<commit_before>require("ipv4")
require("tcp")

local bindshell =	"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" ..
					"\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" ..
					"\x80\xe8\xdc\xff\xff\xff/bin/sh"

haka.rule {
    hooks = { "tcp-up" },
    eval = function (self, pkt)
		if #pkt.payload > 0 then
			-- reconstruct payload
			payload = ''
			for i = 1, #pkt.payload do
				payload = payload .. string.format("%c", pkt.payload[i])
			end
			-- test if shellcode is present in data
			if string.find(payload, bindshell) then
				haka.log("filter", "/bin/sh shellcode detected !!!")
				tcp:drop()
        	end
		end 
	end	
}
<commit_msg>Fix shellcode rule<commit_after>require("ipv4")
require("tcp")

local bindshell = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" ..
                  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" ..
                  "\x80\xe8\xdc\xff\xff\xff/bin/sh"

haka.rule {
	hooks = { "tcp-up" },
	eval = function (self, pkt)
		if #pkt.payload > 0 then
			-- reconstruct payload
			payload = ''
			for i = 1, #pkt.payload do
				payload = payload .. string.format("%c", pkt.payload[i])
			end
			-- test if shellcode is present in data
			if string.find(payload, bindshell) then
				haka.log("filter", "/bin/sh shellcode detected !!!")
				pkt:drop()
			end
		end
	end
}

{'fraction_non_alphanumeric': 0.1773612112472963, 'fraction_numerical': 0.07209805335255948, 'mean_word_length': 2.444168734491315, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7568833', 'n_tokens_mistral': 702, 'n_tokens_neox': 615, 'n_words': 102}