Merge pull request #1778 from pussycat0x/master

vsFTPd 2.3.4 Detection

network/smb-v1-detection.yaml

@@ -0,0 +1,22 @@
+id: smb-v1-detection
+
+info:
+  name: SMB-V1 Detection
+  author: pussycat0x
+  severity: low
+  tags: network,windows,smb,service
+  reference: https://stealthbits.com/blog/what-is-smbv1-and-why-you-should-disable-it/
+
+network:
+  - inputs:
+      - data: 00000031ff534d4272000000001845680000000000000000000000000000be2200000100000e00024e54204c4d20302e3132000200
+        type: hex
+
+    host:
+      - "{{Hostname}}"
+      - "{{Hostname}}:445"
+
+    matchers:
+      - type: word
+        words:
+          - "SMBr"

network/smtp-detection.yaml

@@ -0,0 +1,18 @@
+id: smtp-service-detection
+
+info:
+  name: SMTP Service Detection
+  author: pussycat0x
+  severity: info
+  tags: network,service,smtp
+
+network:
+  - inputs:
+      - data: "\r\n"
+    host:
+      - "{{Hostname}}"
+      - "{{Hostname}}:25"
+    matchers:
+      - type: word
+        words:
+          - "SMTP"

network/vsftpd-detection.yaml

@@ -0,0 +1,21 @@
+id: vsftpd-detection
+
+info:
+  name: VSFTPD v2.3.4 Backdoor Command Execution
+  author: pussycat0x
+  severity: critical
+  tags: network,vsftpd,ftp
+  reference: https://www.rapid7.com/db/modules/exploit/unix/ftp/vsftpd_234_backdoor/
+
+network:
+  - inputs:
+      - data: "USER anonymous\r\nPASS pussycat0x\r\n"
+
+    host:
+      - "{{Hostname}}"
+      - "{{Hostname}}:21"
+
+    matchers:
+      - type: word
+        words:
+          - "vsFTPd 2.3.4"