RCE: missing commands

[emphazer]

@dune73
@csanders-git
@lifeforms

I spend some hours and created a list of commands for which should be in v3.1
The most of them should be in #837 (932106) and some of them should be in 932100/932105

What are you thinking?
I think that some of them are critical.

alternatives
apachectl
apxs
base64
bcrypt
bind
break
c\+\+
chown
clang\+\+
cmake
composer
convert
declare
dgawk
dig
disown
docker
drush
ethtool
find2perl
gawk
hexdump
httpd
igawk
init
jar
javac
jcmd
jconsole
jcontrol
journalctl
jre
jrunscript
jstat
jstatd
keyctl
keytool
logrotate
lshell
make
man
mkfifo
mknod
mktemp
mock
mongo
mount.fuse
munin-node
mvn
ncdu
nginx
node
parallel
paste
pgawk
php-cgi
php-config
php-fpm
phpize
pifconfig
postgres
psed
psql
puppet
redis-cli
redis-server
resolvconf
rev
rmiregistry
rpmbuild
runcon
runuser
sar
script
stdbuf
semanage
servertool
setcap
shift
smbclient
smbpasswd
snmp
ss
sshfs
strace
systemctl
tac
tcpdump
tshark
yes

[lifeforms]

@emphazer I would love to add these commands. Some of those in the list I had already considered and removed for false positives after testing on a comments dataset. The thing is that the RCE rules also hit after a newline. So any of these words after a newline would hit, and that made me want to to skip some common English words. I approve of almost all of your list, but I would probably exclude bind, break, convert, declare, dig, disown, jar, make, man, mock, paste, shift, yes.

[emphazer]

@lifeforms
ah okay, i understand.

what do you think about adding this commands to 932160 (rules/unix-shell.data) ?

bin/mknod
usr/bin/awk
usr/bin/base64
usr/bin/cat
usr/bin/find
usr/bin/gawk
usr/bin/hexdump
usr/bin/ln
usr/bin/mkfifo
usr/bin/ncat
usr/bin/php-cgi
usr/bin/printf
usr/bin/psed
usr/bin/sed
usr/bin/socat
usr/bin/tee
usr/bin/telnet
usr/bin/xxd
usr/bin/yes
usr/local/bin/ncat

and maybe:

tmp/

[lifeforms]

@emphazer That's always great!

[dune73]

That list is awesome, @emphazer!

In case you decide to skip a few of them, would you guys mind adding them to a comment somewhere together with the (individual?) reason why they were skipped? Otherwise somebody may repeat @emphazer's work in the future.

[spartantri]

This list can grow a lot, it may be good to use for flagging tx's for additional scrutiny looking for additional items that will confirm an RCE and reduce false positives so it can ignore "a python on a tree" but complain of "python -m SimpleHTTPServer"

Also if the bin is on the path there is no need to use the full path which will result in and easy bypass for
bin/* usr/bin/* usr/local/bin/*

Other interesting additions:

/dev/tcp
/dev/udp
python
perl
gcc
python

[lifeforms]

I would leave tmp/ and python out personally, other than that, a PR with the above changes would be very nice ;)

[fgsch]

#1095 has been merged. Can we close this?

[dune73]

Yes, let's close issues aggressively. We'll need to review the list again sooner or later anyways. No need to do this in this issue anymore.

[emphazer]

maybe we should label issues/improvements like this here...