15 lines
767 B
Plaintext
15 lines
767 B
Plaintext
|
|
rule Exploit_MacOS_CVE-2016-4625_A_MTB{
|
|
meta:
|
|
description = "Exploit:MacOS/CVE-2016-4625.A!MTB,SIGNATURE_TYPE_MACHOHSTR_EXT,05 00 05 00 05 00 00 01 00 "
|
|
|
|
strings :
|
|
$a_00_0 = {63 68 69 6c 64 20 72 65 63 65 69 76 69 6e 67 20 73 74 6f 6c 65 6e 20 70 6f 72 74 } //01 00 child receiving stolen port
|
|
$a_01_1 = {69 6e 73 65 72 74 69 6e 67 20 4d 41 4b 45 5f 53 45 4e 44 20 69 6e 74 6f 20 73 68 61 72 65 64 20 70 6f 72 74 } //01 00 inserting MAKE_SEND into shared port
|
|
$a_00_2 = {67 6f 74 20 75 73 65 72 20 63 6c 69 65 6e 74 } //01 00 got user client
|
|
$a_00_3 = {67 65 74 74 69 6e 67 20 73 74 61 73 68 65 64 20 70 6f 72 74 } //01 00 getting stashed port
|
|
$a_00_4 = {6b 69 6c 6c 65 64 20 63 68 69 6c 64 } //00 00 killed child
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |