Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've set up snort and am configuring it for my network. I have one vpn server making a connection to my dns/AD server. This connection sets off:

GPL SHELLCODE x86 inc ebx NOOP

The payload is as follows:

....WANG2..JFIF``..C

(1#%(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc..C//cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc..&.!..   
...}!1AQa"q2...#B..R..$3br. 
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...........................................................................    
...w!1AQaq"2.B....  #3R.br.
$4.%.&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..........................................................................?.5mJ#M...dh.....q.=j...+/G3Y.P.@t.@#=...j..u.g...4....................iw......yq..r......ZTQ@Q@Q@
.D.6.GTD...(I5....I..b..+.ie$.)$.[8.3.@..........$..,.......=N..T....E..g.............N.@P.z........S.M7M...iF_k6..>...-...9.;.L.....B..x.9..y.h.5.w.'Q..>...._/v..9Q.`..{t.Z..i..}...P..I,.$....@..'G..q._G..E.*~..s..]..E...$...-.)L.N7m...=........tI..o...v.K...rrp.\mx......s..o&%..c.A.u.zP*....h.....Z..i.q
O.Q.......H....:...K.0#.##...q..9..Mo.?{..n...........{V..<Ek.y.$.Xv.cq.I.q..<t.|Mo.2[.2]_K...@A`I..9..6n.=kI.......G...,.Z..MJ..J.4.n..    RIS8.m...}I....x..M........e..D     c.s.^._.......O.st.3..$...;N....zus.;..B........J..u[b.k.`.aAU....4k..._hze....VtdV
2.......}[..d..|#kb.N#R.H
..o............E
.>?......b3yx'.'9..A..\A.......B...A#...H.D.~.go4...y.|.W(x...o.cD..."*.231..a.......u...[uxT..p....\...:..(u..1L.[...3.u...Y...>..D..NR".........=}.@..._...V.....$..N2.x..0x.5...C....sw...."(u...r..'..S..+{.=z....._&2@....u
.g......C{....s.D.!eYA#..Bh/K.K..N...S.8.
@......B.....................9....}.l..b..VI.x...M.Oane...l{..8..6...Cq...I......7......?.a...}.....O.|1._..<u7.,/b...t.Z[.C..P..9...#...9.
...a.....6.]A...he..z.9=q...lol<..q,.om3.d...(p..=y.M.O.,.....j..5....G.M6.2/#FT`d....06d.w~5:...>....a.3(_-O..

My Question

How do you determine if this is a file transfer or actual shellcode trying to do a buffer overflow like the rule database says?

share|improve this question
add comment

2 Answers 2

up vote 4 down vote accepted

NOOPs are the tip-off for the snort rules. A file transfer is likely not to have NOP slides, but in this case, it might be a false positive:

WANG2..JFIF 

What you may have here is a ping from one Windows machine to another. Part of the ping payload is a jpg of the word: Microsoft.

This type of traffic has triggered other people to be suspicious, as well.

But, it would be nice to have the packet trace instead of the ASCII translation of the hex.

share|improve this answer
    
Thank you very much –  k to the z May 4 '12 at 16:28
add comment

Though I don't have a complete answer for you, keep in mind that the rule on this one is just a string of "C" in ASCII or 0x43. so it's fairly inaccurate.

Snort Rule that found this was: alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"SHELLCODE x86 inc ebx NOOP"; content:"CCCCCCCCCCCCCCCCCCCCCCCC" ; classtype:shellcode-detect; sid:1390; rev:5;)

Example alert file from snort: [] [1:1390:5] SHELLCODE x86 inc ebx NOOP [] [Classification: Executable code was detected] [Priority: 1] 01/15-17:32:16.249189 192.168.2.101:3128 -> 192.168.2.103:57310 TCP TTL:64 TOS:0x0 ID:22656 IpLen:20 DgmLen:1500 DF A* Seq: 0xC2797B70 Ack: 0x11FE472E Win: 0x8B TcpLen: 32 TCP Options (3) => NOP NOP TS: 59640418 25088619

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.