mirror of
https://github.com/roadwy/DefenderYara
synced 2026-06-21 14:08:27 +00:00
roadwy
17 lines
1.0 KiB
Plaintext
17 lines
1.0 KiB
Plaintext
|
|
rule Exploit_iPhoneOS_Vortex_C{
|
|
meta:
|
|
description = "Exploit:iPhoneOS/Vortex.C,SIGNATURE_TYPE_MACHOHSTR_EXT,06 00 06 00 07 00 00 "
|
|
|
|
strings :
|
|
$a_00_0 = {73 74 6f 6c 65 20 74 68 65 20 6b 65 72 6e 65 6c 27 73 20 63 72 65 64 65 6e 74 69 61 6c 73 } //1 stole the kernel's credentials
|
|
$a_00_1 = {76 30 72 74 65 78 } //1 v0rtex
|
|
$a_01_2 = {2f 2e 63 79 64 69 61 5f 6e 6f 5f 73 74 61 73 68 } //1 /.cydia_no_stash
|
|
$a_00_3 = {6d 61 63 68 5f 70 6f 72 74 5f 72 65 71 75 65 73 74 5f 6e 6f 74 69 66 69 63 61 74 69 6f 6e 28 66 61 6b 65 70 6f 72 74 29 } //1 mach_port_request_notification(fakeport)
|
|
$a_00_4 = {65 78 70 6c 6f 69 74 20 66 61 69 6c 65 64 } //1 exploit failed
|
|
$a_00_5 = {2f 41 70 70 6c 69 63 61 74 69 6f 6e 73 2f 43 79 64 69 61 2e 61 70 70 } //1 /Applications/Cydia.app
|
|
$a_00_6 = {66 75 63 6b 73 69 67 6e 69 6e 67 73 65 72 76 69 63 65 73 } //1 fucksigningservices
|
|
condition:
|
|
((#a_00_0 & 1)*1+(#a_00_1 & 1)*1+(#a_01_2 & 1)*1+(#a_00_3 & 1)*1+(#a_00_4 & 1)*1+(#a_00_5 & 1)*1+(#a_00_6 & 1)*1) >=6
|
|
|
|
} |