21 lines
685 B
Text
21 lines
685 B
Text
rule LINUX_ELF_TOOL_OPHCRACK_RELATED
|
|
{
|
|
meta:
|
|
author = "defensive"
|
|
description = "Linux ELF: Ophcrack-related binaries by strings"
|
|
severity = "high"
|
|
fix_notes = "BUG FIX CRITICO: magic byte era 0x464C457F (big-endian errato) - su x86/x86-64 uint32(0) legge little-endian, il valore corretto e' 0x7f454c46. La regola originale non matchava alcun ELF reale."
|
|
|
|
strings:
|
|
$k1 = "ophcrack" nocase ascii
|
|
$k2 = "load tables" nocase ascii
|
|
$k3 = "tables" nocase ascii
|
|
$k4 = "LM" fullword ascii
|
|
$k5 = "NTLM" fullword ascii
|
|
$k6 = "SAM" ascii
|
|
|
|
condition:
|
|
uint32(0) == 0x7f454c46 and
|
|
$k1 and 2 of ($k2,$k3,$k4,$k5,$k6) and
|
|
filesize < 200MB
|
|
}
|