mirror of
https://github.com/roadwy/DefenderYara
synced 2026-06-21 14:08:27 +00:00
roadwy
12 lines
671 B
Plaintext
12 lines
671 B
Plaintext
|
|
rule Exploit_Linux_Local_gen_B{
|
|
meta:
|
|
description = "Exploit:Linux/Local.gen!B,SIGNATURE_TYPE_ELFHSTR_EXT,09 00 09 00 02 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {63 68 6f 77 6e 20 72 6f 6f 74 3a 72 6f 6f 74 20 25 73 20 26 26 20 63 68 6d 6f 64 20 34 37 35 35 20 25 73 20 26 26 20 72 6d 20 2d 72 66 20 25 73 20 26 26 20 6b 69 6c 6c 20 2d 55 53 52 31 20 25 64 } //4 chown root:root %s && chmod 4755 %s && rm -rf %s && kill -USR1 %d
|
|
$a_01_1 = {23 2f 65 74 63 2f 63 72 6f 6e 2e 64 2f 63 6f 72 65 20 73 75 69 64 5f 64 75 6d 70 61 62 6c 65 20 65 78 70 6c 6f 69 74 } //5 #/etc/cron.d/core suid_dumpable exploit
|
|
condition:
|
|
((#a_01_0 & 1)*4+(#a_01_1 & 1)*5) >=9
|
|
|
|
} |