From dcd03b69025384a7eb83b84a115cfecb275dafaf Mon Sep 17 00:00:00 2001 From: TimDiam0nd <54599998+TimDiam0nd@users.noreply.github.com> Date: Mon, 7 Oct 2024 15:05:02 +0100 Subject: [PATCH 1/3] remove unneccessary capture groups --- regex-assembly/934120.ra | 4 ---- rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf | 2 +- rules/RESPONSE-955-WEB-SHELLS.conf | 2 +- 3 files changed, 2 insertions(+), 6 deletions(-) diff --git a/regex-assembly/934120.ra b/regex-assembly/934120.ra index 09ff06790..581122346 100644 --- a/regex-assembly/934120.ra +++ b/regex-assembly/934120.ra @@ -7,10 +7,6 @@ ##!+ i -##! add capture group -##!^ ( -##!$ ) - ##! This regex starts with a list of all the schemes that can be used to make a request ##!> assemble ##!> include url-schemes diff --git a/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf b/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf index c99a1eed9..c45b87cd2 100644 --- a/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf +++ b/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf @@ -293,7 +293,7 @@ SecRule REQUEST_FILENAME|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIE # (consult https://coreruleset.org/docs/development/regex_assembly/ for details): # crs-toolchain regex update 934120 # -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@rx (?i)((?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:\+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[0-9]{10}|(?:0x[0-9a-f]{2}\.){3}0x[0-9a-f]{2}|0x(?:[0-9a-f]{8}|[0-9a-f]{16})|(?:0{1,4}[0-9]{1,3}\.){3}0{1,4}[0-9]{1,3}|[0-9]{1,3}\.(?:[0-9]{1,3}\.[0-9]{5}|[0-9]{8})|(?:\x5c\x5c[\-0-9a-z]\.?_?)+|\[[0-:a-f]+(?:[\.0-9]+|%[0-9A-Z_a-z]+)?\]|[a-z][\-\.0-9A-Z_a-z]{1,255}:[0-9]{1,5}(?:#?[\s\x0b]*&?@(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}|[a-z][\-\.0-9A-Z_a-z]{1,255}):[0-9]{1,5}/?)+|[\.0-9]{0,11}(?:\xe2(?:\x91[\xa0-\xbf]|\x92[\x80-\xbf]|\x93[\x80-\xa9\xab-\xbf])|\xe3\x80\x82)+))" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@rx (?i)(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:\+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://(?:[0-9]{10}|(?:0x[0-9a-f]{2}\.){3}0x[0-9a-f]{2}|0x(?:[0-9a-f]{8}|[0-9a-f]{16})|(?:0{1,4}[0-9]{1,3}\.){3}0{1,4}[0-9]{1,3}|[0-9]{1,3}\.(?:[0-9]{1,3}\.[0-9]{5}|[0-9]{8})|(?:\x5c\x5c[\-0-9a-z]\.?_?)+|\[[0-:a-f]+(?:[\.0-9]+|%[0-9A-Z_a-z]+)?\]|[a-z][\-\.0-9A-Z_a-z]{1,255}:[0-9]{1,5}(?:#?[\s\x0b]*&?@(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}|[a-z][\-\.0-9A-Z_a-z]{1,255}):[0-9]{1,5}/?)+|[\.0-9]{0,11}(?:\xe2(?:\x91[\xa0-\xbf]|\x92[\x80-\xbf]|\x93[\x80-\xa9\xab-\xbf])|\xe3\x80\x82)+)" \ "id:934120,\ phase:2,\ block,\ diff --git a/rules/RESPONSE-955-WEB-SHELLS.conf b/rules/RESPONSE-955-WEB-SHELLS.conf index 63938ae58..8b03a351e 100644 --- a/rules/RESPONSE-955-WEB-SHELLS.conf +++ b/rules/RESPONSE-955-WEB-SHELLS.conf @@ -49,7 +49,7 @@ SecRule RESPONSE_BODY "@pmFromFile web-shells-php.data" \ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # r57 web shell -SecRule RESPONSE_BODY "@rx (r57 Shell Version [0-9.]+|r57 shell)" \ +SecRule RESPONSE_BODY "@rx r57 Shell Version [0-9.]+|r57 shell" \ "id:955110,\ phase:4,\ block,\ From 448f8e33884b419733b597b7cbbfbfc145b60c48 Mon Sep 17 00:00:00 2001 From: TimDiam0nd <54599998+TimDiam0nd@users.noreply.github.com> Date: Mon, 7 Oct 2024 16:13:47 +0100 Subject: [PATCH 2/3] added basic test for 955110 --- .../tests/RESPONSE-955-WEB-SHELLS/955110.yaml | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 tests/regression/tests/RESPONSE-955-WEB-SHELLS/955110.yaml diff --git a/tests/regression/tests/RESPONSE-955-WEB-SHELLS/955110.yaml b/tests/regression/tests/RESPONSE-955-WEB-SHELLS/955110.yaml new file mode 100644 index 000000000..2d002cfbf --- /dev/null +++ b/tests/regression/tests/RESPONSE-955-WEB-SHELLS/955110.yaml @@ -0,0 +1,22 @@ +meta: + author: "TimDiam0nd" +rule_id: 955110 +tests: + - test_id: 1 + desc: "R57 Webshell Test as per https://github.com/r57shell/r57-shell/blob/e85aeeea421b76777e95ae00ae57bba79d5d9389/r57.php#L38" + stages: + - input: + dest_addr: "127.0.0.1" + port: 80 + headers: + Host: "localhost" + User-Agent: "OWASP CRS test agent" + Content-Type: "application/json" + method: "POST" + version: "HTTP/1.1" + uri: "/reflect" + data: |- + {"body": "r57 Shell Version 1.50"} + output: + log: + expect_ids: [955110] From 02de592d7c65a854ac6c927650d13da4a16cfe3f Mon Sep 17 00:00:00 2001 From: TimDiam0nd <54599998+TimDiam0nd@users.noreply.github.com> Date: Tue, 8 Oct 2024 20:13:42 +0100 Subject: [PATCH 3/3] add leading dashes --- tests/regression/tests/RESPONSE-955-WEB-SHELLS/955110.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/regression/tests/RESPONSE-955-WEB-SHELLS/955110.yaml b/tests/regression/tests/RESPONSE-955-WEB-SHELLS/955110.yaml index 2d002cfbf..ec234b425 100644 --- a/tests/regression/tests/RESPONSE-955-WEB-SHELLS/955110.yaml +++ b/tests/regression/tests/RESPONSE-955-WEB-SHELLS/955110.yaml @@ -1,3 +1,4 @@ +--- meta: author: "TimDiam0nd" rule_id: 955110