nuclei-templates/http/exposed-panels/c2/ares-rat-c2.yaml

34 lines
842 B
YAML

id: ares-rat-c2
info:
name: Area Rat C2 - Detect
author: pussycat0x
severity: info
description: |
Ares is a Python Remote Access Tool.
reference:
- https://github.com/montysecurity/C2-Tracker/blob/main/tracker.py
metadata:
verified: true
max-request: 1
shodan-query: product:'Ares RAT C2'
tags: c2,ir,osint,ares,panel,rat
http:
- method: GET
path:
- '{{BaseURL}}/login'
matchers-condition: and
matchers:
- type: word
part: body
words:
- '<title>Ares</title>'
- 'Passphrase:'
condition: and
- type: status
status:
- 200
# digest: 490a0046304402205b62bc5a67524c652daab1f294f759186a46a5ffcebd03628386ab2e29d339000220211bc1d3284e25aca84307b362a7ab113b2a13f1ff36a09679f3811be9addd4a:922c64590222798bb761d5b6d8e72950