Extracting Linux permissions using rex

[izyknows]

Hi all!

I'm looking to extract certain values from a Linux command line. Take the following example

| makeresults
| eval sampleCLI="find / -perm -664 -type d 2>/dev/null"
| eval sampleCLI2="find . -perm -2 -type d 2>/dev/null"
| eval sampleCLI3="find . \( -perm -o rwx \) -type d 2>/dev/null"
| eval sampleCLI4="find / -perm -o+w"

What I want is to extract the permissions and run some checks on it. For example, 664, 2, rwx and +w respectively in the above example. I'm having a hard type writing the regex query for this. I'm new to this and was trying to keep it simple and just get the value using negative matching like so

| rex field=sampleCLI* “find * -perm (?<permval>\S+)” 

However the rex command doesn't even run. Throws up the following error: Error in 'rex' command: The regex '“find' does not extract anything. It should specify at least one named group. Format: (?<name>...). 

Could someone please explain where I'm going wrong? Thanks very much!

[thambisetty]

you can't use wildcard (*) in rex field attribute.

| rex field=sampleCLI "-perm\s+-(-0)?(?<permission>[^\s]+)"
| rex field=sampleCLI2 "-perm\s+-(-0)?(?<permission>[^\s]+)"

[izyknows]

Thank you, this is great. However, it does not match for commands like

find / -perm -o+w
find . \( -perm -o rwx \) -type d 2>/dev/null

 Is it possible for the same regex expression to have this?

[thambisetty · Accepted solution]

| rex field=yourfield "-perm(\s-o)?\s?(-|\+)?(?<permission>[^\s]+)"