16 lines
1.0 KiB
Plaintext
16 lines
1.0 KiB
Plaintext
|
|
rule Exploit_O97M_CVE-2017-11882_BV_MTB{
|
|
meta:
|
|
description = "Exploit:O97M/CVE-2017-11882.BV!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,06 00 06 00 06 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {2b 20 22 63 66 74 36 79 67 76 63 72 34 72 63 76 66 67 79 75 20 3d 20 22 22 } //1 + "cft6ygvcr4rcvfgyu = ""
|
|
$a_01_1 = {28 63 66 74 36 79 67 76 63 72 34 72 63 76 66 67 79 75 2c 46 61 6c 73 65 29 20 22 20 2b 20 76 62 43 72 4c 66 20 27 30 30 30 30 } //1 (cft6ygvcr4rcvfgyu,False) " + vbCrLf '0000
|
|
$a_01_2 = {2b 20 22 22 69 6e 22 22 22 20 2b 20 76 62 43 72 4c 66 20 27 30 30 30 30 } //1 + ""in""" + vbCrLf '0000
|
|
$a_01_3 = {2b 20 22 22 62 61 22 22 22 20 2b 20 76 62 43 72 4c 66 20 27 30 30 30 30 } //1 + ""ba""" + vbCrLf '0000
|
|
$a_01_4 = {2b 20 22 22 73 65 22 22 22 20 2b 20 76 62 43 72 4c 66 20 27 30 30 30 30 } //1 + ""se""" + vbCrLf '0000
|
|
$a_01_5 = {2b 20 22 22 36 34 22 22 20 22 20 2b 20 76 62 43 72 4c 66 20 27 30 30 30 30 } //1 + ""64"" " + vbCrLf '0000
|
|
condition:
|
|
((#a_01_0 & 1)*1+(#a_01_1 & 1)*1+(#a_01_2 & 1)*1+(#a_01_3 & 1)*1+(#a_01_4 & 1)*1+(#a_01_5 & 1)*1) >=6
|
|
|
|
} |