/*
    Source: research.ohiiho.com/arsenal/symlink/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule tool_symlink_privesc {
    meta:
        description = "symlink.php cPanel privilege escalation with W0rm injection"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/symlink/"
        status      = "validated"

    strings:
        $symlink     = "symlink(" ascii
        $passwd      = "/etc/passwd" ascii
        $cookie_auth = "$_COOKIE" ascii
        $conf1       = "wp-config.php" ascii
        $conf2       = "configuration.php" ascii
        $htaccess    = ".htaccess" ascii
        $w0rm_cmd    = "$_GET[\"cmd\"]" ascii

    condition:
        filesize < 60KB
        and $symlink
        and ($cookie_auth or $passwd)
        and ($conf1 or $conf2)
        and ($w0rm_cmd or $htaccess)
}