/*
    Source: research.ohiiho.com/arsenal/cpanel-cracker/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule tool_cpanel_cracker {
    meta:
        description = "cpanel_cracker config grabber (Donnazmi / AnonGhost)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/cpanel-cracker/"
        status      = "validated"

    strings:
        $donnazmi  = "Donnazmi" ascii
        $anonghost = "AnonGhost" ascii
        $ungku     = "ungku_nazmi" ascii
        $mkdir_don = "mkdir(\"Donnazmi/\")" ascii
        $named     = "/etc/named.conf" ascii
        $passwd    = "/etc/passwd" ascii
        $ua_google = "Googlebot" ascii
        $ua_yandex = "Yandex" ascii
        $ua_slurp  = "Slurp" ascii
        $ua_msn    = "MSNBot" ascii
        $symlink   = "symlink(" ascii

    condition:
        filesize < 80KB
        and (
            ($donnazmi or $anonghost or $ungku or $mkdir_don)
            or ($symlink and ($passwd or $named)
                and 2 of ($ua_*))
        )
}