Add Shellscript risk detection. (#2375)

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

2 files changed, 24 insertions, 8 deletions

diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 06c609606..9bb5010fd 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -8160,6 +8160,29 @@ static int ndpi_is_ntop_protocol(ndpi_protocol *ret) {
 
 /* ********************************************************************************* */
 
+static void ndpi_search_shellscript(struct ndpi_detection_module_struct *ndpi_struct,
+                                    struct ndpi_flow_struct *flow)
+{
+  struct ndpi_packet_struct const * const packet = &ndpi_struct->packet;
+
+  NDPI_LOG_DBG(ndpi_struct, "search Shellscript\n");
+
+  if (packet->payload_packet_len < 3)
+  {
+    return;
+  }
+
+  if (packet->payload[0] != '#' ||
+      packet->payload[1] != '!' ||
+      (packet->payload[2] != '/' && packet->payload[2] != ' '))
+  {
+    return;
+  }
+
+  NDPI_LOG_INFO(ndpi_struct, "found Shellscript\n");
+  ndpi_set_risk(flow, NDPI_POSSIBLE_EXPLOIT, "Shellscript found");
+}
+
 /* ELF format specs: https://man7.org/linux/man-pages/man5/elf.5.html */
 static void ndpi_search_elf(struct ndpi_detection_module_struct *ndpi_struct,
                             struct ndpi_flow_struct *flow)
@@ -8622,6 +8645,7 @@ static ndpi_protocol ndpi_internal_detection_process_packet(struct ndpi_detectio
   {
     ndpi_search_portable_executable(ndpi_str, flow);
     ndpi_search_elf(ndpi_str, flow);
+    ndpi_search_shellscript(ndpi_str, flow);
   }
 
   if(flow->first_pkt_fully_encrypted == 0 &&
diff --git a/src/lib/protocols/ftp_data.c b/src/lib/protocols/ftp_data.c
index 048097156..1b5d42ffd 100644
--- a/src/lib/protocols/ftp_data.c
+++ b/src/lib/protocols/ftp_data.c
@@ -82,10 +82,6 @@ static int ndpi_match_file_header(struct ndpi_detection_module_struct *ndpi_stru
   if(ndpi_match_strprefix(packet->payload, payload_len, "RIFF"))
     return 1;
 
-  /* MZ is a .exe file */
-  if((packet->payload[0] == 'M') && (packet->payload[1] == 'Z') && (packet->payload[3] == 0x00))
-    return 1;
-
   /* Ogg files */
   if(ndpi_match_strprefix(packet->payload, payload_len, "OggS"))
     return 1;
@@ -118,10 +114,6 @@ static int ndpi_match_file_header(struct ndpi_detection_module_struct *ndpi_stru
   if((packet->payload[0] == 0x3c) && (packet->payload[1] == 0x3f) && (packet->payload[2] == 0x70) && (packet->payload[3] == 0x68))
     return 1;
 
-  /* Unix scripts */
-  if((packet->payload[0] == 0x23) && (packet->payload[1] == 0x21) && (packet->payload[2] == 0x2f) && (packet->payload[3] == 0x62))
-    return 1;
-
   /* PDFs */
   if(ndpi_match_strprefix(packet->payload, payload_len, "%PDF"))
     return 1;