SIGNATURE_BASE_EXPL_HKTL_LNX_Dirtyfragshellcode_May26

rule SIGNATURE_BASE_EXPL_HKTL_LNX_Dirtyfragshellcode_May26
{
	meta:
		description = "Detects a shellcode observed in dirtyfrag, a local privilege escalation exploit for Linux."
		author = "Pezier Pierre-Henri (Nextron Systems)"
		id = "c156da87-c029-5084-9cd3-a233fefdaf25"
		date = "2026-05-07"
		modified = "2026-05-15"
		reference = "https://github.com/V4bel/dirtyfrag/tree/master"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_lnx_dirtyfrag.yar#L28-L60"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "a02ea2ba8108a9b7a997faa8808cfc55bb69af54e69178fa5aa1785681cf0ced"
		logic_hash = "af23343955d917f302bbba3faf48d4a57ab3b37f77ec7556e17c3e9bac6cdc5f"
		score = 80
		quality = 85
		tags = ""

	strings:
		$op1 = {
         31 ff     // xor     edi, edi
         31 f6     // xor     esi, esi
         31 c0     // xor     eax, eax
         b0 6a     // mov     al, 6Ah ; 'j'
         0f 05     // syscall; LINUX - sys_setgid
         b0 69     // mov     al, 69h ; 'i'
         0f 05     // syscall; LINUX - sys_setuid
         b0 74     // mov     al, 74h ; 't'
         0f 05     // syscall; LINUX - sys_setgroups
         6a 00     // push    0
         48 [6]    // lea     rax, aTermXterm; "TERM=xterm"
         50        // push    rax
         48 89 e2  // mov     rdx, rsp
         48 [6]    // lea     rdi, aBinSh; "/bin/sh"
         31 f6     // xor     esi, esi
         6a 3b     // push    3Bh ; ';'
         58        // pop     rax
         0f 05     // syscall; LINUX - sys_execve
      }

	condition:
		$op1
}