mirror of
https://github.com/roadwy/DefenderYara
synced 2026-06-21 14:08:27 +00:00
roadwy
15 lines
942 B
Plaintext
15 lines
942 B
Plaintext
|
|
rule Exploit_Linux_DirtyPipe_B{
|
|
meta:
|
|
description = "Exploit:Linux/DirtyPipe.B,SIGNATURE_TYPE_ELFHSTR_EXT,14 00 14 00 05 00 00 "
|
|
|
|
strings :
|
|
$a_00_0 = {55 73 61 67 65 3a 20 25 73 20 54 41 52 47 45 54 46 49 4c 45 20 4f 46 46 53 45 54 20 44 41 54 41 } //5 Usage: %s TARGETFILE OFFSET DATA
|
|
$a_00_1 = {53 6f 72 72 79 2c 20 63 61 6e 6e 6f 74 20 73 74 61 72 74 20 77 72 69 74 69 6e 67 20 61 74 20 61 20 70 61 67 65 20 62 6f 75 6e 64 61 72 79 } //5 Sorry, cannot start writing at a page boundary
|
|
$a_00_2 = {53 6f 72 72 79 2c 20 63 61 6e 6e 6f 74 20 77 72 69 74 65 20 61 63 72 6f 73 73 20 61 20 70 61 67 65 20 62 6f 75 6e 64 61 72 79 } //5 Sorry, cannot write across a page boundary
|
|
$a_00_3 = {49 74 20 77 6f 72 6b 65 64 21 } //5 It worked!
|
|
$a_00_4 = {73 70 6c 69 63 65 20 66 61 69 6c 65 64 } //5 splice failed
|
|
condition:
|
|
((#a_00_0 & 1)*5+(#a_00_1 & 1)*5+(#a_00_2 & 1)*5+(#a_00_3 & 1)*5+(#a_00_4 & 1)*5) >=20
|
|
|
|
} |