mirror of
https://github.com/roadwy/DefenderYara
synced 2026-06-21 14:08:27 +00:00
roadwy
16 lines
1.6 KiB
Plaintext
16 lines
1.6 KiB
Plaintext
|
|
rule Exploit_Win32_SQLexp_J{
|
|
meta:
|
|
description = "Exploit:Win32/SQLexp.J,SIGNATURE_TYPE_PEHSTR,06 00 06 00 06 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 c9 83 e9 af d9 ee d9 74 24 f4 5b 81 73 13 92 35 88 95 83 eb fc e2 f4 6e 5f 63 da 7a cc 77 6a 6d 55 03 f9 b6 11 03 d0 ae be f4 90 ea 34 67 1e dd 2d 03 ca b2 34 63 76 a2 7c 03 a1 19 34 66 a4 52 ac 24 11 52 41 8f 54 58 38 89 57 79 c1 b3 c1 b6 1d fd 76 19 6a ac 94 79 53 03 99 d9 be d7 89 93 de 8b b9 19 bc e4 b1 8e 54 4b a4 52 51 03 d5 a2 be c8 99 19 45 94 38 19 75 80 cb fa bb c6 9b 7e 65 77 43 a3 ee ee c6 f4 5d bb a7 fa 42 fb a7 cd 61 77 45 fa fe 65 69 a9 65 77 43 cd bc 6d f3 13 d8 80 97 c7 5f 8a 6a 42 5d 51 9c 67 98 df 6a 44 66 db c6 c1 66 cb c6 d1 66 77 45 f4 5d 99 c9 f4 66 01 74 07 5d 2c 8f e2 f2 df 6a 44 5f 98 c4 c7 ca 58 fd 36 98 a6 7c c5 ca 5e c6 } //1
|
|
$a_01_1 = {c7 ca 58 fd 77 7c 0e dc c5 ca 5e c5 c6 61 dd 6a 42 a6 e0 72 eb f3 f1 c2 6d e3 dd 6a 42 53 e2 f1 f4 5d eb f8 1b d0 e2 c5 cb 1c 44 1c 75 5f cc 1c 70 04 48 66 38 cb ca b8 6c 77 a4 06 1f 4f b0 3e 39 9e e0 e7 6c 86 9e 6a e7 71 77 43 c9 62 da c4 c3 64 e2 94 c3 64 dd c4 6d e5 e0 38 4b 30 46 c6 6d e3 e2 6a 6d 02 77 45 19 62 74 16 56 51 77 43 c0 ca 58 fd 62 bf 8c ca c1 ca 5e 6a 42 35 88 95 } //1
|
|
$a_01_2 = {63 72 61 73 68 20 73 65 72 76 65 72 } //1 crash server
|
|
$a_01_3 = {65 78 70 6c 6f 69 74 61 74 69 6f 6e 20 46 41 49 4c 45 44 21 } //1 exploitation FAILED!
|
|
$a_01_4 = {47 45 54 20 2f 25 } //1 GET /%
|
|
$a_01_5 = {48 54 54 50 2f 31 2e 30 } //1 HTTP/1.0
|
|
condition:
|
|
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
|
|
|
|
} |