74 20 25 73 20 26 26 20 63 68 6d 6f 64 20 34 37 35 35 20 25 73 20 26 26 20 72 6d 20 2d 72 66 20 25 73 20 26 26 20 6b 69 6c 6c 20 2d 55 53 52 31 20 25 64 } //4 chown root:root %s && chmod 4755 %s && rm -rf %s && kill -USR1 %d
		$a_01_1 = {23 2f 65 74 63 2f 63 72 6f 6e 2e 64 2f 63 6f 72 65 20 73 75 69 64 5f 64 75 6d 70 61 62 6c 65 20 65 78 70 6c 6f 69 74 } //5 #/etc/cron.d/core suid_dumpable exploit
	condition:
		((#a_01_0  & 1)*4+(#a_01_1  & 1)*5) >=9
 
}