来源

关联漏洞

描述

This repository contains Yara rule and the method that a security investigator may want to use for CVE-2022-26134 threat hunting on their Linux confluence servers.

介绍

# Confluence RCE [CVE-2022-26134] Exploit Detection

## Pre-requisites

1. ClamAV

## Clone this repository or download the Yara rule on your confluence server

We are using the Yara rule provided by volexity/threat-intel who first unveiled this vulnerability.

**Git Clone**

```bash
git clone https://github.com/th3b3ginn3r/CVE-2022-26134-Exploit-Detection.git
```

**Raw file download**

CVE-2022-26134.yar: https://raw.githubusercontent.com/th3b3ginn3r/CVE-2022-26134-Exploit-Detection-on-Linux/main/CVE-2022-26134.yar

```bash
curl -o <CVE-2022-26134.yar url>
```

Alternatively, you can also download the Yara rule directly from the volexity repository

## Usage

```bash
sudo clamscan -d /path-to-the/CVE-2022-26134.yar -r /path-to-scan -io #If scannig "/" root directory, include " exclude-dir="^/sys" " in the command.
```
## Reading the results

Now when you have run the scan, you will be presented with the scan summary. Below is a sample of it.

```bash
----------- SCAN SUMMARY -----------
Known viruses: 3 #These are the number of Yara rules in the CVE-2022-26134.yar file
Engine version: 0.xxx.5
Scanned directories: 20000
Scanned files: 200000
Infected files: 0 #See the count of infected files or the list of files that matches the conditions of the Yara rules
Data scanned: 1000.08 MB
Data read: 18000.00 MB (ratio 0.54:1)
Time: 284.885 sec (4 m 44 s)
Start Date: 2022:06:03 00:19:34
End Date:   2022:06:03 00:24:19
```
## Manual Hunting

You may additionaly want to search for suspicious activities in below confluence logs:

1. conf access log (log file name may differ in your environment)
2. catalina*.log

**Detailed write-up on Manual Hunting** :  https://link.medium.com/cebuWoAazqb


## License
[GPL]  GPL-3.0 license

文件快照

 [4.0K]  /data/pocs/86a454f1ce94d21ac6eb91e97782b06cdf73c463
├── [3.0K]  CVE-2022-26134.yar
├── [ 34K]  LICENSE
└── [1.7K]  README.md

0 directories, 3 files

备注