377 lines
17 KiB
Text
377 lines
17 KiB
Text
/*
|
|
Yara Rule Set
|
|
Author: Florian Roth
|
|
Date: 2015-06-23
|
|
Identifier: CN-PentestSet
|
|
*/
|
|
|
|
rule CN_Honker_mafix_root {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file root"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "826778ef9c22177d41698b467586604e001fed19"
|
|
id = "ae08b2e9-4d81-5f15-88d2-e2ace20626bf"
|
|
strings:
|
|
$s0 = "echo \"# vbox (voice box) getty\" >> /tmp/.init1" fullword ascii /* PEStudio Blacklist: strings */
|
|
$s1 = "cp /var/log/tcp.log $HOMEDIR/.owned/bex2/snifflog" fullword ascii
|
|
$s2 = "if [ -f /sbin/xlogin ]; then" fullword ascii /* PEStudio Blacklist: strings */
|
|
condition:
|
|
filesize < 96KB and all of them
|
|
}
|
|
|
|
rule CN_Honker_passwd_dict_3389 {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file 3389.txt"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "2897e909e48a9f56ce762244c3a3e9319e12362f"
|
|
id = "9418f0e5-7bf0-5df3-8857-dea90fae5a54"
|
|
strings:
|
|
$s0 = "654321" fullword ascii /* reversed goodware string '123456' */
|
|
$s1 = "admin123" fullword ascii /* PEStudio Blacklist: strings */
|
|
$s2 = "admin123456" fullword ascii /* PEStudio Blacklist: strings */
|
|
$s3 = "administrator" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 2 times */
|
|
$s4 = "passwd" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 42 times */
|
|
$s5 = "password" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 244 times */
|
|
$s7 = "12345678" fullword ascii /* Goodware String - occured 29 times */
|
|
condition:
|
|
filesize < 1KB and all of them
|
|
}
|
|
|
|
rule CN_Honker_Perl_serv_U {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file Perl-serv-U.pl"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "f333c597ff746ebd5a641fbc248497d61e3ec17b"
|
|
id = "d793227d-dd4d-5c92-bfdc-9662c3ed8933"
|
|
strings:
|
|
$s1 = "$dir = 'C:\\\\WINNT\\\\System32\\\\';" fullword ascii /* PEStudio Blacklist: strings */
|
|
$s2 = "$sock = IO::Socket::INET->new(\"127.0.0.1:$adminport\") || die \"fail\";" fullword ascii /* PEStudio Blacklist: strings */
|
|
condition:
|
|
filesize < 8KB and all of them
|
|
}
|
|
|
|
rule CN_Honker_F4ck_Team_f4ck {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file f4ck.txt"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "e216f4ba3a07de5cdbb12acc038cd8156618759e"
|
|
id = "abf2f277-79b4-5ca2-b12e-93a662e5d607"
|
|
strings:
|
|
$s0 = "PassWord:F4ckTeam!@#" fullword ascii /* PEStudio Blacklist: strings */
|
|
$s1 = "UserName:F4ck" fullword ascii /* PEStudio Blacklist: strings */
|
|
$s2 = "F4ck Team" fullword ascii
|
|
condition:
|
|
filesize < 1KB and all of them
|
|
}
|
|
|
|
rule CN_Honker_sig_3389_3389 {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file 3389.vbs"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "f92b74f41a2138cc05c6b6993bcc86c706017e49"
|
|
id = "6d385820-befe-5e2b-8c48-ad90564d5f42"
|
|
strings:
|
|
$s1 = "success = obj.run(\"cmd /c takeown /f %SystemRoot%\\system32\\sethc.exe&echo y| " ascii /* PEStudio Blacklist: strings */
|
|
condition:
|
|
filesize < 10KB and all of them
|
|
}
|
|
|
|
rule CN_Honker_sig_3389_3389_2 {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file 3389.bat"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "5ff92f39ade12f8ba6cb75dfdc9bb907e49f0ebd"
|
|
id = "f449f632-3102-5e62-b790-5546698dd663"
|
|
strings:
|
|
$s1 = "@del c:\\termsrvhack.dll" fullword ascii
|
|
$s2 = "@del c:\\3389.txt" fullword ascii
|
|
condition:
|
|
filesize < 3KB and all of them
|
|
}
|
|
|
|
rule CN_Honker_Injection_Transit_jmCook {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file jmCook.asp"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "5e1851c77ce922e682333a3cb83b8506e1d7395d"
|
|
id = "468abb0e-a163-5fc5-b6a1-896fc04b8570"
|
|
strings:
|
|
$s1 = ".Open \"POST\",PostUrl,False" fullword ascii /* PEStudio Blacklist: strings */
|
|
$s2 = "JmdcwName=request(\"jmdcw\")" fullword ascii /* PEStudio Blacklist: strings */
|
|
condition:
|
|
filesize < 9KB and all of them
|
|
}
|
|
|
|
rule CN_Honker_Pwdump7_Pwdump7 {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file Pwdump7.bat"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "67d0e215c96370dcdc681bb2638703c2eeea188a"
|
|
id = "baf6ced6-4298-5453-a020-a384c923584c"
|
|
strings:
|
|
$s1 = "Pwdump7.exe >pass.txt" fullword ascii /* PEStudio Blacklist: strings */
|
|
condition:
|
|
filesize < 1KB and all of them
|
|
}
|
|
|
|
rule CN_Honker_portRecall_pr {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file pr"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "583cf6dc2304121d835f2879803a22fea76930f3"
|
|
id = "1e137ed0-3af6-5b01-a27b-87bf42359887"
|
|
strings:
|
|
$s1 = "Usage: Same as lcx.exe in win32 :)" fullword ascii
|
|
$s2 = "connect to client" fullword ascii /* PEStudio Blacklist: strings */
|
|
$s3 = "PR(Packet redirection) for linux " fullword ascii /* PEStudio Blacklist: strings */
|
|
condition:
|
|
filesize < 70KB and all of them
|
|
}
|
|
|
|
rule CN_Honker_sig_3389_3389_3 {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file 3389.bat"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "cfedec7bd327897694f83501d76063fe16b13450"
|
|
id = "ff61a5cb-6089-5632-a65d-09f4ffd99857"
|
|
strings:
|
|
$s1 = "echo \"fDenyTSConnections\"=dword:00000000>>3389.reg " fullword ascii /* PEStudio Blacklist: strings */
|
|
$s2 = "echo \"PortNumber\"=dword:00000d3d>>3389.reg " fullword ascii /* PEStudio Blacklist: strings */
|
|
$s3 = "echo [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server]>>" ascii /* PEStudio Blacklist: strings */
|
|
condition:
|
|
filesize < 2KB and all of them
|
|
}
|
|
|
|
rule CN_Honker_Alien_D {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file D.ASP"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "de9cd4bd72b1384b182d58621f51815a77a5f07d"
|
|
id = "88529577-0dea-5aa8-b763-79a69397ddd5"
|
|
strings:
|
|
$s0 = "Paths_str=\"c:\\windows\\\"&chr(13)&chr(10)&\"c:\\Documents and Settings\\\"&chr" ascii /* PEStudio Blacklist: strings */
|
|
$s1 = "CONST_FSO=\"Script\"&\"ing.Fil\"&\"eSyst\"&\"emObject\"" fullword ascii /* PEStudio Blacklist: strings */
|
|
$s2 = "Response.Write \"<form id='form1' name='form1' method='post' action=''>\"" fullword ascii /* PEStudio Blacklist: strings */
|
|
$s3 = "set getAtt=FSO.GetFile(filepath)" fullword ascii
|
|
$s4 = "Response.Write \"<input name='NoCheckTemp' type='checkbox' id='NoCheckTemp' chec" ascii
|
|
condition:
|
|
filesize < 30KB and 2 of them
|
|
}
|
|
|
|
rule CN_Honker_ChinaChopper_db {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file db.mdb"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "af79ff2689a6b7a90a5d3c0ebe709e42f2a15597"
|
|
id = "1314e204-d3f5-5f0a-bb74-dc774fef3d3c"
|
|
strings:
|
|
$s1 = "http://www.maicaidao.com/server.phpcaidao" fullword wide /* PEStudio Blacklist: strings */
|
|
$s2 = "<O>act=login</O>" fullword wide /* PEStudio Blacklist: strings */
|
|
$s3 = "<H>localhost</H>" fullword wide /* PEStudio Blacklist: strings */
|
|
condition:
|
|
filesize < 340KB and 2 of them
|
|
}
|
|
|
|
rule CN_Honker_syconfig {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file syconfig.dll"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "ff75353df77d610d3bccfbffb2c9dfa258b2fac9"
|
|
id = "3850007d-20d5-5b10-a549-dc4655877c6e"
|
|
strings:
|
|
$s9 = "Hashq.CrackHost+FormUnit" fullword ascii /* PEStudio Blacklist: strings */
|
|
condition:
|
|
uint16(0) == 0x0100 and filesize < 18KB and all of them
|
|
}
|
|
|
|
rule CN_Honker_linux_bin {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file linux_bin"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "26e71e6ebc6a3bdda9467ce929610c94de8a7ca0"
|
|
id = "3c56a4a8-6392-517c-a16e-63785799acb9"
|
|
strings:
|
|
$s1 = "client.sin_port = htons(atoi(argv[3]));" fullword ascii /* PEStudio Blacklist: strings */
|
|
$s2 = "printf(\"\\n\\n*********Waiting Client connect*****\\n\\n\");" fullword ascii /* PEStudio Blacklist: strings */
|
|
condition:
|
|
filesize < 20KB and all of them
|
|
}
|
|
|
|
rule CN_Honker_Intersect2_Beta {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file Intersect2-Beta.py"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "3ba5f720c4994cd4ad519b457e232365e66f37cc"
|
|
id = "d20da18d-f8c9-5eb3-8d5d-c8816cff3200"
|
|
strings:
|
|
$s1 = "os.system(\"ls -alhR /home > AllUsers.txt\")" fullword ascii /* PEStudio Blacklist: strings */
|
|
$s2 = "os.system('getent passwd > passwd.txt')" fullword ascii /* PEStudio Blacklist: strings */
|
|
$s3 = "os.system(\"rm -rf credentials/\")" fullword ascii /* PEStudio Blacklist: strings */
|
|
condition:
|
|
uint16(0) == 0x2123 and filesize < 50KB and 2 of them
|
|
}
|
|
|
|
rule CN_Honker_IIS_logcleaner1_0_readme {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file readme.txt"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "2ab47d876b49e9a693f602f3545381415e82a556"
|
|
id = "6f3605ab-cf9d-5f6b-8d89-6269976c5b0b"
|
|
strings:
|
|
$s2 = "LogCleaner.exe <ip> [Logpath]" fullword ascii
|
|
$s3 = "http://l-y.vicp.net" fullword ascii
|
|
condition:
|
|
filesize < 7KB and all of them
|
|
}
|
|
|
|
rule CN_Honker_Alien_command {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file command.txt"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "5896b74158ef153d426fba76c2324cd9c261c709"
|
|
id = "55dd10c9-f7dc-5ee2-a47d-dab8cc7b60e6"
|
|
strings:
|
|
$s0 = "for /d %i in (E:\\freehost\\*) do @echo %i" fullword ascii /* PEStudio Blacklist: strings */
|
|
$s1 = "/c \"C:\\windows\\temp\\cscript\" C:\\windows\\temp\\iis.vbs" fullword ascii /* PEStudio Blacklist: strings */
|
|
condition:
|
|
filesize < 8KB and all of them
|
|
}
|
|
|
|
rule CN_Honker_portRecall_bc {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file bc.pl"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "2084990406398afd856b2309c7f579d7d61c3767"
|
|
id = "ea74f260-87e6-5027-b558-628949cae32a"
|
|
strings:
|
|
$s0 = "print \"[*] Connected to remote host \\n\"; " fullword ascii /* PEStudio Blacklist: strings */
|
|
$s1 = "print \"Usage: $0 [Host] [Port] \\n\\n\"; " fullword ascii /* PEStudio Blacklist: strings */
|
|
$s5 = "print \"[*] Resolving HostName\\n\"; " fullword ascii /* PEStudio Blacklist: strings */
|
|
condition:
|
|
filesize < 10KB and all of them
|
|
}
|
|
|
|
rule CN_Honker_Tuoku_script_MSSQL_ {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file MSSQL_.asp"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "7097c21f92306983add3b5b29a517204cd6cd819"
|
|
id = "35c4f119-6a57-580a-b5ee-c36af0ccc94a"
|
|
strings:
|
|
$s1 = "GetLoginCookie = Request.Cookies(Cookie_Login)" fullword ascii /* PEStudio Blacklist: strings */
|
|
$s2 = "if ShellPath=\"\" Then ShellPath = \"c:\\\\windows\\\\system32\\\\cmd.exe\"" fullword ascii /* PEStudio Blacklist: strings */
|
|
$s8 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii /* PEStudio Blacklist: strings */
|
|
condition:
|
|
filesize < 100KB and all of them
|
|
}
|
|
|
|
rule CN_Honker_nc_MOVE {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file MOVE.txt"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "4195370c103ca467cddc8f2724a8e477635be424"
|
|
id = "115d1ec9-6c4f-587e-977c-cd24ada89ab6"
|
|
strings:
|
|
$s0 = "Destination: http://202.113.20.235/gj/images/2.asp" fullword ascii /* PEStudio Blacklist: strings */
|
|
$s1 = "HOST: 202.113.20.235" fullword ascii /* PEStudio Blacklist: strings */
|
|
$s2 = "MOVE /gj/images/A.txt HTTP/1.1" fullword ascii
|
|
condition:
|
|
filesize < 1KB and all of them
|
|
}
|
|
|
|
rule CN_Honker_mssqlpw_scan {
|
|
meta:
|
|
description = "Script from disclosed CN Honker Pentest Toolset - file mssqlpw scan.txt"
|
|
license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "Disclosed CN Honker Pentest Toolset"
|
|
date = "2015-06-23"
|
|
score = 70
|
|
hash = "e49def9d72bfef09a639ef3f7329083a0b8b151c"
|
|
id = "7dc29d06-e1e7-527f-b9e5-d75f660fd73e"
|
|
strings:
|
|
$s0 = "response.Write(\"I Get it ! Password is <font color=red>\" & str & \"</font><BR>" ascii /* PEStudio Blacklist: strings */
|
|
$s1 = "response.Write \"Done!<br>Process \" & tTime & \" s\"" fullword ascii /* PEStudio Blacklist: strings */
|
|
condition:
|
|
filesize < 6KB and all of them
|
|
}
|