commit
a773fd49c8
|
@ -0,0 +1,22 @@
|
|||
id: smb-v1-detection
|
||||
|
||||
info:
|
||||
name: SMB-V1 Detection
|
||||
author: pussycat0x
|
||||
severity: low
|
||||
tags: network,windows,smb,service
|
||||
reference: https://stealthbits.com/blog/what-is-smbv1-and-why-you-should-disable-it/
|
||||
|
||||
network:
|
||||
- inputs:
|
||||
- data: 00000031ff534d4272000000001845680000000000000000000000000000be2200000100000e00024e54204c4d20302e3132000200
|
||||
type: hex
|
||||
|
||||
host:
|
||||
- "{{Hostname}}"
|
||||
- "{{Hostname}}:445"
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "SMBr"
|
|
@ -0,0 +1,18 @@
|
|||
id: smtp-service-detection
|
||||
|
||||
info:
|
||||
name: SMTP Service Detection
|
||||
author: pussycat0x
|
||||
severity: info
|
||||
tags: network,service,smtp
|
||||
|
||||
network:
|
||||
- inputs:
|
||||
- data: "\r\n"
|
||||
host:
|
||||
- "{{Hostname}}"
|
||||
- "{{Hostname}}:25"
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "SMTP"
|
|
@ -0,0 +1,21 @@
|
|||
id: vsftpd-detection
|
||||
|
||||
info:
|
||||
name: VSFTPD v2.3.4 Backdoor Command Execution
|
||||
author: pussycat0x
|
||||
severity: critical
|
||||
tags: network,vsftpd,ftp
|
||||
reference: https://www.rapid7.com/db/modules/exploit/unix/ftp/vsftpd_234_backdoor/
|
||||
|
||||
network:
|
||||
- inputs:
|
||||
- data: "USER anonymous\r\nPASS pussycat0x\r\n"
|
||||
|
||||
host:
|
||||
- "{{Hostname}}"
|
||||
- "{{Hostname}}:21"
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
words:
|
||||
- "vsFTPd 2.3.4"
|
Loading…
Reference in New Issue