/*
    Source: research.ohiiho.com/arsenal/whmcs-killer/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule tool_whmcs_killer {
    meta:
        description = "whmcs-killer-v3 billing system exploitation tool (RAB3OUN)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/whmcs-killer/"
        status      = "validated"

    strings:
        $tbladmins  = "tbladmins" ascii
        $reset_pw   = "e10adc3949ba59abbe56e057f20f883e" ascii
        $rab3oun    = "rab3oun" ascii nocase
        $erreur_sql = "Erreur SQL !" ascii
        $post_f     = "$_POST[\"f\"]" ascii
        $c0de_var   = "$c0de" ascii
        $f0p3n_var  = "$f0p3n" ascii
        $dropper1   = "downloads/rab3oun.php" ascii
        $dropper2   = "attachments/rab3oun.php" ascii

    condition:
        filesize < 200KB
        and (
            ($tbladmins and ($reset_pw or $erreur_sql or $post_f))
            or ($rab3oun and ($c0de_var or $f0p3n_var))
            or ($dropper1 or $dropper2)
        )
}