34 lines
1.2 KiB
Go
34 lines
1.2 KiB
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package detectors
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
|
|
)
|
|
|
|
func intPointer(value int) *int { return &value }
|
|
|
|
func TestReverseShellRequiresInterpreterAndNetworkInode(t *testing.T) {
|
|
state := model.State{
|
|
Processes: []model.Process{
|
|
{PID: 100, Comm: "bash", Cmdline: "bash -i", FDTargets: map[string]string{"0": "socket:[999]"}},
|
|
{PID: 101, Comm: "nginx", FDTargets: map[string]string{"0": "socket:[999]"}},
|
|
{PID: 102, Comm: "bash", FDTargets: map[string]string{"0": "socket:[777]"}},
|
|
},
|
|
Sockets: []model.Socket{{
|
|
State: "ESTAB", Local: "127.0.0.1:55", Peer: "9.9.9.9:443",
|
|
Inode: intPointer(999), Comm: "bash", PID: intPointer(100), Kind: "tcp",
|
|
}},
|
|
}
|
|
alerts := ReverseShell(state, config.Default())
|
|
if len(alerts) != 1 || alerts[0].SID != 100010 || alerts[0].Key != "rsh:100" {
|
|
t.Fatalf("unexpected alerts: %#v", alerts)
|
|
}
|
|
want := "pid=100 comm=bash stdio=net-socket peer=[127.0.0.1:55 -> 9.9.9.9:443] cmd=[bash -i]"
|
|
if alerts[0].Detail != want {
|
|
t.Fatalf("unexpected detail: %q", alerts[0].Detail)
|
|
}
|
|
}
|