\" title=\"<%=SubFolder.Name%>\"> \" title=\"<%=File.Name%>\"> \" align=\"right\"><%=Attributes(SubFolder.Attributes)%>\">"
condition:
all of them
}
rule byloader {
meta:
description = "Webshells Auto-generated - file byloader.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "0f0d6dc26055653f5844ded906ce52df"
strings:
$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtfsChk"
$s1 = "Failure ... Access is Denied !"
$s2 = "NTFS Disk Driver Checking Service"
$s3 = "Dumping Description to Registry..."
$s4 = "Opening Service .... Failure !"
condition:
all of them
}
rule shelltools_g0t_root_Fport {
meta:
description = "Webshells Auto-generated - file Fport.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "dbb75488aa2fa22ba6950aead1ef30d5"
strings:
$s4 = "Copyright 2000 by Foundstone, Inc."
$s5 = "You must have administrator privileges to run fport - exiting..."
condition:
all of them
}
rule BackDooR__fr_ {
meta:
description = "Webshells Auto-generated - file BackDooR (fr).php"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "a79cac2cf86e073a832aaf29a664f4be"
strings:
$s3 = "print(\"Exploit include "
condition:
all of them
}
rule FSO_s_ntdaddy {
meta:
description = "Webshells Auto-generated - file ntdaddy.asp"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "f6262f3ad9f73b8d3e7d9ea5ec07a357"
strings:
$s1 = "\"> &X\\\";open STDERR,\\\">&X\\\";exec(\\\"/bin/sh -i\\\");"
condition:
all of them
}
rule HYTop_DevPack_upload {
meta:
description = "Webshells Auto-generated - file upload.asp"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "b09852bda534627949f0259828c967de"
strings:
$s0 = ""
condition:
all of them
}
rule PasswordReminder {
meta:
description = "Webshells Auto-generated - file PasswordReminder.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "ea49d754dc609e8bfa4c0f95d14ef9bf"
strings:
$s3 = "The encoded password is found at 0x%8.8lx and has a length of %d."
condition:
all of them
}
rule Pack_InjectT {
meta:
description = "Webshells Auto-generated - file InjectT.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "983b74ccd57f6195a0584cdfb27d55e8"
strings:
$s3 = "ail To Open Registry"
$s4 = "32fDssignim"
$s5 = "vide Internet S"
$s6 = "d]Software\\M"
$s7 = "TInject.Dll"
condition:
all of them
}
rule FSO_s_RemExp_2 {
meta:
description = "Webshells Auto-generated - file RemExp.asp"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "b69670ecdbb40012c73686cd22696eeb"
strings:
$s2 = " Then Response.Write \""
$s3 = ""
condition:
all of them
}
rule FSO_s_c99 {
meta:
description = "Webshells Auto-generated - file c99.php"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "5f9ba02eb081bba2b2434c603af454d0"
strings:
$s2 = "\"txt\",\"conf\",\"bat\",\"sh\",\"js\",\"bak\",\"doc\",\"log\",\"sfc\",\"cfg\",\"htacce"
condition:
all of them
}
rule rknt_zip_Folder_RkNT {
meta:
description = "Webshells Auto-generated - file RkNT.dll"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "5f97386dfde148942b7584aeb6512b85"
strings:
$s0 = "PathStripPathA"
$s1 = "`cLGet!Addr%"
$s2 = "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $"
$s3 = "oQToOemBuff* <="
$s4 = "ionCdunAsw[Us'"
$s6 = "CreateProcessW: %S"
$s7 = "ImageDirectoryEntryToData"
condition:
all of them
}
rule dbgntboot {
meta:
description = "Webshells Auto-generated - file dbgntboot.dll"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "4d87543d4d7f73c1529c9f8066b475ab"
strings:
$s2 = "now DOS is working at mode %d,faketype %d,against %s,has worked %d minutes,by sp"
$s3 = "sth junk the M$ Wind0wZ retur"
condition:
all of them
}
rule PHP_shell {
meta:
description = "Webshells Auto-generated - file shell.php"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "45e8a00567f8a34ab1cccc86b4bc74b9"
strings:
$s0 = "AR8iROET6mMnrqTpC6W1Kp/DsTgxNby9H1xhiswfwgoAtED0y6wEXTihoAtICkIX6L1+vTUYWuWz"
$s11 = "1HLp1qnlCyl5gko8rDlWHqf8/JoPKvGwEm9Q4nVKvEh0b0PKle3zeFiJNyjxOiVepMSpflJkPv5s"
condition:
all of them
}
rule hxdef100 {
meta:
description = "Webshells Auto-generated - file hxdef100.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "55cc1769cef44910bd91b7b73dee1f6c"
strings:
$s0 = "RtlAnsiStringToUnicodeString"
$s8 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"
$s9 = "\\\\.\\mailslot\\hxdef-rk100sABCDEFGH"
condition:
all of them
}
rule rdrbs100 {
meta:
description = "Webshells Auto-generated - file rdrbs100.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "7c752bcd6da796d80a6830c61a632bff"
strings:
$s3 = "Server address must be IP in A.B.C.D format."
$s4 = " mapped ports in the list. Currently "
condition:
all of them
}
rule Mithril_Mithril {
meta:
description = "Webshells Auto-generated - file Mithril.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "017191562d72ab0ca551eb89256650bd"
strings:
$s0 = "OpenProcess error!"
$s1 = "WriteProcessMemory error!"
$s4 = "GetProcAddress error!"
$s5 = "HHt`HHt\\"
$s6 = "Cmaudi0"
$s7 = "CreateRemoteThread error!"
$s8 = "Kernel32"
$s9 = "VirtualAllocEx error!"
condition:
all of them
}
rule hxdef100_2 {
meta:
description = "Webshells Auto-generated - file hxdef100.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "1b393e2e13b9c57fb501b7cd7ad96b25"
strings:
$s0 = "\\\\.\\mailslot\\hxdef-rkc000"
$s2 = "Shared Components\\On Access Scanner\\BehaviourBlo"
$s6 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"
condition:
all of them
}
rule Release_dllTest {
meta:
description = "Webshells Auto-generated - file dllTest.dll"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "76a59fc3242a2819307bb9d593bef2e0"
strings:
$s0 = ";;;Y;`;d;h;l;p;t;x;|;"
$s1 = "0 0&00060K0R0X0f0l0q0w0"
$s2 = ": :$:(:,:0:4:8:D:`=d="
$s3 = "4@5P5T5\\5T7\\7d7l7t7|7"
$s4 = "1,121>1C1K1Q1X1^1e1k1s1y1"
$s5 = "9 9$9(9,9P9X9\\9`9d9h9l9p9t9x9|9"
$s6 = "0)0O0\\0a0o0\"1E1P1q1"
$s7 = "<.\".ws(2).\"HDD Free : \".view_size($free).\" HDD Total : \".view_"
condition:
all of them
}
rule Mithril_v1_45_dllTest {
meta:
description = "Webshells Auto-generated - file dllTest.dll"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "1b9e518aaa62b15079ff6edb412b21e9"
strings:
$s3 = "syspath"
$s4 = "\\Mithril"
$s5 = "--list the services in the computer"
condition:
all of them
}
rule dbgiis6cli {
meta:
description = "Webshells Auto-generated - file dbgiis6cli.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "3044dceb632b636563f66fee3aaaf8f3"
strings:
$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
$s5 = "###command:(NO more than 100 bytes!)"
condition:
all of them
}
rule remview_2003_04_22 {
meta:
description = "Webshells Auto-generated - file remview_2003_04_22.php"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "17d3e4e39fbca857344a7650f7ea55e3"
strings:
$s1 = "\"\".mm(\"Eval PHP code\").\" (\".mm(\"don't type\").\" \\\"<?\\\""
condition:
all of them
}
rule FSO_s_test {
meta:
description = "Webshells Auto-generated - file test.php"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "82cf7b48da8286e644f575b039a99c26"
strings:
$s0 = "$yazi = \"test\" . \"\\r\\n\";"
$s2 = "fwrite ($fp, \"$yazi\");"
condition:
all of them
}
rule Debug_cress {
meta:
description = "Webshells Auto-generated - file cress.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "36a416186fe010574c9be68002a7286a"
strings:
$s0 = "\\Mithril "
$s4 = "Mithril.exe"
condition:
all of them
}
rule webshell {
meta:
description = "Webshells Auto-generated - file webshell.php"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "f2f8c02921f29368234bfb4d4622ad19"
strings:
$s0 = "RhViRYOzz"
$s1 = "d\\O!jWW"
$s2 = "bc!jWW"
$s3 = "0W[&{l"
$s4 = "[INhQ@\\"
condition:
all of them
}
rule FSO_s_EFSO_2 {
meta:
description = "Webshells Auto-generated - file EFSO_2.asp"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "a341270f9ebd01320a7490c12cb2e64c"
strings:
$s0 = ";!+/DRknD7+.\\mDrC(V+kcJznndm\\f|nzKuJb'r@!&0KUY@*Jb@#@&Xl\"dKVcJ\\CslU,),@!0KxD~mKV"
$s4 = "\\co!VV2CDtSJ'E*#@#@&mKx/DP14lM/nY{JC81N+6LtbL3^hUWa;M/OE-AXX\"b~/fAs!u&9|J\\grKp\"j"
condition:
all of them
}
rule thelast_index3 {
meta:
description = "Webshells Auto-generated - file index3.php"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "cceff6dc247aaa25512bad22120a14b4"
strings:
$s5 = "$err = \"Your Name Not Entered!Sorry, \\\"Your Name\\\" field is r"
condition:
all of them
}
rule adjustcr {
meta:
description = "Webshells Auto-generated - file adjustcr.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "17037fa684ef4c90a25ec5674dac2eb6"
strings:
$s0 = "$Info: This file is packed with the UPX executable packer $"
$s2 = "$License: NRV for UPX is distributed under special license $"
$s6 = "AdjustCR Carr"
$s7 = "ION\\System\\FloatingPo"
condition:
all of them
}
rule FeliksPack3___PHP_Shells_xIShell {
meta:
description = "Webshells Auto-generated - file xIShell.php"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "997c8437c0621b4b753a546a53a88674"
strings:
$s3 = "if (!$nix) { $xid = implode(explode(\"\\\\\",$xid),\"\\\\\\\\\");}echo (\"
\")"
condition:
all of them
}
rule EditServer_Webshell_2 {
meta:
description = "Webshells Auto-generated - file EditServer.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "5c1f25a4d206c83cdfb006b3eb4c09ba"
strings:
$s0 = "@HOTMAIL.COM"
$s1 = "Press Any Ke"
$s3 = "glish MenuZ"
condition:
all of them
}
rule by064cli {
meta:
description = "Webshells Auto-generated - file by064cli.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "10e0dff366968b770ae929505d2a9885"
strings:
$s7 = "packet dropped,redirecting"
$s9 = "input the password(the default one is 'by')"
condition:
all of them
}
rule Mithril_dllTest {
meta:
description = "Webshells Auto-generated - file dllTest.dll"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "a8d25d794d8f08cd4de0c3d6bf389e6d"
strings:
$s0 = "please enter the password:"
$s3 = "\\dllTest.pdb"
condition:
all of them
}
rule peek_a_boo {
meta:
description = "Webshells Auto-generated - file peek-a-boo.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "aca339f60d41fdcba83773be5d646776"
strings:
$s0 = "__vbaHresultCheckObj"
$s1 = "\\VB\\VB5.OLB"
$s2 = "capGetDriverDescriptionA"
$s3 = "__vbaExceptHandler"
$s4 = "EVENT_SINK_Release"
$s8 = "__vbaErrorOverflow"
condition:
all of them
}
rule fmlibraryv3 {
meta:
description = "Webshells Auto-generated - file fmlibraryv3.asp"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "c34c248fed6d5a20d8203924a2088acc"
strings:
$s3 = "ExeNewRs.CommandText = \"UPDATE \" & tablename & \" SET \" & ExeNewRsValues & \" WHER"
condition:
all of them
}
rule Debug_dllTest_2 {
meta:
description = "Webshells Auto-generated - file dllTest.dll"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "1b9e518aaa62b15079ff6edb412b21e9"
strings:
$s4 = "\\Debug\\dllTest.pdb"
$s5 = "--list the services in the computer"
condition:
all of them
}
rule connector {
meta:
description = "Webshells Auto-generated - file connector.asp"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "3ba1827fca7be37c8296cd60be9dc884"
strings:
$s2 = "If ( AttackID = BROADCAST_ATTACK )"
$s4 = "Add UNIQUE ID for victims / zombies"
condition:
all of them
}
rule shelltools_g0t_root_HideRun {
meta:
description = "Webshells Auto-generated - file HideRun.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "45436d9bfd8ff94b71eeaeb280025afe"
strings:
$s0 = "Usage -- hiderun [AppName]"
$s7 = "PVAX SW, Alexey A. Popoff, Moscow, 1997."
condition:
all of them
}
rule regshell {
meta:
description = "Webshells Auto-generated - file regshell.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "db2fdc821ca6091bab3ebd0d8bc46ded"
strings:
$s0 = "Changes the base hive to HKEY_CURRENT_USER."
$s4 = "Displays a list of values and sub-keys in a registry Hive."
$s5 = "Enter a menu selection number (1 - 3) or 99 to Exit: "
condition:
all of them
}
rule PHP_Shell_v1_7 {
meta:
description = "Webshells Auto-generated - file PHP_Shell_v1.7.php"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "b5978501c7112584532b4ca6fb77cba5"
strings:
$s8 = "[ADDITINAL TITTLE]-phpShell by:[YOURNAME]"
condition:
all of them
}
rule xssshell_save {
meta:
description = "Webshells Auto-generated - file save.asp"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "865da1b3974e940936fe38e8e1964980"
strings:
$s4 = "RawCommand = Command & COMMAND_SEPERATOR & Param & COMMAND_SEPERATOR & AttackID"
$s5 = "VictimID = fm_NStr(Victims(i))"
condition:
all of them
}
rule screencap {
meta:
description = "Webshells Auto-generated - file screencap.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "51139091dea7a9418a50f2712ea72aa6"
strings:
$s0 = "GetDIBColorTable"
$s1 = "Screen.bmp"
$s2 = "CreateDCA"
condition:
all of them
}
rule FSO_s_phpinj_2 {
meta:
description = "Webshells Auto-generated - file phpinj.php"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "dd39d17e9baca0363cc1c3664e608929"
strings:
$s9 = "<? system(\\$_GET[cpc]);exit; ?>' ,0 ,0 ,0 ,0 INTO"
condition:
all of them
}
rule ZXshell2_0_rar_Folder_zxrecv {
meta:
description = "Webshells Auto-generated - file zxrecv.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "5d3d12a39f41d51341ef4cb7ce69d30f"
strings:
$s0 = "RyFlushBuff"
$s1 = "teToWideChar^FiYP"
$s2 = "mdesc+8F D"
$s3 = "\\von76std"
$s4 = "5pur+virtul"
$s5 = "- Kablto io"
$s6 = "ac#f{lowi8a"
condition:
all of them
}
rule FSO_s_ajan {
meta:
description = "Webshells Auto-generated - file ajan.asp"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "22194f8c44524f80254e1b5aec67b03e"
strings:
$s4 = "entrika.write \"BinaryStream.SaveToFile"
condition:
all of them
}
rule c99shell {
meta:
description = "Webshells Auto-generated - file c99shell.php"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "90b86a9c63e2cd346fe07cea23fbfc56"
strings:
$s0 = "<br />Input URL: <input name=\\\"uploadurl\\\" type=\\\"text\\\"&"
condition:
all of them
}
rule phpspy_2005_full {
meta:
description = "Webshells Auto-generated - file phpspy_2005_full.php"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "d1c69bb152645438440e6c903bac16b2"
strings:
$s7 = "echo \" <td align=\\\"center\\\" nowrap valign=\\\"top\\\"><a href=\\\"?downfile=\".urlenco"
condition:
all of them
}
rule FSO_s_zehir4_2 {
meta:
description = "Webshells Auto-generated - file zehir4.asp"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "5b496a61363d304532bcf52ee21f5d55"
strings:
$s4 = "\"Program Files\\Serv-u\\Serv"
condition:
all of them
}
rule httpdoor {
meta:
description = "Webshells Auto-generated - file httpdoor.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "6097ea963455a09474471a9864593dc3"
strings:
$s4 = "''''''''''''''''''DaJKHPam"
$s5 = "o,WideCharR]!n]"
$s6 = "HAutoComplete"
$s7 = "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?> <assembly xmlns=\"urn:sch"
condition:
all of them
}
rule FSO_s_indexer_2 {
meta:
description = "Webshells Auto-generated - file indexer.asp"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "135fc50f85228691b401848caef3be9e"
strings:
$s5 = "<td>Nerden :<td><input type=\"text\" name=\"nerden\" size=25 value=index.html></td>"
condition:
all of them
}
rule HYTop_DevPack_2005 {
meta:
description = "Webshells Auto-generated - file 2005.asp"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
strings:
$s7 = "theHref=encodeForUrl(mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\")"
$s8 = "scrollbar-darkshadow-color:#9C9CD3;"
$s9 = "scrollbar-face-color:#E4E4F3;"
condition:
all of them
}
rule _root_040_zip_Folder_deploy {
meta:
description = "Webshells Auto-generated - file deploy.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "2c9f9c58999256c73a5ebdb10a9be269"
strings:
$s5 = "halon synscan 127.0.0.1 1-65536"
$s8 = "Obviously you replace the ip address with that of the target."
condition:
all of them
}
rule by063cli {
meta:
description = "Webshells Auto-generated - file by063cli.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "49ce26eb97fd13b6d92a5e5d169db859"
strings:
$s2 = "#popmsghello,are you all right?"
$s4 = "connect failed,check your network and remote ip."
condition:
all of them
}
rule icyfox007v1_10_rar_Folder_asp {
meta:
description = "Webshells Auto-generated - file asp.asp"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "2c412400b146b7b98d6e7755f7159bb9"
strings:
$s0 = "<SCRIPT RUNAT=SERVER LANGUAGE=JAVASCRIPT>eval(Request.form('#')+'')</SCRIPT>"
condition:
all of them
}
rule FSO_s_EFSO_2_2 {
meta:
description = "Webshells Auto-generated - file EFSO_2.asp"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "a341270f9ebd01320a7490c12cb2e64c"
strings:
$s0 = ";!+/DRknD7+.\\mDrC(V+kcJznndm\\f|nzKuJb'r@!&0KUY@*Jb@#@&Xl\"dKVcJ\\CslU,),@!0KxD~mKV"
$s4 = "\\co!VV2CDtSJ'E*#@#@&mKx/DP14lM/nY{JC81N+6LtbL3^hUWa;M/OE-AXX\"b~/fAs!u&9|J\\grKp\"j"
condition:
all of them
}
rule byshell063_ntboot_2 {
meta:
description = "Webshells Auto-generated - file ntboot.dll"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "cb9eb5a6ff327f4d6c46aacbbe9dda9d"
strings:
$s6 = "OK,job was done,cuz we have localsystem & SE_DEBUG_NAME:)"
condition:
all of them
}
rule u_uay {
meta:
description = "Webshells Auto-generated - file uay.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "abbc7b31a24475e4c5d82fc4c2b8c7c4"
strings:
$s1 = "exec \"c:\\WINDOWS\\System32\\freecell.exe"
$s9 = "SYSTEM\\CurrentControlSet\\Services\\uay.sys\\Security"
condition:
1 of them
}
rule bin_wuaus {
meta:
description = "Webshells Auto-generated - file wuaus.dll"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "46a365992bec7377b48a2263c49e4e7d"
strings:
$s1 = "9(90989@9V9^9f9n9v9"
$s2 = ":(:,:0:4:8:C:H:N:T:Y:_:e:o:y:"
$s3 = ";(=@=G=O=T=X=\\="
$s4 = "TCP Send Error!!"
$s5 = "1\"1;1X1^1e1m1w1~1"
$s8 = "=$=)=/=<=Y=_=j=p=z="
condition:
all of them
}
rule pwreveal {
meta:
description = "Webshells Auto-generated - file pwreveal.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "b4e8447826a45b76ca45ba151a97ad50"
strings:
$s0 = "*<Blank - no es"
$s3 = "JDiamondCS "
$s8 = "sword set> [Leith=0 bytes]"
$s9 = "ION\\System\\Floating-"
condition:
all of them
}
rule shelltools_g0t_root_xwhois {
meta:
description = "Webshells Auto-generated - file xwhois.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "0bc98bd576c80d921a3460f8be8816b4"
strings:
$s1 = "rting! "
$s2 = "aTypCog("
$s5 = "Diamond"
$s6 = "r)r=rQreryr"
condition:
all of them
}
rule vanquish_2 {
meta:
description = "Webshells Auto-generated - file vanquish.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "2dcb9055785a2ee01567f52b5a62b071"
strings:
$s2 = "Vanquish - DLL injection failed:"
condition:
all of them
}
rule down_rar_Folder_down {
meta:
description = "Webshells Auto-generated - file down.asp"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "db47d7a12b3584a2e340567178886e71"
strings:
$s0 = "response.write \"<font color=blue size=2>NetBios Name: \\\\\" & Snet.ComputerName &"
condition:
all of them
}
rule cmdShell {
meta:
description = "Webshells Auto-generated - file cmdShell.asp"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "8a9fef43209b5d2d4b81dfbb45182036"
strings:
$s1 = "if cmdPath=\"wscriptShell\" then"
condition:
all of them
}
rule ZXshell2_0_rar_Folder_nc {
meta:
description = "Webshells Auto-generated - file nc.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "2cd1bf15ae84c5f6917ddb128827ae8b"
strings:
$s0 = "WSOCK32.dll"
$s1 = "?bSUNKNOWNV"
$s7 = "p@gram Jm6h)"
$s8 = "ser32.dllCONFP@"
condition:
all of them
}
rule portlessinst {
meta:
description = "Webshells Auto-generated - file portlessinst.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "74213856fc61475443a91cd84e2a6c2f"
strings:
$s2 = "Fail To Open Registry"
$s3 = "f<-WLEggDr\""
$s6 = "oMemoryCreateP"
condition:
all of them
}
rule SetupBDoor {
meta:
description = "Webshells Auto-generated - file SetupBDoor.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "41f89e20398368e742eda4a3b45716b6"
strings:
$s1 = "\\BDoor\\SetupBDoor"
condition:
all of them
}
rule phpshell_3 {
meta:
description = "Webshells Auto-generated - file phpshell.php"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "e8693a2d4a2ffea4df03bb678df3dc6d"
strings:
$s3 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p>"
$s5 = " echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>\\n\";"
condition:
all of them
}
rule BIN_Server {
meta:
description = "Webshells Auto-generated - file Server.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "1d5aa9cbf1429bb5b8bf600335916dcd"
strings:
$s0 = "configserver"
$s1 = "GetLogicalDrives"
$s2 = "WinExec"
$s4 = "fxftest"
$s5 = "upfileok"
$s7 = "upfileer"
condition:
all of them
}
rule HYTop2006_rar_Folder_2006 {
meta:
description = "Webshells Auto-generated - file 2006.asp"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "c19d6f4e069188f19b08fa94d44bc283"
strings:
$s6 = "strBackDoor = strBackDoor "
condition:
all of them
}
rule r57shell_3 {
meta:
description = "Webshells Auto-generated - file r57shell.php"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "87995a49f275b6b75abe2521e03ac2c0"
strings:
$s1 = "<b>\".$_POST['cmd']"
condition:
all of them
}
rule HDConfig {
meta:
description = "Webshells Auto-generated - file HDConfig.exe"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "7d60e552fdca57642fd30462416347bd"
strings:
$s0 = "An encryption key is derived from the password hash. "
$s3 = "A hash object has been created. "
$s4 = "Error during CryptCreateHash!"
$s5 = "A new key container has been created."
$s6 = "The password has been added to the hash. "
condition:
all of them
}
rule FSO_s_ajan_2 {
meta:
description = "Webshells Auto-generated - file ajan.asp"
author = "Yara Bulk Rule Generator by Florian Roth"
hash = "22194f8c44524f80254e1b5aec67b03e"
strings:
$s2 = "\"Set WshShell = CreateObject(\"\"WScript.Shell\"\")"
$s3 = "/file.zip"
condition:
all of them
}
rule Webshell_and_Exploit_CN_APT_HK : Webshell
{
meta:
author = "Florian Roth"
description = "Webshell and Exploit Code in relation with APT against Honk Kong protesters"
date = "10.10.2014"
score = 50
strings:
$a0 = "<script language=javascript src=http://java-se.com/o.js</script>" fullword
$s0 = "<span style=\"font:11px Verdana;\">Password: </span><input name=\"password\" type=\"password\" size=\"20\">"
$s1 = "<input type=\"hidden\" name=\"doing\" value=\"login\">"
condition:
$a0 or ( all of ($s*) )
}
rule JSP_Browser_APT_webshell {
meta:
description = "VonLoesch JSP Browser used as web shell by APT groups - jsp File browser 1.1a"
author = "F.Roth"
date = "10.10.2014"
score = 60
strings:
$a1a = "private static final String[] COMMAND_INTERPRETER = {\"" ascii
$a1b = "cmd\", \"/C\"}; // Dos,Windows" ascii
$a2 = "Process ls_proc = Runtime.getRuntime().exec(comm, null, new File(dir));" ascii
$a3 = "ret.append(\"!!!! Process has timed out, destroyed !!!!!\");" ascii
condition:
all of them
}
rule JSP_jfigueiredo_APT_webshell {
meta:
description = "JSP Browser used as web shell by APT groups - author: jfigueiredo"
author = "F.Roth"
date = "12.10.2014"
score = 60
reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/Browser.jsp"
strings:
$a1 = "String fhidden = new String(Base64.encodeBase64(path.getBytes()));" ascii
$a2 = "<form id=\"upload\" name=\"upload\" action=\"ServFMUpload\" method=\"POST\" enctype=\"multipart/form-data\">" ascii
condition:
all of them
}
rule JSP_jfigueiredo_APT_webshell_2 {
meta:
description = "JSP Browser used as web shell by APT groups - author: jfigueiredo"
author = "F.Roth"
date = "12.10.2014"
score = 60
reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/"
strings:
$a1 = "<div id=\"bkorotator\"><img alt=\"\" src=\"images/rotator/1.jpg\"></div>" ascii
$a2 = "$(\"#dialog\").dialog(\"destroy\");" ascii
$s1 = "<form id=\"form\" action=\"ServFMUpload\" method=\"post\" enctype=\"multipart/form-data\">" ascii
$s2 = "<input type=\"hidden\" id=\"fhidden\" name=\"fhidden\" value=\"L3BkZi8=\" />" ascii
condition:
all of ($a*) or all of ($s*)
}
rule AJAX_FileUpload_webshell {
meta:
description = "AJAX JS/CSS components providing web shell by APT groups"
author = "F.Roth"
date = "12.10.2014"
score = 75
reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/ajaxfileupload.js"
strings:
$a1 = "var frameId = 'jUploadFrame' + id;" ascii
$a2 = "var form = jQuery('<form action=\"\" method=\"POST\" name=\"' + formId + '\" id=\"' + formId + '\" enctype=\"multipart/form-data\"></form>');" ascii
$a3 = "jQuery(\"<div>\").html(data).evalScripts();" ascii
condition:
all of them
}
rule Webshell_Insomnia {
meta:
description = "Insomnia Webshell - file InsomniaShell.aspx"
author = "Florian Roth"
reference = "http://www.darknet.org.uk/2014/12/insomniashell-asp-net-reverse-shell-bind-shell/"
date = "2014/12/09"
hash = "e0cfb2ffaa1491aeaf7d3b4ee840f72d42919d22"
score = 80
strings:
$s0 = "Response.Write(\"- Failed to create named pipe:\");" fullword ascii
$s1 = "Response.Output.Write(\"+ Sending {0}<br>\", command);" fullword ascii
$s2 = "String command = \"exec master..xp_cmdshell 'dir > \\\\\\\\127.0.0.1" ascii
$s3 = "Response.Write(\"- Error Getting User Info<br>\");" fullword ascii
$s4 = "string lpCommandLine, ref SECURITY_ATTRIBUTES lpProcessAttributes," fullword ascii
$s5 = "[DllImport(\"Advapi32.dll\", SetLastError = true)]" fullword ascii
$s9 = "username = DumpAccountSid(tokUser.User.Sid);" fullword ascii
$s14 = "//Response.Output.Write(\"Opened process PID: {0} : {1}<br>\", p" ascii
condition:
3 of them
}
rule HawkEye_PHP_Panel {
meta:
description = "Detects HawkEye Keyloggers PHP Panel"
author = "Florian Roth"
date = "2014/12/14"
score = 60
strings:
$s0 = "$fname = $_GET['fname'];" ascii fullword
$s1 = "$data = $_GET['data'];" ascii fullword
$s2 = "unlink($fname);" ascii fullword
$s3 = "echo \"Success\";" fullword ascii
condition:
all of ($s*) and filesize < 600
}
rule SoakSoak_Infected_Wordpress {
meta:
description = "Detects a SoakSoak infected Wordpress site http://goo.gl/1GzWUX"
reference = "http://goo.gl/1GzWUX"
author = "Florian Roth"
date = "2014/12/15"
score = 60
strings:
$s0 = "wp_enqueue_script(\"swfobject\");" ascii fullword
$s1 = "function FuncQueueObject()" ascii fullword
$s2 = "add_action(\"wp_enqueue_scripts\", 'FuncQueueObject');" ascii fullword
condition:
all of ($s*)
}
rule Pastebin_Webshell {
meta:
description = "Detects a web shell that downloads content from pastebin.com http://goo.gl/7dbyZs"
author = "Florian Roth"
score = 70
date = "13.01.2015"
reference = "http://goo.gl/7dbyZs"
strings:
$s0 = "file_get_contents(\"http://pastebin.com" ascii
$s1 = "xcurl('http://pastebin.com/download.php" ascii
$s2 = "xcurl('http://pastebin.com/raw.php" ascii
$x0 = "if($content){unlink('evex.php');" ascii
$x1 = "$fh2 = fopen(\"evex.php\", 'a');" ascii
$y0 = "file_put_contents($pth" ascii
$y1 = "echo \"<login_ok>" ascii
$y2 = "str_replace('* @package Wordpress',$temp" ascii
condition:
1 of ($s*) or all of ($x*) or all of ($y*)
}
rule ASPXspy2 {
meta:
description = "Web shell - file ASPXspy2.aspx"
author = "Florian Roth"
reference = "not set"
date = "2015/01/24"
hash = "5642387d92139bfe9ae11bfef6bfe0081dcea197"
strings:
$s0 = "string iVDT=\"-SETUSERSETUP\\r\\n-IP=0.0.0.0\\r\\n-PortNo=52521\\r\\n-User=bin" ascii
$s1 = "SQLExec : <asp:DropDownList runat=\"server\" ID=\"FGEy\" AutoPostBack=\"True\" O" ascii
$s3 = "Process[] p=Process.GetProcesses();" fullword ascii
$s4 = "Response.Cookies.Add(new HttpCookie(vbhLn,Password));" fullword ascii
$s5 = "[DllImport(\"kernel32.dll\",EntryPoint=\"GetDriveTypeA\")]" fullword ascii
$s6 = "<p>ConnString : <asp:TextBox id=\"MasR\" style=\"width:70%;margin:0 8px;\" CssCl" ascii
$s7 = "ServiceController[] kQmRu=System.ServiceProcess.ServiceController.GetServices();" fullword ascii
$s8 = "Copyright © 2009 Bin -- <a href=\"http://www.rootkit.net.cn\" target=\"_bla" ascii
$s10 = "Response.AddHeader(\"Content-Disposition\",\"attachment;filename=\"+HttpUtility." ascii
$s11 = "nxeDR.Command+=new CommandEventHandler(this.iVk);" fullword ascii
$s12 = "<%@ import Namespace=\"System.ServiceProcess\"%>" fullword ascii
$s13 = "foreach(string innerSubKey in sk.GetSubKeyNames())" fullword ascii
$s17 = "Response.Redirect(\"http://www.rootkit.net.cn\");" fullword ascii
$s20 = "else if(Reg_Path.StartsWith(\"HKEY_USERS\"))" fullword ascii
condition:
6 of them
}
/*
Yara Rule Set
Author: Florian Roth
Date: 2016-01-11
Identifier: Web Shell Repo
Reference: https://github.com/nikicat/web-malware-collection
*/
rule Webshell_27_9_c66_c99 {
meta:
description = "Detects Webshell - rule generated from from files 27.9.txt, c66.php, c99-shadows-mod.php, c99.php ..."
author = "Florian Roth"
reference = "https://github.com/nikicat/web-malware-collection"
date = "2016-01-11"
score = 70
hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
hash2 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
hash3 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
hash4 = "80ec7831ae888d5603ed28d81225ed8b256c831077bb8feb235e0a1a9b68b748"
hash5 = "6ce99e07aa98ba6dc521c34cf16fbd89654d0ba59194878dffca857a4c34e57b"
hash6 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
hash7 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
hash8 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
hash9 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
hash10 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
strings:
$s4 = "if (!empty($unset_surl)) {setcookie(\"c99sh_surl\"); $surl = \"\";}" fullword ascii
$s6 = "@extract($_REQUEST[\"c99shcook\"]);" fullword ascii
$s7 = "if (!function_exists(\"c99_buff_prepare\"))" fullword ascii
condition:
filesize < 685KB and 1 of them
}
rule Webshell_acid_AntiSecShell_3 {
meta:
description = "Detects Webshell Acid"
author = "Florian Roth"
reference = "https://github.com/nikicat/web-malware-collection"
date = "2016-01-11"
score = 70
hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
hash3 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
hash4 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
hash5 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
hash6 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
hash7 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
hash8 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
hash9 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
hash10 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
hash11 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
hash12 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
hash13 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
hash14 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
hash15 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
hash16 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
hash17 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
hash18 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
strings:
$s0 = "echo \"<option value=delete\".($dspact == \"delete\"?\" selected\":\"\").\">Delete</option>\";" fullword ascii
$s1 = "if (!is_readable($o)) {return \"<font color=red>\".view_perms(fileperms($o)).\"</font>\";}" fullword ascii
condition:
filesize < 900KB and all of them
}
rule Webshell_c99_4 {
meta:
description = "Detects C99 Webshell"
author = "Florian Roth"
reference = "https://github.com/nikicat/web-malware-collection"
date = "2016-01-11"
score = 70
hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
hash2 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
hash3 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
hash4 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
hash5 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
hash6 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
hash7 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
hash8 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
hash9 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
hash10 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
hash11 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
hash12 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
hash13 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
hash14 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
strings:
$s1 = "displaysecinfo(\"List of Attributes\",myshellexec(\"lsattr -a\"));" fullword ascii
$s2 = "displaysecinfo(\"RAM\",myshellexec(\"free -m\"));" fullword ascii
$s3 = "displaysecinfo(\"Where is perl?\",myshellexec(\"whereis perl\"));" fullword ascii
$s4 = "$ret = myshellexec($handler);" fullword ascii
$s5 = "if (posix_kill($pid,$sig)) {echo \"OK.\";}" fullword ascii
condition:
filesize < 900KB and 1 of them
}
rule Webshell_r57shell_2 {
meta:
description = "Detects Webshell R57"
author = "Florian Roth"
reference = "https://github.com/nikicat/web-malware-collection"
date = "2016-01-11"
score = 70
hash1 = "e46777e5f1ac1652db3ce72dd0a2475ea515b37a737fffd743126772525a47e6"
hash2 = "aa957ca4154b7816093d667873cf6bdaded03f820e84d8f1cd5ad75296dd5d4d"
hash3 = "aa957ca4154b7816093d667873cf6bdaded03f820e84d8f1cd5ad75296dd5d4d"
hash4 = "756b788401aad4bfd4dbafd15c382d98e3ba079390addb5b0cea7ff7f985f881"
hash5 = "756b788401aad4bfd4dbafd15c382d98e3ba079390addb5b0cea7ff7f985f881"
hash6 = "16b6ec4b80f404f4616e44d8c21978dcdad9f52c84d23ba27660ee8e00984ff2"
hash7 = "59105e4623433d5bf93b9e17d72a43a40a4d8ac99e4a703f1d8851ad1276cd88"
hash8 = "1db0549066f294f814ec14ba4e9f63d88c4460d68477e5895236173df437d2b8"
hash9 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
hash10 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
hash11 = "59ea6cf16ea06ff47cf0e6a398df2eaec4d329707b8c3201fc63cbf0b7c85519"
hash12 = "0e0227a0001b38fb59fc07749e80c9d298ff0e6aca126ea8f4ea68ebc9a3661f"
hash13 = "ef74644065925aa8d64913f5f124fe73d8d289d5f019a104bf5f56689f49ba92"
strings:
$s1 = "$connection = @ftp_connect($ftp_server,$ftp_port,10);" fullword ascii
$s2 = "echo $lang[$language.'_text98'].$suc.\"\\r\\n\";" fullword ascii
condition:
filesize < 900KB and all of them
}
rule Webshell_27_9_acid_c99_locus7s {
meta:
description = "Detects Webshell - rule generated from from files 27.9.txt, acid.php, c99_locus7s.txt"
author = "Florian Roth"
reference = "https://github.com/nikicat/web-malware-collection"
date = "2016-01-11"
score = 70
hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
hash3 = "960feb502f913adff6b322bc9815543e5888bbf9058ba0eb46ceb1773ea67668"
hash4 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
hash5 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
hash6 = "5ae121f868555fba112ca2b1a9729d4414e795c39d14af9e599ce1f0e4e445d3"
hash7 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
hash8 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
strings:
$s0 = "$blah = ex($p2.\" /tmp/back \".$_POST['backconnectip'].\" \".$_POST['backconnectport'].\" &\");" fullword ascii
$s1 = "$_POST['backcconnmsge']=\"</br></br><b><font color=red size=3>Error:</font> Can't backdoor host!</b>\";" fullword ascii
condition:
filesize < 1711KB and 1 of them
}
rule Webshell_Backdoor_PHP_Agent_r57_mod_bizzz_shell_r57 {
meta:
description = "Detects Webshell - rule generated from from files Backdoor.PHP.Agent.php, r57.mod-bizzz.shell.txt ..."
author = "Florian Roth"
reference = "https://github.com/nikicat/web-malware-collection"
date = "2016-01-11"
score = 70
hash1 = "e46777e5f1ac1652db3ce72dd0a2475ea515b37a737fffd743126772525a47e6"
hash2 = "f51a5c5775d9cca0b137ddb28ff3831f4f394b7af6f6a868797b0df3dcdb01ba"
hash3 = "16b6ec4b80f404f4616e44d8c21978dcdad9f52c84d23ba27660ee8e00984ff2"
hash4 = "59105e4623433d5bf93b9e17d72a43a40a4d8ac99e4a703f1d8851ad1276cd88"
hash5 = "6dc417db9e07420a618d44217932ca8baf3541c08d5e68281e1be10af4280e4a"
hash6 = "5d07fdfee2dc6d81da26f05028f79badd10dec066909932129d398627b2f4e94"
hash7 = "1db0549066f294f814ec14ba4e9f63d88c4460d68477e5895236173df437d2b8"
hash8 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
hash9 = "59ea6cf16ea06ff47cf0e6a398df2eaec4d329707b8c3201fc63cbf0b7c85519"
hash10 = "0e0227a0001b38fb59fc07749e80c9d298ff0e6aca126ea8f4ea68ebc9a3661f"
hash11 = "ef74644065925aa8d64913f5f124fe73d8d289d5f019a104bf5f56689f49ba92"
strings:
$s1 = "$_POST['cmd'] = which('" ascii
$s2 = "$blah = ex(" fullword ascii
condition:
filesize < 600KB and all of them
}
rule Webshell_c100 {
meta:
description = "Detects Webshell - rule generated from from files c100 v. 777shell"
author = "Florian Roth"
reference = "https://github.com/nikicat/web-malware-collection"
date = "2016-01-11"
score = 70
hash1 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
hash2 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
hash3 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
hash4 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
hash5 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
hash6 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
hash7 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
strings:
$s0 = "<OPTION VALUE=\"wget http://ftp.powernet.com.tr/supermail/debug/k3\">Kernel attack (Krad.c) PT1 (If wget installed)" fullword ascii
$s1 = "<center>Kernel Info: <form name=\"form1\" method=\"post\" action=\"http://google.com/search\">" fullword ascii
$s3 = "cut -d: -f1,2,3 /etc/passwd | grep ::" ascii
$s4 = "which wget curl w3m lynx" ascii
$s6 = "netstat -atup | grep IST" ascii
condition:
filesize < 685KB and 2 of them
}
rule Webshell_AcidPoison {
meta:
description = "Detects Poison Sh3ll - Webshell"
author = "Florian Roth"
reference = "https://github.com/nikicat/web-malware-collection"
date = "2016-01-11"
score = 70
hash1 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
hash3 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
hash4 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
hash5 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
hash6 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
hash7 = "be541cf880a8e389a0767b85f1686443f35b508d1975ee25e1ce3f08fa32cfb5"
hash8 = "be541cf880a8e389a0767b85f1686443f35b508d1975ee25e1ce3f08fa32cfb5"
hash9 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
hash10 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
strings:
$s1 = "elseif ( enabled(\"exec\") ) { exec($cmd,$o); $output = join(\"\\r\\n\",$o); }" fullword ascii
condition:
filesize < 550KB and all of them
}
rule Webshell_acid_FaTaLisTiCz_Fx_fx_p0isoN_sh3ll_x0rg_byp4ss_256 {
meta:
description = "Detects Webshell - rule generated from from files acid.php, FaTaLisTiCz_Fx.txt, fx.txt, p0isoN.sh3ll.txt, x0rg.byp4ss.txt"
author = "Florian Roth"
reference = "https://github.com/nikicat/web-malware-collection"
date = "2016-01-11"
score = 70
hash1 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
hash2 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
hash3 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
hash4 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
hash5 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
strings:
$s0 = "<form method=\"POST\"><input type=hidden name=act value=\"ls\">" fullword ascii
$s2 = "foreach($quicklaunch2 as $item) {" fullword ascii
condition:
filesize < 882KB and all of them
}
rule Webshell_Ayyildiz {
meta:
description = "Detects Webshell - rule generated from from files Ayyildiz Tim -AYT- Shell v 2.1 Biz.txt, Macker's Private PHPShell.php, matamu.txt, myshell.txt, PHP Shell.txt"
author = "Florian Roth"
reference = "https://github.com/nikicat/web-malware-collection"
date = "2016-01-11"
score = 70
hash1 = "0e25aec0a9131e8c7bd7d5004c5c5ffad0e3297f386675bccc07f6ea527dded5"
hash2 = "9c43aada0d5429f8c47595f79a7cdd5d4eb2ba5c559fb5da5a518a6c8c7c330a"
hash3 = "2ebf3e5f5dde4a27bbd60e15c464e08245a35d15cc370b4be6b011aa7a46eaca"
hash4 = "77a63b26f52ba341dd2f5e8bbf5daf05ebbdef6b3f7e81cec44ce97680e820f9"
hash5 = "61c4fcb6e788c0dffcf0b672ae42b1676f8a9beaa6ec7453fc59ad821a4a8127"
strings:
$s0 = "echo \"<option value=\\\"\". strrev(substr(strstr(strrev($work_dir), \"/\"), 1)) .\"\\\">Parent Directory</option>\\n\";" fullword ascii
$s1 = "echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>\\n\";" fullword ascii
condition:
filesize < 112KB and all of them
}
rule Webshell_zehir {
meta:
description = "Detects Webshell - rule generated from from files elmaliseker.asp, zehir.asp, zehir.txt, zehir4.asp, zehir4.txt"
author = "Florian Roth"
reference = "https://github.com/nikicat/web-malware-collection"
date = "2016-01-11"
score = 70
hash1 = "16e1e886576d0c70af0f96e3ccedfd2e72b8b7640f817c08a82b95ff5d4b1218"
hash2 = "0c5f8a2ed62d10986a2dd39f52886c0900a18c03d6d279207b8de8e2ed14adf6"
hash3 = "cb9d5427a83a0fc887e49f07f20849985bd2c3850f272ae1e059a08ac411ff66"
hash4 = "b57bf397984545f419045391b56dcaf7b0bed8b6ee331b5c46cee35c92ffa13d"
hash5 = "febf37a9e8ba8ece863f506ae32ad398115106cc849a9954cbc0277474cdba5c"
strings:
$s1 = "for (i=1; i<=frmUpload.max.value; i++) str+='File '+i+': <input type=file name=file'+i+'><br>';" fullword ascii
$s2 = "if (frmUpload.max.value<=0) frmUpload.max.value=1;" fullword ascii
condition:
filesize < 200KB and 1 of them
}
================================================
FILE: rules/xunjian.yar
================================================
/*
shuoshuren
2020.9.7
*/
include "./malware/MALW_BackdoorSSH.yar"
include "./malware/MALW_BlackRev.yar"
include "./malware/MALW_PE_sections.yar"
include "./webshells/WShell_APT_Laudanum.yar"
include "./webshells/WShell_ASPXSpy.yar"
include "./webshells/WShell_Drupalgeddon2_icos.yar"
include "./webshells/WShell_PHP_Anuna.yar"
include "./webshells/WShell_PHP_in_images.yar"
include "./webshells/WShell_THOR_Webshells.yar"
include "./utils/wget.yar"
include "./malware/ddg.yar"
include "./malware/h2miner.yar"
include "./malware/lsdminer.yar"
include "./malware/rainbowminer.yar"
include "./malware/skipmap.yar"
include "./malware/startminer.yar"
include "./malware/sysupdataminer.yar"
include "./malware/teamtnt.yar"
include "./malware/watchbogminer.yar"
================================================
FILE: whohk.py
================================================
# -*- coding:utf-8 -*- -
import os
import re
import time
import psutil
import yara
import sys
import socket
import struct
import prettytable as pt
import argparse
# 检查是否root运行
def checkroot():
if os.popen("whoami").read() != 'root\n':
print('[\033[1;33mwaring\033[0m]检测到当前为非root权限，部分功能可能受限哦~')
def system_state(): # 系统状态
cpu = '{}{}'.format(str(psutil.cpu_percent(1)), '%')
mem = '{}{}'.format(str(psutil.virtual_memory()[2]), '%')
disk = '{}{}'.format(psutil.disk_usage('/')[3], '%')
login=os.popen("who").read()
system_state = pt.PrettyTable()
system_state.field_names = ['CPU', 'MEM', 'DISK','ONLINE']
system_state.add_row([cpu, mem, disk,login.replace(' ',' ').replace(' ',' ')])
return system_state
########查外连模块#############
class CzIp: # 读取解析纯真IP数据库的类
def __init__(self, db_file='config/qqwry.dat'):
self.f_db = open(db_file, "rb")
bs = self.f_db.read(8)
(self.first_index, self.last_index) = struct.unpack('II', bs)
self.index_count = int((self.last_index - self.first_index) / 7 + 1)
self.cur_start_ip = None
self.cur_end_ip_offset = None
self.cur_end_ip = None
def _get_area_addr(self, offset=0):
if offset:
self.f_db.seek(offset)
bs = self.f_db.read(1)
(byte,) = struct.unpack('B', bs)
if byte == 0x01 or byte == 0x02:
p = self.getLong3()
if p:
return self.get_offset_string(p)
else:
return ""
else:
self.f_db.seek(-1, 1)
return self.get_offset_string(offset)
def _get_addr(self, offset):
'''
获取offset处记录区地址信息(包含国家和地区)
如果是中国ip，则是 "xx省xx市 xxxxx地区" 这样的形式
(比如:"福建省 电信", "澳大利亚 墨尔本Goldenit有限公司")
:param offset:
:return:str
'''
self.f_db.seek(offset + 4)
bs = self.f_db.read(1)
(byte,) = struct.unpack('B', bs)
if byte == 0x01: # 重定向模式1
country_offset = self.getLong3()
self.f_db.seek(country_offset)
bs = self.f_db.read(1)
(b,) = struct.unpack('B', bs)
if b == 0x02:
country_addr = self.get_offset_string(self.getLong3())
self.f_db.seek(country_offset + 4)
else:
country_addr = self.get_offset_string(country_offset)
area_addr = self._get_area_addr()
elif byte == 0x02: # 重定向模式2
country_addr = self.get_offset_string(self.getLong3())
area_addr = self._get_area_addr(offset + 8)
else: # 字符串模式
country_addr = self.get_offset_string(offset + 4)
area_addr = self._get_area_addr()
return country_addr + " " + area_addr
def dump(self, first, last):
'''
打印数据库中索引为first到索引为last(不包含last)的记录
:param first:
:param last:
:return:
'''
if last > self.index_count:
last = self.index_count
for index in range(first, last):
offset = self.first_index + index * 7
self.f_db.seek(offset)
buf = self.f_db.read(7)
(ip, of1, of2) = struct.unpack("IHB", buf)
address = self._get_addr(of1 + (of2 << 16))
def _set_ip_range(self, index):
offset = self.first_index + index * 7
self.f_db.seek(offset)
buf = self.f_db.read(7)
(self.cur_start_ip, of1, of2) = struct.unpack("IHB", buf)
self.cur_end_ip_offset = of1 + (of2 << 16)
self.f_db.seek(self.cur_end_ip_offset)
buf = self.f_db.read(4)
(self.cur_end_ip,) = struct.unpack("I", buf)
def get_addr_by_ip(self, ip):
'''
通过ip查找其地址
:param ip: (int or str)
:return: str
'''
if type(ip) == str:
ip = self.str2ip(ip)
L = 0
R = self.index_count - 1
while L < R - 1:
M = int((L + R) / 2)
self._set_ip_range(M)
if ip == self.cur_start_ip:
L = M
break
if ip > self.cur_start_ip:
L = M
else:
R = M
self._set_ip_range(L)
# version information, 255.255.255.X, urgy but useful
if ip & 0xffffff00 == 0xffffff00:
self._set_ip_range(R)
if self.cur_start_ip <= ip <= self.cur_end_ip:
address = self._get_addr(self.cur_end_ip_offset)
else:
address = "未找到该IP的地址"
return address
def get_ip_range(self, ip):
'''
返回ip所在记录的IP段
:param ip: ip(str or int)
:return: str
'''
if type(ip) == str:
ip = self.str2ip(ip)
self.get_addr_by_ip(ip)
range = self.ip2str(self.cur_start_ip) + ' - ' \
+ self.ip2str(self.cur_end_ip)
return range
def get_offset_string(self, offset=0):
'''
获取文件偏移处的字符串(以'\0'结尾)
:param offset: 偏移
:return: str
'''
if offset:
self.f_db.seek(offset)
bs = b''
ch = self.f_db.read(1)
(byte,) = struct.unpack('B', ch)
while byte != 0:
bs += ch
ch = self.f_db.read(1)
(byte,) = struct.unpack('B', ch)
return bs.decode('gbk')
def ip2str(self, ip):
'''
整数IP转化为IP字符串
:param ip:
:return:
'''
return str(ip >> 24) + '.' + str((ip >> 16) & 0xff) + '.' + str((ip >> 8) & 0xff) + '.' + str(ip & 0xff)
def str2ip(self, s):
'''
IP字符串转换为整数IP
:param s:
:return:
'''
(ip,) = struct.unpack('I', socket.inet_aton(s))
return ((ip >> 24) & 0xff) | ((ip & 0xff) << 24) | ((ip >> 8) & 0xff00) | ((ip & 0xff00) << 8)
def getLong3(self, offset=0):
'''
3字节的数值
:param offset:
:return:
'''
if offset:
self.f_db.seek(offset)
bs = self.f_db.read(3)
(a, b) = struct.unpack('HB', bs)
return (b << 16) + a
def network(): # 获取对外网络连接情况
addr_list = str(psutil.net_connections()).split('sconn')
iptb = pt.PrettyTable()
iptb.field_names = ['进程名', 'IP', '端口', 'PID', '归属地址']
for addr in addr_list:
try:
if re.findall(r'raddr', addr) != []: # 如果存在远程地址，就取出来
remote = addr.split('raddr')[-1]
local = addr.split('laddr')[-1]
ip = re.findall(r'ip=\'(.+?)\'', remote)[0]
port = re.findall(r'port=(.+?)\)', local)[0]
pid = re.findall(r'pid=(.+?)\)', remote)[0]
process = psutil.Process(int(pid)).name()
if ip != '127.0.0.1' and ip != '::1':
IP_addr = CzIp().get_addr_by_ip(ip)
iptb.add_row([process, ip, port, pid, IP_addr])
except:
pass
network = iptb
return network
################日志分析模块#####################
def ostype(): # 判断系统类型和版本
try:
os_info = os.popen("cat /proc/version").read()
sysnum = int(re.findall(r' (\d+?)\.', os_info, re.S)[0]) # 取出版本号
system = ''
try:
system = re.search('CentOS', os_info).group()
except:
pass
try:
system = re.search('Ubuntu', os_info).group()
except:
pass
try:
system = re.search('openSUSE', os_info).group()
except:
pass
try:
system = re.search('Red Hat', os_info).group()
except:
pass
try:
system = re.search('Debian', os_info).group()
except:
pass
except:
print('\033[1;33m提示：系统类型获取失败，请手动输入系统类型和版本号\033[0m')
print("\033[1;33m系统类型只能'CentOS'，'Ubuntu'，'openSUSE'，'Red Hat'，'Debian' 其中一个，注意空格和大小写，输入其他无效\033[0m")
print("\033[1;33m版本号请输入整数，如：6\033[0m")
system = input('系统类型：')
sysnum = int(input('版本号：'))
return system, sysnum
def pid_fileinfo(pid): # 根据pid获取进程路径等信息
fileinfo = os.popen("ls -all /proc/{} |grep \"exe ->\"".format(pid)).read()
return fileinfo
def log_burp_ip(system): # 定位有哪些IP在爆破
burp_ip = ""
if system == 'CentOS' or system == 'Red Hat':
burp_ip = os.popen(
"grep \"Failed\" /var/log/secure*|grep -E -o \"(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\"|uniq -c").read()
elif system == 'Ubuntu' or system == 'Debian':
burp_ip = os.popen(
"grep \"Failed\" /var/log/auth.log*|grep -E -o \"(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\"|uniq -c").read()
elif system == 'openSUSE':
burp_ip = os.popen(
"grep \"Failed\" /var/log/messages*|grep -E -o \"(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\"|uniq -c").read()
return burp_ip
def log_burp_user(system): # 被爆破用户名是什么
burp_user = ''
if system == 'CentOS' or system == 'Red Hat':
burp_user = os.popen(
"grep \"Failed\" /var/log/secure*|perl -e 'while($_=<>){ /for(.*?) from/; print \"$1\n\";}'|uniq -c|sort -nr").read()
elif system == 'Ubuntu' or system == 'Debian':
burp_user = os.popen(
"grep \"Failed\" /var/log/auth.log*|perl -e 'while($_=<>){ /for(.*?) from/; print \"$1\n\";}'|uniq -c|sort -nr").read()
elif system == 'openSUSE':
burp_user = os.popen(
"grep \"Failed\" /var/log/messages*|perl -e 'while($_=<>){ /for(.*?) from/; print \"$1\n\";}'|uniq -c|sort -nr").read()
return burp_user
def log_success_ip(system): # 登录成功的 IP 有哪些
success_ip = ''
if system == 'CentOS' or system == 'Red Hat':
success_ip = os.popen(
"grep \"Accepted \" /var/log/secure* | awk '{print $11}' | sort | uniq -c | sort -nr | more").read()
elif system == 'Ubuntu' or system == 'Debian':
success_ip = os.popen(
"grep \"Accepted \" /var/log/auth.log* | awk '{print $11}' | sort | uniq -c | sort -nr | more").read()
elif system == 'openSUSE':
success_ip = os.popen(
"grep \"Accepted \" /var/log/messages* | awk '{print $11}' | sort | uniq -c | sort -nr | more").read()
return success_ip
def log_success_info(system): # 登录成功的日期、用户名、IP
success_info = ''
if system == 'CentOS' or system == 'Red Hat':
success_info = os.popen("grep \"Accepted \" /var/log/secure* | awk '{print $1,$2,$3,$9,$11}'").read()
elif system == 'Ubuntu' or system == 'Debian':
success_info = os.popen("grep \"Accepted \" /var/log/auth.log* | awk '{print $1,$2,$3,$9,$11}'").read()
elif system == 'openSUSE':
success_info = os.popen("grep \"Accepted \" /var/log/messages* | awk '{print $1,$2,$3,$9,$11}'").read()
return success_info
def cron(): # 所有用户的定时任务
cmd = os.popen("cd /var/spool/cron && ls").read() # 直接到定时任务保存的位置看有没有
timingtask_list = re.split(r'\n', cmd)
del (timingtask_list[-1]) # 删除最后一个空值
if timingtask_list != []:
all_timingtask = ''
for user in timingtask_list:
path = "cat /var/spool/cron/{0}".format(user)
info = os.popen(path).read()
timingtask = '\033[1;33m用户【{0}】的定时任务有：\033[0m\n{1}\n'.format(user, info)
all_timingtask = all_timingtask + timingtask
else:
all_timingtask = '\033[1;33m没有定时任务\033[0m'
return all_timingtask
def cron_file(day): # 按时间检查crontab文件或脚本
cron.d = os.popen("find /etc/cron.d/ -mtime -{}".format(day)).read()
cron.hourly = os.popen("find /etc/cron.hourly/ -mtime -{}".format(day)).read()
cron.daily = os.popen("find /etc/cron.daily/ -mtime -{}".format(day)).read()
cron.weekly = os.popen("find /etc/cron.weekly/ -mtime -{}".format(day)).read()
cron.monthly = os.popen("find /etc/cron.monthly/ -mtime -{}".format(day)).read()
cron_file_output = "\033[1;33m------------------------------/etc/cron.d/-------------------------------\033[0m\n{}\n\033[1;33m---------------------------/etc/cron.hourly/-----------------------------\033[0m\n{}\n\033[1;33m----------------------------/etc/cron.daily/-----------------------------\033[0m\n{}\n\033[1;33m---------------------------/etc/cron.weekly/-----------------------------\033[0m\n{}\n\033[1;33m---------------------------/etc/cron.monthly/----------------------------\033[0m\n{}\n".format(
cron.d, cron.hourly, cron.daily, cron.weekly, cron.monthly)
return cron_file_output
def starup(day): # 按检查启动项
rc_local = os.popen("cat /etc/rc.local").read()
init_d = os.popen("find /etc/init.d/ -mtime -{}".format(day)).read()
rc0_d = os.popen("find /etc/rc0.d/ -mtime -{}".format(day)).read()
rc1_d = os.popen("find /etc/rc1.d/ -mtime -{}".format(day)).read()
rc2_d = os.popen("find /etc/rc2.d/ -mtime -{}".format(day)).read()
rc3_d = os.popen("find /etc/rc3.d/ -mtime -{}".format(day)).read()
rc4_d = os.popen("find /etc/rc4.d/ -mtime -{}".format(day)).read()
rc5_d = os.popen("find /etc/rc5.d/ -mtime -{}".format(day)).read()
rc6_d = os.popen("find /etc/rc6.d/ -mtime -{}".format(day)).read()
rc_d = os.popen("find /etc/init/rc.d/ -mtime -{}".format(day)).read()
starup_output = "\033[1;33m------------------------------/etc/rc.local------------------------------\033[0m\n{}\n\033[1;33m-------------------------------/etc/init.d/------------------------------\033[0m\n{}\n\033[1;33m-------------------------------/etc/rc0.d/-------------------------------\033[0m\n{}\n\033[1;33m-------------------------------/etc/rc1.d/-------------------------------\033[0m\n{}\n\033[1;33m-------------------------------/etc/rc2.d/-------------------------------\033[0m\n{}\n\033[1;33m-------------------------------/etc/rc3.d/-------------------------------\033[0m\n{}\n\033[1;33m-------------------------------/etc/rc4.d/-------------------------------\033[0m\n{}\n\033[1;33m-------------------------------/etc/rc5.d/-------------------------------\033[0m\n{}\n\033[1;33m-------------------------------/etc/rc6.d/-------------------------------\033[0m\n{}\n\033[1;33m-----------------------------/etc/init/rc.d/-----------------------------\033[0m\n".format(
rc_local, init_d, rc0_d, rc1_d, rc2_d, rc3_d, rc4_d, rc5_d, rc6_d, rc_d)
return starup_output
def osfile(day):#查看系统进程是否被劫持
osfile=os.popen("find /usr/bin/ /usr/sbin/ /bin/ /usr/local/bin/ -mtime -{}".format(day)).read()
return osfile
def changefile(all):#查看系统中指定类型文件的修改
changefile=os.popen("find {} -mtime -{} -name \"*.{}\"".format(all[0],all[1],all[2])).read()
return changefile
def permfile(all):#查看系统中指定权限的文件
permfile=os.popen("find {} -name \"*.{}\" -perm {}".format(all[0],all[1],all[2])).read()
return permfile
def account_check(): # 检查账户情况
account_list = []
cmd = os.popen("cat /etc/passwd | grep '/bin/bash'").read()
user_list = re.split(r'\n', cmd)[:-1]
result=''
for i in user_list:
user=re.findall('(.+?):',i)[0]
account_list.append(user)
user_info=os.popen("chage --list {}".format(user)).read().replace(' ','')
result+="\033[1;33m可登录的账户：\033[0m{0}\n\033[1;33m账户详情：\033[0m\n{1}\n".format(user,user_info)
anonymous_account = os.popen("awk -F: 'length($2)==0 {print $1}' /etc/shadow").read()
account = '{0}\n\033[1;33m空口令用户：\033[0m\n{1}\n'.format(result, anonymous_account)
return account_list,account
def history():
history=""
user_list=account_check()[0]
try:
for user in user_list:
if user!='root':
minggan=os.popen("cat /home/{}/.bash_history |grep -E \"wget|curl|http|rsync|sftp|ssh|scp|rcp|python|java|chmod|ftp|bash｜zip|tar\"".format(user)).read()
history+="\033[1;33m{}用户下的敏感历史命令：\033[0m\n{}\n".format(user,minggan)
else:
minggan = os.popen("cat /root/.bash_history |grep -E \"wget|curl|http|rsync|sftp|ssh|scp|rcp|python|java|chmod|ftp|bash｜zip|tar\"").read()
history += "\033[1;33m{}用户下的敏感历史命令：\033[0m\n{}\n".format(user, minggan)
except:
pass
return history
def webshell_scan(path):
webshell = pt.PrettyTable()
webshell.field_names = ['Path', 'LastChange']
webshell.align["Path"] = "l" # 路径字段靠右显示
rule = yara.compile(filepath=r'rules/webshell.yar')
print('\033[1;34m读取待检测文件中...\033[0m')
all = os.popen("find " + path).read().split('\n')
file_list = [] # 过滤后的文件列表
print('\033[1;32m读取完毕，开始过滤...\033[0m')
for file in all: # 过滤掉部分文件
try:
fsize = os.path.getsize(file) / float(1024 * 1024)
except:
fsize = 6
if fsize <= 5: # 只检测小于5M的文件
file_list.append(file)
print('\033[1;32m过滤完毕，开始扫描...\033[0m')
for i in range(len(file_list)):
sys.stdout.write('\033[K' + '\r')
print('\r','[{0}/{1}]检测中,耐心等待哦~'.format(str(i), str(len(file_list))),end=' ')
try:
with open(file_list[i], 'rb') as f:
matches = rule.match(data=f.read())
except:
matches = []
try:
if matches != []:
time_chuo = time.localtime(os.path.getmtime(file_list[i])) # 最后修改时间戳
lasttime = time.strftime("%Y--%m--%d %H:%M:%S", time_chuo) # 最后修改时间
warning = ('\033[1;31m\n告警：检测到标签{0}，文件位置{1}\033[0m'.format(matches, file_list[i]))
webshell.add_row([file_list[i], lasttime])
print(warning)
except:
pass
print('\033[1;32m\n所有文件扫描完成，结果如下：\n\033[0m')
print(webshell)
def file_scan(path):
webshell = pt.PrettyTable()
webshell.field_names = ['Path', 'LastChange']
webshell.align["Path"] = "l" # 路径字段靠右显示
rule = yara.compile(filepath=r'rules/xunjian.yar')
print('\033[1;34m读取待检测文件中...\033[0m')
all = os.popen("find " + path).read().split('\n')
file_list = [] # 过滤后的文件列表
print('\033[1;32m读取完毕，开始过滤...\033[0m')
for file in all: # 过滤掉部分文件
try:
fsize = os.path.getsize(file) / float(1024 * 1024)
except:
fsize = 6
if fsize <= 5: # 只检测小于5M的文件
file_list.append(file)
print('\033[1;32m过滤完毕，开始扫描...\033[0m')
for i in range(len(file_list)):
sys.stdout.write('\033[K' + '\r')
print('\r','[{0}/{1}]检测中,耐心等待哦~'.format(str(i), str(len(file_list))),end=' ')
try:
with open(file_list[i], 'rb') as f:
matches = rule.match(data=f.read())
except:
matches = []
try:
if matches != []:
time_chuo = time.localtime(os.path.getmtime(file_list[i])) # 最后修改时间戳
lasttime = time.strftime("%Y--%m--%d %H:%M:%S", time_chuo) # 最后修改时间
warning = ('\033[1;31m\n告警：检测到标签{0}，文件位置{1}\033[0m'.format(matches, file_list[i]))
webshell.add_row([file_list[i], lasttime])
print(warning)
except:
pass
print('\033[1;32m\n所有文件扫描完成，结果如下：\n\033[0m')
print(webshell)
################################################
parser = argparse.ArgumentParser(description='本工具可帮你快速定位很多关键问题，将化复杂繁琐的命令为简单。\n应急响应工具为辅，但不要只依赖于工具哦')
parser.add_argument("-user", action='store_true',help='用于查看系统可登录账户和空口令账户（无参数）')
parser.add_argument("-history", action='store_true',help='用于查看所有用户的敏感历史命令（无参数）')
parser.add_argument("-cron", action='store_true',help='用于查看所有用户的定时任务（无参数）')
parser.add_argument("-ip", action='store_true',help='用于查看外连ip（无参数）')
parser.add_argument("--pid", type=str,metavar='1234',help='用于定位进程物理路径（参数为pid号）')
parser.add_argument("--ssh-fip", action='store_true',help='用于查看ssh登录失败的ip和次数（无参数）')
parser.add_argument("--ssh-fuser", action='store_true',help='用于查看ssh登录失败的用户和次数（无参数）')
parser.add_argument("--ssh-sip", action='store_true',help='用于查看ssh登录成功的ip和次数（无参数）')
parser.add_argument("--ssh-sinfo", action='store_true',help='用于查看ssh登录成功的用户详情（无参数）')
parser.add_argument("--file-cron", type=str,metavar='7',help='用于查看系统各个级别定时任务目录中，n天内被修改的文件（参数为天数）')
parser.add_argument("--file-starup", type=str,metavar='7',help='用于查看系统启动项目录中，n天内被修改的文件（参数为天数）')
parser.add_argument("--file-os", type=str,metavar='7',help='用于查看系统重要目录中，n天内被修改的文件（参数为天数）')
parser.add_argument("--file-change", nargs=3,metavar=('/www', '7', 'php'),help='用于查看在n天内指定目录中指定后缀的被修改的文件（参数为物理路径、天数、后缀）')
parser.add_argument("--file-perm", nargs=3,metavar=('/www', 'jsp', '777'),help='用于查看指定目录下指定后缀指定权限的文件（参数为物理路径、后缀、天数）')
parser.add_argument("--s-backdoor", type=str,metavar='/home',help='用于检测指定路径下的恶意样本（参数为物理路径）')
parser.add_argument("--s-webshell", type=str,metavar='/var/www',help='用于检测指定路径下的webshell（参数为物理路径）')
args = parser.parse_args()
sys_tup = ostype() # 判断系统类型
system = sys_tup[0]
sysnum = sys_tup[1]
banner = '''\033[1;34m
██╗ ██╗██╗ ██╗ ██████╗ ██████╗ ██╗ ██╗██╗ ██╗
██║ ██║██║ ██║██╔═══██╗╚════██╗██║ ██║██║ ██╔╝
██║ █╗ ██║███████║██║ ██║ ▄███╔╝███████║█████╔╝
██║███╗██║██╔══██║██║ ██║ ▀▀══╝ ██╔══██║██╔═██╗
╚███╔███╔╝██║ ██║╚██████╔╝ ██╗ ██║ ██║██║ ██╗
╚══╝╚══╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝
公众号：台下言书 作者：说书人 版本：v1.1\033[0m
\033[1;36m-------------------------------系统信息----------------------------------\033[0m
{}
\033[1;36m-------------------------------output------------------------------------\033[0m
'''.format(system_state())
print(banner)
checkroot()
if args.ip:
print(network())
elif args.pid:
print(pid_fileinfo(args.pid))
elif args.ssh_fip:
print(log_burp_ip(system))
elif args.ssh_fuser:
print(log_burp_user(system))
elif args.ssh_sip:
print(log_success_ip(system))
elif args.ssh_sinfo:
print(log_success_info(system))
elif args.cron:
print(cron())
elif args.file_cron:
print(cron_file(args.file_cron))
elif args.file_starup:
print(starup(args.file_starup))
elif args.file_os:
print(osfile(args.file_os))
elif args.file_change:
print(changefile(args.file_change))
elif args.file_perm:
print(permfile(args.file_perm))
elif args.user:
print(account_check()[1])
elif args.history:
print(history())
elif args.s_backdoor:
file_scan(args.s_backdoor)
elif args.s_webshell:
webshell_scan(args.s_webshell)
else:
print("\033[1;33m可以带上参数 -h 或者 --help 来查看工具使用说明哦~\033[0m")
print("\033[1;36m-------------------------------------------------------------------------\033[0m") | 
在linux下的应急响应往往需要通过繁琐的命令行来查看各个点的情况，有的时候还需要做一些格式处理，这对于linux下命令不是很熟悉的人比较不友好。本工具将linux下应急响应中常用的一些操作给集合了起来，并处理成了较为友好的格式，只需要通过一个参数就能代替繁琐复杂的命令来实现对各个点的检查。
支持主流的Linux，包含centos、redhat、ubuntu、debian、opensuse。
## 使用指南
```
optional arguments:
-h, --help show this help message and exit
-user 用于查看系统可登录账户和空口令账户（无参数）
-history 用于查看所有用户的敏感历史命令（无参数）
-cron 用于查看所有用户的定时任务（无参数）
-ip 用于查看外连ip（无参数）
--pid 1234 用于定位进程物理路径（参数为pid号）
--ssh-fip 用于查看ssh登录失败的ip和次数（无参数）
--ssh-fuser 用于查看ssh登录失败的用户和次数（无参数）
--ssh-sip 用于查看ssh登录成功的ip和次数（无参数）
--ssh-sinfo 用于查看ssh登录成功的用户详情（无参数）
--file-cron 7 用于查看系统各个级别定时任务目录中，n天内被修改的文件（参数为天数）
--file-starup 7 用于查看系统启动项目录中，n天内被修改的文件（参数为天数）
--file-os 7 用于查看系统重要目录中，n天内被修改的文件（参数为天数）
--file-change /www 7 php
用于查看在n天内指定目录中指定后缀的被修改的文件（参数为物理路径、天数、后缀）
--file-perm /www jsp 777
用于查看指定目录下指定后缀指定权限的文件（参数为物理路径、后缀、天数）
--s-backdoor /home 用于检测指定路径下的恶意样本（参数为物理路径）
--s-webshell /var/www
用于检测指定路径下的webshell（参数为物理路径）
```
## 细节
由于懒得重新截图，所以就直接放公众号之前发的图了
- whohk，一款强大的linux应急响应辅助工具：[点击跳转](https://mp.weixin.qq.com/s?__biz=MzIyNDkwNjQ5Ng==&mid=2247484224&idx=1&sn=616be624b7936abef282c5611f710a6a&chksm=e8069f2fdf71163973a712de55de80b042fb6224fa9179b4a655b5fe2e5be647f63d7f038e60&token=1653316416&lang=zh_CN#rd)
- [更新]Linux下应急响应工具whohk v1.1版本：[点击跳转](https://mp.weixin.qq.com/s?__biz=MzIyNDkwNjQ5Ng==&mid=2247485371&idx=1&sn=8f6a32e28bf06e100edcd9241a8923e4&chksm=e8069bd4df7112c28a416e740b6025982d1d4a920906f9e3aa2f6244c5a691af6cf9a96bb55d#rd)
- 如何打造一款自己的恶意样本检测工具：[点击跳转](https://mp.weixin.qq.com/s?__biz=MzIyNDkwNjQ5Ng==&mid=2247484475&idx=1&sn=7180cb7a18335c71ef561f9ec468f601&chksm=e8069854df7111425708634704d07832764f02545065717fd45424abb960938cbc121a417eb5&token=393884268&lang=zh_CN#rd)
## 碎碎念
- 2020-09-21
> 在历次的Linux系统下应急中感受到了敲命令的繁琐，以及有些太长记不住的命令当着客户面去百度的尴尬，决定把Linux下应急检查的一些点的命令用工具来集合到一起。在这个工具之前其实还做过一个windows/Linux系统下的安全巡检小工具，但由于对我的工作意义不大，所以最后经过一顿操作，有了`whohk`这一款小工具。
- 2021-08-26
> 在过去的近一年里应急的次数不那么频繁了，基本无视这个工具。不过有一次登录公众号后，发现有一些粉丝私信提新功能以及反馈了一些问题（原谅我半年登一次公众号），所以这次根据之前的反馈，进行了一些更新。
- 2022-04-30
> 发现这个工具居然成为了我GitHub stars最多的一个项目，或许真的帮助到了一些人。
> 决定开源。代码写的很简单，也可以说比较烂，本次上传的是2021.08.26的版本，也是目前最新版（因为只要没有新的需求就不会更新，以及我~~没有时间~~懒也不会更新🐶）。
>
> ~~不会摆烂。目前有一些新的想法，但是很模糊，大家有好的建议欢迎提issue。~~ 摆烂中...
## TODO
- [ ] 重构，代码写的优雅点
- [ ] Windows支持
- [ ] server端
- [ ] 多台主机数据聚合分析
## 交流
================================================
FILE: rules/malware/MALW_BackdoorSSH.yar
================================================
/*
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
rule SSH_backdoor
{
meta:
description = "Custome SSH backdoor based on python and paramiko - file server.py"
author = "Florian Roth"
reference = "https://goo.gl/S46L3o"
date = "2015-05-14"
hash = "0953b6c2181249b94282ca5736471f85d80d41c9"
strings:
$s0 = "command= raw_input(\"Enter command: \").strip('n')" fullword ascii
$s1 = "print '[-] (Failed to load moduli -- gex will be unsupported.)'" fullword ascii
$s2 = "print '[-] Listen/bind/accept failed: ' + str(e)" fullword ascii
$s3 = "chan.send(command)" fullword ascii
$s4 = "print '[-] SSH negotiation failed.'" fullword ascii
$s5 = "except paramiko.SSHException, x:" fullword ascii
condition:
filesize < 10KB and 5 of them
}
================================================
FILE: rules/malware/MALW_BlackRev.yar
================================================
/*
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as
long as you use it under this license.
*/
rule BlackRev_BotNet
{
meta:
author = "Dennis Schwarz"
date = "2013-05-21"
description = "Black Revolution DDoS Malware. http://www.arbornetworks.com/asert/2013/05/the-revolution-will-be-written-in-delphi/"
origin = "https://github.com/arbor/yara/blob/master/blackrev.yara"
strings:
$base1 = "http"
$base2 = "simple"
$base3 = "loginpost"
$base4 = "datapost"
$opt1 = "blackrev"
$opt2 = "stop"
$opt3 = "die"
$opt4 = "sleep"
$opt5 = "syn"
$opt6 = "udp"
$opt7 = "udpdata"
$opt8 = "icmp"
$opt9 = "antiddos"
$opt10 = "range"
$opt11 = "fastddos"
$opt12 = "slowhttp"
$opt13 = "allhttp"
$opt14 = "tcpdata"
$opt15 = "dataget"
condition:
all of ($base*) and 5 of ($opt*)
}
================================================
FILE: rules/malware/MALW_PE_sections.yar
================================================
/*
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
import "pe"
rule packered : packer PE {
meta:
author = "@j0sm1"
date = "2016/10/21"
description = "The packer/protector section names/keywords"
reference = "http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/"
filetype = "binary"
strings:
$s1 = ".aspack" wide ascii
$s2 = ".adata" wide ascii
$s3 = "ASPack" wide ascii
$s4 = ".ASPack" wide ascii
$s5 = ".ccg" wide ascii
$s6 = "BitArts" wide ascii
$s7 = "DAStub" wide ascii
$s8 = "!EPack" wide ascii
$s9 = "FSG!" wide ascii
$s10 = "kkrunchy" wide ascii
$s11 = ".mackt" wide ascii
$s12 = ".MaskPE" wide ascii
$s13 = "MEW" wide ascii
$s14 = ".MPRESS1" wide ascii
$s15 = ".MPRESS2" wide ascii
$s16 = ".neolite" wide ascii
$s17 = ".neolit" wide ascii
$s18 = ".nsp1" wide ascii
$s19 = ".nsp2" wide ascii
$s20 = ".nsp0" wide ascii
$s21 = "nsp0" wide ascii
$s22 = "nsp1" wide ascii
$s23 = "nsp2" wide ascii
$s24 = ".packed" wide ascii
$s25 = "pebundle" wide ascii
$s26 = "PEBundle" wide ascii
$s27 = "PEC2TO" wide ascii
$s28 = "PECompact2" wide ascii
$s29 = "PEC2" wide ascii
$s30 = "pec1" wide ascii
$s31 = "pec2" wide ascii
$s32 = "PEC2MO" wide ascii
$s33 = "PELOCKnt" wide ascii
$s34 = ".perplex" wide ascii
$s35 = "PESHiELD" wide ascii
$s36 = ".petite" wide ascii
$s37 = "ProCrypt" wide ascii
$s38 = ".RLPack" wide ascii
$s39 = "RCryptor" wide ascii
$s40 = ".RPCrypt" wide ascii
$s41 = ".sforce3" wide ascii
$s42 = ".spack" wide ascii
$s43 = ".svkp" wide ascii
$s44 = "Themida" wide ascii
$s45 = ".Themida" wide ascii
$s46 = ".packed" wide ascii
$s47 = ".Upack" wide ascii
$s48 = ".ByDwing" wide ascii
$s49 = "UPX0" wide ascii
$s50 = "UPX1" wide ascii
$s51 = "UPX2" wide ascii
$s52 = ".UPX0" wide ascii
$s53 = ".UPX1" wide ascii
$s54 = ".UPX2" wide ascii
$s55 = ".vmp0" wide ascii
$s56 = ".vmp1" wide ascii
$s57 = ".vmp2" wide ascii
$s58 = "VProtect" wide ascii
$s59 = "WinLicen" wide ascii
$s60 = "WWPACK" wide ascii
$s61 = ".yP" wide ascii
$s62 = ".y0da" wide ascii
$s63 = "UPX!" wide ascii
condition:
// DOS stub signature PE signature
uint16(0) == 0x5a4d and uint32be(uint32(0x3c)) == 0x50450000 and (
for any of them : ( $ in (0..1024) )
)
}
================================================
FILE: rules/malware/ddg.yar
================================================
// ddg脚本通配规则
rule linux_miner_ddg_script_gen
{
meta:
description = "ddg shell script general"
author = "G4rb3n"
reference = "https://blog.netlab.360.com/ddg-a-mining-botnet-aiming-at-database-server"
date = "2020-5-13"
strings:
$s1 = "/i.sh"
$s2 = "/ddgs"
$c1 = "/var/spool/cron/root"
$c2 = "crontab -"
condition:
( filesize < 50KB ) and ( all of ($s*) ) and ( 1 of ($c*) )
}
// v5000以上版本的规则
rule linux_miner_ddg_script_v5
{
meta:
description = "ddg shell script v5000+"
author = "G4rb3n"
reference = "https://blog.netlab.360.com/ddg-upgrade-to-new-p2p-hybrid-model"
date = "2020-5-13"
url = "http://67.205.168.20:8000/i.sh"
md5_v5023 = "FE0D7BCF06779EF0CC6702FBB7C330E7"
md5_v5019 = "D6F402F6DCB75EA1A81A7C596CDA50C5"
strings:
$s1 = "/i.sh"
$s2 = /\/50[0-9]{2}\/ddgs.+/
$c1 = "/var/spool/cron/root"
$c2 = "crontab -"
condition:
( filesize < 50KB ) and ( all of ($s*) ) and ( 1 of ($c*) )
}
================================================
FILE: rules/malware/h2miner.yar
================================================
// H2Miner脚本通配规则
rule linux_miner_h2miner_script_gen
{
meta:
description = "h2miner script general"
author = "G4rb3n"
reference = "https://mp.weixin.qq.com/s/iNq8SdTZ9IrttAoQYLJw5A"
date = "2020-7-31"
md5_2001 = "A626C7274F51C55FDFF1F398BB10BAD5"
md5_2005 = "E600632DA9A710BBA3C53C1DFDD7BAC1"
md5_2007 = "BE17040E1A4EAF7E2DF8C0273FF2DFD2"
md5_2008 = "69886742CF56F9FC97B97DF0A19FC8F0"
strings:
$s1 = "echo \"P OK\""
$s2 = "echo \"T DIR $DIR\""
$s3 = "echo \"No md5sum\""
$s4 = "echo \"P NOT EXISTS\""
$s5 = "case $sum in"
$x1 = "ulimit -n 65535"
$x2 = "https://bitbucket.org"
$c1 = "kingsing"
$c2 = "salt-store"
$c3 = "195.3.146.118"
$c4 = "217.12.210.192"
condition:
( filesize < 50KB ) and ( ( 4 of ($s*) ) and ( ( 2 of ($x*) ) or ( 2 of ($c*) ) ) )
}
================================================
FILE: rules/malware/lsdminer.yar
================================================
// LSDMiner脚本通配规则
rule linux_miner_lsdminer_script_gen
{
meta:
description = "lsdminer script general"
author = "G4rb3n"
reference = "https://www.anquanke.com/post/id/193116"
date = "2020-5-21"
strings:
$s1 = "hwlh3wlh44lh"
$s2 = "Circle_MI"
$s3 = "thyrsi.com"
$s4 = "img.sobot.com"
$s5 = "cdn.xiaoduoai.com"
$s6 = "res.cloudinary.com"
$s7 = "pastebin.com"
$s8 = "user-images.githubusercontent.com"
condition:
( filesize < 50KB ) and ( 4 of ($s*) )
}
================================================
FILE: rules/malware/rainbowminer.yar
================================================
// StartMiner脚本通配规则
rule linux_miner_rainbowminer_script_gen
{
meta:
description = "rainbowminer script general"
author = "G4rb3n"
reference = "https://mp.weixin.qq.com/s/KUK2hW7oRA2hN_cJ5QaYUA"
date = "2020-5-21"
strings:
$s1 = "=\"/lib64/"
$s2 = "pdflushType=\""
$s3 = "kthreadds"
$s4 = "processhider"
$s5 = "paDKiUwmHNUSW7E1S18Cl" // ssh公钥片段
$s6 = "cron.py"
$s7 = "/pdflushs"
$x1 = "Rainbow66"
$x2 = "47.106.187.104"
condition:
( filesize < 50KB ) and ( ( 4 of ($s*) ) or ( 1 of ($x*) ) )
}
================================================
FILE: rules/malware/skipmap.yar
================================================
// SkipMap脚本通配规则
rule linux_miner_skipmap_script_gen
{
meta:
description = "skipmap shell script general"
author = "G4rb3n"
reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload"
date = "2020-8-7"
strings:
$s1 = "chmod +x /var/lib/"
$s2 = "/bin/get"
$s3 = "/bin/cur"
$c1 = "pm.ipfswallet.tk"
$c2 = "a.powerofwish.com"
condition:
( filesize < 10KB ) and ( all of ($s*) ) and ( 1 of ($c*) )
}
================================================
FILE: rules/malware/startminer.yar
================================================
// StartMiner脚本通配规则
rule linux_miner_startminer_script_gen
{
meta:
description = "startminer script general"
author = "G4rb3n"
reference = "https://s.tencent.com/research/report/978.html"
date = "2020-5-20"
strings:
$s1 = "echo \"P OK\""
$s2 = "echo \"T DIR $DIR\""
$s3 = "echo \"No md5sum\""
$s4 = "echo \"P NOT EXISTS\""
$s5 = "case $sum in"
$x1 = "f2=\""
$x2 = "downloadIfNeed()"
$x3 = "judge()"
$x4 = "judge2()"
$x5 = "start.jpg"
$c1 = "jukesxdbrxd.xyz"
$c2 = "37.44.212.223"
$c3 = "107.189.11.170"
condition:
( filesize < 50KB ) and ( ( 4 of ($s*) ) and ( ( 2 of ($x*) ) or ( 1 of ($c*) ) ) )
}
================================================
FILE: rules/malware/sysupdataminer.yar
================================================
// SysUpdataMiner脚本通配规则
rule linux_miner_sysupdataminer_script_gen
{
meta:
description = "sysupdataminer script general"
author = "G4rb3n"
reference = "https://www.freebuf.com/articles/system/172987.html"
date = "2020-6-4"
strings:
$s1 = "miner_url"
$s2 = "miner_size"
$s3 = "sh_url"
$s4 = "config_url"
$s5 = "config_size"
$s6 = "scan_url"
$s7 = "scan_size"
$s8 = "watchdog_url"
$s9 = "watchdog_size"
$x1 = "/etc/update.sh"
$x2 = "/etc/sysupdate"
$x3 = "/etc/networkservice"
$x4 = "/usr/bin/cur" fullword ascii
$x5 = "/usr/bin/wge" fullword ascii
$c1 = "185.181.10.234"
$c2 = "de.gsearch.com.de"
$c3 = "AAAAB3NzaC1yc2EAAAADAQABAAABAQC9WKiJ7yQ6HcafmwzDMv1RKxPdJI"
condition:
( filesize < 50KB ) and ( ( ( 3 of ($s*) ) or ( 2 of ($x*) ) ) and ( 2 of ($c*) ) )
}
================================================
FILE: rules/malware/teamtnt.yar
================================================
// TeamTNT脚本通配规则
rule linux_miner_teamtnt_script_gen
{
meta:
description = "teamtnt shell script general"
author = "G4rb3n"
reference = "https://x.threatbook.cn/nodev4/vb4/article?threatInfoID=2813"
date = "2020-8-8"
md5_2008 = "BE5B1BE30CF430AF6F76776FEBE805F2"
md5_2009 = "856109FAFF327638BA3A8EC5800E988C"
strings:
$s1 = "LDR=\"wget -q -O -\""
$s2 = "LDR=\"curl\""
$s3 = "echo \"cron good\""
$s4 = "echo \"setup cron\""
$s5 = "downloadxmin()"
$s6 = "startxmin()"
$s7 = "setupmyapps()"
$s8 = "loadthisfile()"
$s9 = "uploadthersa()"
$s10 = "getsomelanssh()"
$s11 = "localgo()"
$c1 = "85.214.149.236"
condition:
( filesize < 10KB ) and ( 2 of ($s*) ) and ( 1 of ($c*) )
}
================================================
FILE: rules/malware/watchbogminer.yar
================================================
// WatchBogMiner脚本通配规则
rule linux_miner_watchbogminer_script_gen
{
meta:
description = "watchbogminer shell script general"
author = "G4rb3n"
reference = "https://s.tencent.com/research/report/1056.html"
date = "2020-8-17"
strings:
$s1 = "pastebin.com"
$s2 = "kill_miner_proc()"
$s3 = "gettarfile()"
$s4 = "base -d"
$c1 = "UhUmR517"
$c2 = "/JavaUpdates"
$c3 = "tmpdropoff"
condition:
( filesize < 50KB ) and ( 2 of ($s*) ) and ( 2 of ($c*) )
}
================================================
FILE: rules/utils/wget.yar
================================================
rule wget {
meta:
author = "yiansec"
strings:
$url_regex = /wget https?:\/\// wide ascii
condition:
$url_regex
}
================================================
FILE: rules/webshell.yar
================================================
/*
yiansec
2020.5.1
*/
include "./webshells/WShell_APT_Laudanum.yar"
include "./webshells/WShell_ASPXSpy.yar"
include "./webshells/WShell_Drupalgeddon2_icos.yar"
include "./webshells/WShell_PHP_Anuna.yar"
include "./webshells/WShell_PHP_in_images.yar"
include "./webshells/WShell_THOR_Webshells.yar"
include "./webshells/WShell_Behinder.yar"
================================================
FILE: rules/webshells/WShell_APT_Laudanum.yar
================================================
/*
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
rule asp_file : webshell {
meta:
description = "Laudanum Injector Tools - file file.asp"
author = "Florian Roth"
reference = "http://laudanum.inguardians.com/"
date = "2015-06-22"
hash = "ff5b1a9598735440bdbaa768b524c639e22f53c5"
strings:
$s1 = "' *** Written by Tim Medin