| Current Path : /proc/2/root/usr/local/scan/lw-yara/includes/ |
| Current File : //proc/2/root/usr/local/scan/lw-yara/includes/yertle.yar |
/*
Yara Rule Set
Author: Brian Laskowski
Date: 2018-07-28
Identifier: yertle
Reference: https://github.com/Hestat/lw-yara
*/
/* Rule Set ----------------------------------------------------------------- */
rule yertle_yertle {
meta:
description = "yertle - file yertle.php"
author = "Brian Laskowski"
reference = "https://github.com/Hestat/lw-yara"
date = "2018-07-28"
hash1 = "2031cea1ee6be78abc632b7be0b4ef3c180da44d601348543db408b68b0ec4d6"
strings:
$s1 = "// Copied and modified from https://github.com/leonjza/wordpress-shell" fullword ascii
$s2 = "Author URI: https://github.com/n00py" fullword ascii
$s3 = "Description: This is a backdoor PHP shell designed to be used with the Yertle script from WPForce." fullword ascii
$s4 = "Plugin URI: https://github.com/n00py" fullword ascii
$s5 = "$command = substr($command, 0, -1);" fullword ascii
$s6 = "Plugin Name: Yertle Interactive Shell" fullword ascii
$s7 = "call_user_func_array('system', array($command));" fullword ascii
$s8 = "$command = base64_decode($command);" fullword ascii
$s9 = "call_user_func('system', $command);" fullword ascii
$s10 = "$command = $_GET[\"cmd\"];" fullword ascii
$s11 = "system($command);" fullword ascii
$s12 = "$thingy = $function->invoke($command );" fullword ascii
$s13 = "$function = new ReflectionFunction('system');" fullword ascii
condition:
( uint16(0) == 0x3f3c and
filesize < 2KB and
( 8 of them )
) or ( all of them )
}
rule yertle_r {
meta:
description = "yertle - file yertle-r.php"
author = "Brian Laskowski"
reference = "https://github.com/Hestat/lw-yara"
date = "2018-07-28"
hash1 = "527d3b0ede0780c48098c4bd43c266ca91c6bd417c7144ef898fa1326292130b"
strings:
$s1 = "$shell = 'uname -a; w; id; python -c \\'import pty;pty.spawn(\"/bin/bash\")\\'';" fullword ascii
$s2 = "// See http://pentestmonkey.net/tools/php-reverse-shell if you get stuck." fullword ascii
$s3 = "Description: This spawns a backdoor PHP reverse shell designed to be used with the Yertle script from WPForce." fullword ascii
$s4 = "// This script will make an outbound TCP connection to a hardcoded IP and port." fullword ascii
$s5 = "printit(\"ERROR: Shell process terminated\");" fullword ascii
$s6 = "// php-reverse-shell - A Reverse Shell implementation in PHP" fullword ascii
$s7 = "$process = proc_open($shell, $descriptorspec, $pipes);" fullword ascii
$s8 = "printit(\"Successfully opened reverse shell to $ip:$port\");" fullword ascii
$s9 = "// Spawn shell process" fullword ascii
$s10 = "// The recipient will be given a shell running as the current user (apache normally)." fullword ascii
$s11 = "Author URI: https://github.com/n00py" fullword ascii
$s12 = "printit(\"ERROR: Shell connection terminated\");" fullword ascii
$s13 = "// Make the current process a session leader" fullword ascii
$s14 = "// Use of stream_select() on file descriptors returned by proc_open() will fail and return FALSE under Windows." fullword ascii
$s15 = "0 => array(\"pipe\", \"r\"), // stdin is a pipe that the child will read from" fullword ascii
$s16 = "// This tool may be used for legal purposes only. Users take full responsibility" fullword ascii
$s17 = "Plugin URI: https://github.com/n00py" fullword ascii
$s18 = "Plugin Name: Yertle Reverse Shell" fullword ascii
$s19 = "// Some compile-time options are needed for daemonisation (like pcntl, posix). These are rarely available." fullword ascii
$s20 = "printit(\"WARNING: Failed to daemonise. This is quite common and not fatal.\");" fullword ascii
condition:
( uint16(0) == 0x3f3c and
filesize < 20KB and
( 8 of them )
) or ( all of them )
}
rule leonjzashell {
meta:
description = "yertle - file leonjzashell.php"
author = "Brian Laskowski"
reference = "https://github.com/Hestat/lw-yara"
date = "2018-07-28"
hash1 = "5f01b6d93673c9d1673aea513c51688b54e1c8c5c31e9770f6530c4dfdbc87dd"
strings:
$x1 = "Description: Execute Commands as the webserver you are serving wordpress with! Shell will probably live at /wp-content/plugi" fullword ascii
$x2 = "Description: Execute Commands as the webserver you are serving wordpress with! Shell will probably live at /wp-content/plugins/s" ascii
$s3 = "ns/shell/shell.php. Commands can be given using the 'cmd' GET parameter. Eg: \"http://192.168.0.1/wp-content/plugins/shell/shell" ascii
$s4 = "Plugin URI: https://github.com/leonjza/wordpress-shell" fullword ascii
$s5 = "# grab the command we want to run from the 'cmd' GET parameter" fullword ascii
$s6 = "# Try to find a way to run our command using various PHP internals" fullword ascii
$s7 = "# http://php.net/manual/en/function.system.php" fullword ascii
$s8 = "php?cmd=id\", should provide you with output such as <code>uid=33(www-data) gid=verd33(www-data) groups=33(www-data)</code>" fullword ascii
$s9 = "# http://php.net/manual/en/function.call-user-func-array.php" fullword ascii
$s10 = "call_user_func_array('system', array($command));" fullword ascii
$s11 = "# attempt to protect myself from deletion" fullword ascii
$s12 = "# http://php.net/manual/en/function.call-user-func.php" fullword ascii
$s13 = "call_user_func('system', $command);" fullword ascii
$s14 = "$command = $_GET[\"cmd\"];" fullword ascii
$s15 = "Plugin Name: Cheap & Nasty Wordpress Shell" fullword ascii
$s16 = "system($command);" fullword ascii
$s17 = "# http://php.net/manual/en/class.reflectionfunction.php" fullword ascii
$s18 = "# has system() on a blacklist anyways :>" fullword ascii
$s19 = "$function->invoke($command);" fullword ascii
$s20 = "Author URI: https://leonjza.github.io" fullword ascii
condition:
( uint16(0) == 0x3f3c and
filesize < 4KB and
( 1 of ($x*) and 4 of them )
) or ( all of them )
}
/* Super Rules ------------------------------------------------------------- */
Copyright 2K16 - 2K18 Indonesian Hacker Rulez
;?>)