| 1 |
// MakeNotWork - Linux/Unix shell droppers. |
| 2 |
// The fetch -> make-executable -> run chain that stages a second-stage payload |
| 3 |
// to a world-writable path. Each token is innocuous alone (install scripts use |
| 4 |
// chmod and curl), so the rule requires a download, an executable-bit flip, and |
| 5 |
// a temp/world-writable target together before firing. |
| 6 |
|
| 7 |
rule linux_shell_dropper { |
| 8 |
meta: |
| 9 |
description = "Download + chmod +x + execute from a world-writable path" |
| 10 |
strings: |
| 11 |
$dl1 = "curl " ascii |
| 12 |
$dl2 = "wget " ascii |
| 13 |
$chmod1 = "chmod +x" ascii |
| 14 |
$chmod2 = "chmod 777" ascii |
| 15 |
$chmod3 = "chmod 0777" ascii |
| 16 |
$tmp1 = "/tmp/" ascii |
| 17 |
$tmp2 = "/dev/shm/" ascii |
| 18 |
$tmp3 = "/var/tmp/" ascii |
| 19 |
condition: |
| 20 |
(1 of ($dl*)) and (1 of ($chmod*)) and (1 of ($tmp*)) |
| 21 |
} |
| 22 |
|
| 23 |
rule pipe_to_shell_dropper { |
| 24 |
meta: |
| 25 |
description = "Remote fetch piped directly into an interpreter" |
| 26 |
strings: |
| 27 |
$dl1 = "curl " ascii |
| 28 |
$dl2 = "wget " ascii |
| 29 |
$pipe1 = "| bash" ascii |
| 30 |
$pipe2 = "| sh" ascii |
| 31 |
$pipe3 = "|bash" ascii |
| 32 |
$pipe4 = "|sh" ascii |
| 33 |
$b64 = "base64 -d" ascii |
| 34 |
condition: |
| 35 |
((1 of ($dl*)) and (1 of ($pipe*))) |
| 36 |
or ($b64 and (1 of ($pipe*))) |
| 37 |
} |
| 38 |
|