rule LINUX_ELF_TOOL_RAINBOWCRACK_FAMILY
{
  meta:
    author = "defensive"
    description = "Linux ELF: RainbowCrack family tools by CLI strings"
    severity = "high"
    fix_notes = "BUG FIX CRITICO: magic byte era 0x464C457F (big-endian errato) - su x86/x86-64 uint32(0) legge little-endian, il valore corretto e' 0x7f454c46. La regola originale non matchava alcun ELF reale."

  strings:
    $t1 = "rtgen" nocase ascii
    $t2 = "rtsort" nocase ascii
    $t3 = "rcrack" nocase ascii
    $t4 = "rainbowcrack" nocase ascii

    $p1 = "chain length" nocase ascii
    $p2 = "chain count" nocase ascii
    $p3 = "table index" nocase ascii
    $p4 = "reduction" nocase ascii
    $p5 = "hash algorithm" nocase ascii
    $p6 = "plaintext" nocase ascii
    $p7 = "usage:" nocase ascii
    $p8 = "--help" ascii
    $p9 = "-h" ascii

    $h1 = "LM" fullword ascii
    $h2 = "NTLM" fullword ascii
    $h3 = "MD5" fullword ascii
    $h4 = "SHA1" fullword ascii
    $h5 = "SHA-1" fullword ascii

  condition:
    uint32(0) == 0x7f454c46 and
    (1 of ($t*)) and
    (2 of ($p1,$p2,$p3,$p4,$p5,$p6,$p7,$p8,$p9)) and
    (1 of ($h*)) and
    filesize < 50MB
}