37 lines
1.1 KiB
Text
37 lines
1.1 KiB
Text
rule LINUX_ELF_TOOL_RAINBOWCRACK_FAMILY
|
|
{
|
|
meta:
|
|
author = "defensive"
|
|
description = "Linux ELF: RainbowCrack family tools by CLI strings"
|
|
severity = "high"
|
|
fix_notes = "BUG FIX CRITICO: magic byte era 0x464C457F (big-endian errato) - su x86/x86-64 uint32(0) legge little-endian, il valore corretto e' 0x7f454c46. La regola originale non matchava alcun ELF reale."
|
|
|
|
strings:
|
|
$t1 = "rtgen" nocase ascii
|
|
$t2 = "rtsort" nocase ascii
|
|
$t3 = "rcrack" nocase ascii
|
|
$t4 = "rainbowcrack" nocase ascii
|
|
|
|
$p1 = "chain length" nocase ascii
|
|
$p2 = "chain count" nocase ascii
|
|
$p3 = "table index" nocase ascii
|
|
$p4 = "reduction" nocase ascii
|
|
$p5 = "hash algorithm" nocase ascii
|
|
$p6 = "plaintext" nocase ascii
|
|
$p7 = "usage:" nocase ascii
|
|
$p8 = "--help" ascii
|
|
$p9 = "-h" ascii
|
|
|
|
$h1 = "LM" fullword ascii
|
|
$h2 = "NTLM" fullword ascii
|
|
$h3 = "MD5" fullword ascii
|
|
$h4 = "SHA1" fullword ascii
|
|
$h5 = "SHA-1" fullword ascii
|
|
|
|
condition:
|
|
uint32(0) == 0x7f454c46 and
|
|
(1 of ($t*)) and
|
|
(2 of ($p1,$p2,$p3,$p4,$p5,$p6,$p7,$p8,$p9)) and
|
|
(1 of ($h*)) and
|
|
filesize < 50MB
|
|
}
|