mirror of
https://github.com/projectdiscovery/nuclei-templates.git
synced 2026-02-09 04:03:16 +08:00
20 lines
835 B
YAML
20 lines
835 B
YAML
id: godzilla-webshell-hash
|
|
info:
|
|
name: Godzilla Webshell Hash - Detect
|
|
author: pussycat0x
|
|
severity: info
|
|
description: Detects the JSP implementation of the Godzilla Webshell.
|
|
reference:
|
|
- https://github.com/volexity/threat-intel/blob/main/2022/2022-08-10%20Mass%20exploitation%20of%20(Un)authenticated%20Zimbra%20RCE%20CVE-2022-27925/yara.yar
|
|
- https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/
|
|
tags: malware,webshells
|
|
|
|
file:
|
|
- extensions:
|
|
- all
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- "sha256(raw) == '2786d2dc738529a34ecde10ffeda69b7f40762bf13e7771451f13a24ab7fc5fe'"
|
|
# digest: 4a0a00473045022076837eec80a696dd94820f09606d9c0b898df167062019438d6a524deae170e7022100e04494a4faf434420541568819f6c974b92716787d9a86c27c660eee5bf1ca7e:922c64590222798bb761d5b6d8e72950 |