Fixed 0245-apache and 0250-web rules for Shellshock detection

[frgv]

This PR fixes Shellshock detection on Web rules (0245 and 250). Now it can detect more malicious patterns, as suggested in #80, avoiding false negatives.

192.168.2.100 - - [02/Nov/2015:01:35:55 +0100] "GET /cgi-bin/test.sh HTTP/1.1" 200 292 "-" "() { _; foo; } >_[$($())] { /usr/bin/perl ... }"

**Phase 1: Completed pre-decoding.
       full event: '192.168.2.100 - - [02/Nov/2015:01:35:55 +0100] "GET /cgi-bin/test.sh HTTP/1.1" 200 292 "-" "() { _; foo; } >_[$($())] { /usr/bin/perl ... }"'
       timestamp: '(null)'
       hostname: 'manager1'
       program_name: '(null)'
       log: '192.168.2.100 - - [02/Nov/2015:01:35:55 +0100] "GET /cgi-bin/test.sh HTTP/1.1" 200 292 "-" "() { _; foo; } >_[$($())] { /usr/bin/perl ... }"'

**Phase 2: Completed decoding.
       decoder: 'web-accesslog'
       srcip: '192.168.2.100'
       proto: 'GET'
       url: '/cgi-bin/test.sh'
       id: '200'

**Phase 3: Completed filtering (rules).
       Rule id: '31167'
       Level: '15'
       Description: 'Shellshock attack detected'
       Info - CVE: 'CVE-2014-6278'
       Info - Link: 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278'
**Alert to be generated.

192.168.2.100 - - [02/Nov/2015:01:35:55 +0100] "GET /cgi-bin/test.sh HTTP/1.1" 200 292 "-" "() { _; } >_[$($())] { /usr/bin/perl ... }"

**Phase 1: Completed pre-decoding.
       full event: '192.168.2.100 - - [02/Nov/2015:01:35:55 +0100] "GET /cgi-bin/test.sh HTTP/1.1" 200 292 "-" "() { _; } >_[$($())] { /usr/bin/perl ... }"'
       timestamp: '(null)'
       hostname: 'manager1'
       program_name: '(null)'
       log: '192.168.2.100 - - [02/Nov/2015:01:35:55 +0100] "GET /cgi-bin/test.sh HTTP/1.1" 200 292 "-" "() { _; } >_[$($())] { /usr/bin/perl ... }"'

**Phase 2: Completed decoding.
       decoder: 'web-accesslog'
       srcip: '192.168.2.100'
       proto: 'GET'
       url: '/cgi-bin/test.sh'
       id: '200'

**Phase 3: Completed filtering (rules).
       Rule id: '31167'
       Level: '15'
       Description: 'Shellshock attack detected'
       Info - CVE: 'CVE-2014-6278'
       Info - Link: 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278'
**Alert to be generated.

192.168.2.100 - - [02/Nov/2015:01:35:55 +0100] "GET /cgi-bin/test.sh HTTP/1.1" 200 292 "-" "() { gry; };/usr/bin/perl ..."

**Phase 1: Completed pre-decoding.
       full event: '192.168.2.100 - - [02/Nov/2015:01:35:55 +0100] "GET /cgi-bin/test.sh HTTP/1.1" 200 292 "-" "() { gry; };/usr/bin/perl ..."'
       timestamp: '(null)'
       hostname: 'manager1'
       program_name: '(null)'
       log: '192.168.2.100 - - [02/Nov/2015:01:35:55 +0100] "GET /cgi-bin/test.sh HTTP/1.1" 200 292 "-" "() { gry; };/usr/bin/perl ..."'

**Phase 2: Completed decoding.
       decoder: 'web-accesslog'
       srcip: '192.168.2.100'
       proto: 'GET'
       url: '/cgi-bin/test.sh'
       id: '200'

**Phase 3: Completed filtering (rules).
       Rule id: '31166'
       Level: '15'
       Description: 'Shellshock attack detected'
       Info - CVE: 'CVE-2014-6271'
       Info - Link: 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271'
**Alert to be generated.


192.168.2.100 - - [02/Nov/2015:01:35:55 +0100] "GET /cgi-bin/test.sh HTTP/1.1" 200 292 "-" "() { _; } >_[$($())] { /usr/bin/perl ... }"

192.168.2.100 - - [02/Nov/2015:01:35:55 +0100] "GET /cgi-bin/test.sh HTTP/1.1" 200 292 "-" "() { foo:; };/usr/bin/perl ..."

**Phase 1: Completed pre-decoding.
       full event: '192.168.2.100 - - [02/Nov/2015:01:35:55 +0100] "GET /cgi-bin/test.sh HTTP/1.1" 200 292 "-" "() { foo:; };/usr/bin/perl ..."'
       timestamp: '(null)'
       hostname: 'manager1'
       program_name: '(null)'
       log: '192.168.2.100 - - [02/Nov/2015:01:35:55 +0100] "GET /cgi-bin/test.sh HTTP/1.1" 200 292 "-" "() { foo:; };/usr/bin/perl ..."'

**Phase 2: Completed decoding.
       decoder: 'web-accesslog'
       srcip: '192.168.2.100'
       proto: 'GET'
       url: '/cgi-bin/test.sh'
       id: '200'

**Phase 3: Completed filtering (rules).
       Rule id: '31166'
       Level: '15'
       Description: 'Shellshock attack detected'
       Info - CVE: 'CVE-2014-6271'
       Info - Link: 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271'
**Alert to be generated.

192.168.2.100 - - [02/Nov/2015:01:35:55 +0100] "GET /cgi-bin/test.sh HTTP/1.1" 200 292 "-" "() { ignored;};/usr/bin/perl ..."

**Phase 1: Completed pre-decoding.
       full event: '192.168.2.100 - - [02/Nov/2015:01:35:55 +0100] "GET /cgi-bin/test.sh HTTP/1.1" 200 292 "-" "() { ignored;};/usr/bin/perl ..."'
       timestamp: '(null)'
       hostname: 'manager1'
       program_name: '(null)'
       log: '192.168.2.100 - - [02/Nov/2015:01:35:55 +0100] "GET /cgi-bin/test.sh HTTP/1.1" 200 292 "-" "() { ignored;};/usr/bin/perl ..."'

**Phase 2: Completed decoding.
       decoder: 'web-accesslog'
       srcip: '192.168.2.100'
       proto: 'GET'
       url: '/cgi-bin/test.sh'
       id: '200'

**Phase 3: Completed filtering (rules).
       Rule id: '31166'
       Level: '15'
       Description: 'Shellshock attack detected'
       Info - CVE: 'CVE-2014-6271'
       Info - Link: 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271'
**Alert to be generated.

[jesuslinares]

The regex should be stricter:
https://github.com/wazuh/wazuh-ruleset/pull/115/files#diff-6393325546bc1b08a1de9a0bb8fc2e15R234

We want to dectect:

• () { gry;};
• () { foo:; };
• () { ignored;};

Please, check it.

Thanks.

[jesuslinares]

Thanks @frgv !