Re: sidestep

From: Jill Tovey (jill.tovey_at_bigbluedoor.com)
Date: 04/29/03

  • Next message: Randy Taylor: "Re: sidestep" 
    To: focus-ids@securityfocus.com
Date: 29 Apr 2003 13:28:54 +0100

    Okay,

    Thanks for the responses so far.

    I am tackling how the RPC attack works first.

    First of all I send the RPC request in normal mode.
    This gets detected by snort with the following output:

    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

    TCP TTL:128 TOS:0x0 ID:8585 IpLen:20 DgmLen:84 DF
    ***AP*** Seq: 0xBE7826F7 Ack: 0x34F8656C Win: 0x4470 TcpLen: 20
    80 00 00 28 00 00 00 00 00 00 00 00 00 00 00 02 ...(............
    00 01 86 A0 00 00 00 02 00 00 00 04 00 00 00 00 ................
    00 00 00 00 00 00 00 00 00 00 00 00 ............

    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

    So I then try sidestep in -evade mode.
    It gets detected by snort anyway, as someone already mentioned, this is
    probably because sidestep is older than my snort rules.

    [**] RPC portmap listing [**]
    04/29-12:57:58.607580 192.168.0.10:1471 -> 192.168.0.2:111
    TCP TTL:128 TOS:0x0 ID:10424 IpLen:20 DgmLen:240 DF
    ***AP*** Seq: 0x19B53290 Ack: 0xB60B1018 Win: 0x4470 TcpLen: 20
    80 00 00 28 00 00 00 00 00 00 00 00 00 00 00 02 ...(............
    00 01 86 A0 00 00 00 02 00 00 00 04 00 00 00 00 ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    01 00 00 00 00 01 00 00 00 00 01 02 00 00 00 01 ................
    00 00 00 00 01 01 00 00 00 01 86 00 00 00 01 A0 ................
    00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 ................
    00 00 01 02 00 00 00 01 00 00 00 00 01 00 00 00 ................
    00 01 00 00 00 00 01 04 00 00 00 01 00 00 00 00 ................
    01 00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 ................
    00 00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 ................
    00 00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 ................
    00 00 01 00 00 00 00 01 00 00 00 00 01 00 00 00 ................
    00 01 00 80 00 00 01 00 ........

    =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

    Anyway, as you can see the packet data is very different, but the first
    44 bytes are the same, this is probably why snort is detecting the
    attack.
    So would anyone like to attempt an explanation as to how this tries to
    evade snort?

    Any comments much appreciated,

    Cheers

    -------------------------------------------------------------------------------
    Can you respond to attacks based on attack type, severity, source IP,
    destination IP, number of times attacked, or the time of day an attack
    occurs? No?
    No wonder why you're swamped with false positives!
    Download a free 15-day trial of Border Guard and watch your false
    positives disappear.

    http://www.securityfocus.com/StillSecure-focus-ids2
    -------------------------------------------------------------------------------

  • Next message: Randy Taylor: "Re: sidestep"

    Relevant Pages

    • Re: IDS Project
      ... I'm doing the some test on the NFR and on the SNORT systems. ... the IDS have raised the correct type of alert. ... When I've reached the blinding point (example 1% of attack lost), ...
      (Focus-IDS)
    • Re: [Full-Disclosure] IDS Signatures
      ... do take a look at snort. ... firewall, so that when snort sees as attack, i ... >> a database of intrusion signatures using MySQL database. ... >> algorithm be appropriate for pattern matching in IDS?) ...
      (Full-Disclosure)
    • Re: [Full-Disclosure] IDS Signatures
      ... > firewall, so that when snort sees as attack, i ... take a look at Snortsam. ... had script, like you have now, running on Snort and a Checkpoint ...
      (Full-Disclosure)
    • Re: sidestep
      ... Snort 1.8.7 is hideously out of date (not to mention the huge buffer ... If you use version 2.0 with the default rule set ... > destination IP, number of times attacked, or the time of day an attack ... > No wonder why you're swamped with false positives! ...
      (Focus-IDS)
    • Re: Snort + RedHat v7.2 - Back to Basics
      ... >> To date, I've convinced snort to monitor eth1, but I've only managed to ... > but the attack is against the external address. ... No sense in running snort just to pickup portscans. ...
      (comp.os.linux.security)
    • Quantcast