43 lines
1.3 KiB
Python
43 lines
1.3 KiB
Python
|
import yara, os
|
||
|
|
os.chdir(r'd:\project\MeshSafe')
|
||
|
|
rules = yara.compile(filepaths={f: os.path.join('rules', f) for f in os.listdir('rules') if f.endswith('.yar')})
|
||
|
|
|
||
|
|
# 测 PHP eval
|
||
|
|
import tempfile
|
||
|
|
tmp = tempfile.NamedTemporaryFile(delete=False, suffix='.php', mode='wb')
|
||
|
|
tmp.write(b'<?php eval($_POST["cmd"]); echo "ok"; ?>')
|
||
|
|
tmp.close()
|
||
|
|
matches = rules.match(tmp.name)
|
||
|
|
print(f'PHP eval: {[m.rule for m in matches]}')
|
||
|
|
os.unlink(tmp.name)
|
||
|
|
|
||
|
|
# 测 PE
|
||
|
|
pe_path = 'tests/samples/pe_injection.exe'
|
||
|
|
if os.path.exists(pe_path):
|
||
|
|
matches = rules.match(pe_path)
|
||
|
|
print(f'PE injection: {[m.rule for m in matches]}')
|
||
|
|
|
||
|
|
# 测 PHP 文件（用真实样本）
|
||
|
|
php_path = 'tests/samples/shell_php_eval.php'
|
||
|
|
if os.path.exists(php_path):
|
||
|
|
matches = rules.match(php_path)
|
||
|
|
print(f'shell_php_eval.php: {[m.rule for m in matches]}')
|
||
|
|
|
||
|
|
# 测 python reverse shell
|
||
|
|
py_path = 'tests/samples/shell_python.py'
|
||
|
|
if os.path.exists(py_path):
|
||
|
|
matches = rules.match(py_path)
|
||
|
|
print(f'shell_python.py: {[m.rule for m in matches]}')
|
||
|
|
|
||
|
|
# 测 certutil lolbin
|
||
|
|
lol_path = 'tests/samples/lolbin.cmd'
|
||
|
|
if os.path.exists(lol_path):
|
||
|
|
matches = rules.match(lol_path)
|
||
|
|
print(f'lolbin.cmd: {[m.rule for m in matches]}')
|
||
|
|
|
||
|
|
# 测 normal_deploy.sh
|
||
|
|
sh_path = 'tests/samples/normal_deploy.sh'
|
||
|
|
if os.path.exists(sh_path):
|
||
|
|
matches = rules.match(sh_path)
|
||
|
|
print(f'normal_deploy.sh: {[m.rule for m in matches]}')
|