1

I am trying to do a Snort demo and I though it would be nice to detect a real threat. I picked the sasser worm and the jolt/teardrop dos attacks for the demo; no particular reason. Out of the three only one, the teardrop attack, is detected.

I have tested snort with "testing rules" (alert every tcp packet, search for a string in the payload, ...) and they seem to work flawlessly. I checked Snort output and there is no warnings nor errors for the files containing the rules for sasser/jolt.

I have not much experience writing Snort rules so I picked them from recognized security sites and github.

Sasser traffic is generated by the sasser worm, which I found online and compiled. Jolt and teardrop traffic is generated with the tool targa2.

I checked the traffic with tcpdump and it seems to be OK. Sasser generates traffic directed to the windows update port and both jolt and teardrop generate ICMP packets.

Having tested all the previous I guess the problem are my Snort rules. I've beem intesively Googling but I found nothing new so it would be nice if someone could check if these rules do what intended.

Here are my sasser rules:

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt" ; flow:to_server,established; flowbits:isset,netbios.lsass.bind.attempt; content:"|FF|SMB"; depth:4; offset:4; nocase:; content:"|05|"; distance:59; content:"|00|"; within:1; distance:1; content:"|09 00|"; within:2; distance:19; reference:cve,CAN-2003-0533; reference:url,www.microsoft.com/technet/security/bulletin/MS04-011.mspx; classtype:attempted-admin; sid:2514; rev:5;)

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 ( sid: 1000041; rev: 1; msg: "LSLass MS-0411 exploit"; flow: established,to_server; content:"|eb10 5a4a 33c9 66b9 7d01 8034 0a99 e2fa eb05 e8eb ffff|"; reference:url,www.secuser.com/alertes/2004/sasser.htm; classtype: shellcode-detect;)

alert tcp $HOME_NET any -> $EXTERNAL_NET 9996 ( sid: 1000042; rev: 3; msg:"Sasser ftp script to transfer up.exe"; content:"|5F75702E657865|"; depth:250; flags:A+; reference:url,www.secuser.com/alertes/2004/sasser.htm; classtype: misc-activity;)

alert tcp $EXTERNAL_NET any -> $HOME_NET 5554 ( sid: 1000043; rev: 1; msg:"Sasser binary transfer get up.exe"; content:"|5F75702E657865|"; depth:250; flags:A+; reference:url,www.secuser.com/alertes/2004/sasser.htm; classtype: misc-activity;)

Here my Jolt rule:

alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"DOS Jolt attack"; dsize:408; fragbits:M; reference:cve,1999-0345; classtype:attempted-dos; sid:268; rev:4;)

And finally the Teardrop rule, the only one that works:

alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"DOS Teardrop attack"; fragbits:M; id:242; reference:bugtraq,124; reference:cve,1999-0015; reference:nessus,10279; reference:url,www.cert.org/advisories/CA-1997-28.html; classtype:attempted-dos; sid:270; rev:6;)

Thanks in advance.

Improve this question

1 Answer 1

Reset to default
1

I don't see anything obviously wrong with the rules.

Did you happen to capture your pcaps on either the attacking or target system? If so, checksums may be incorrect. As a quick test, run snort with the "-k none" flag to ignore checksums but the correct way to do it would be to use tcprewrite to fix tcp checksums (or some other utility to reach the same goal).

Thanks,

~Patrick

Improve this answer
1
  • Thanks for the answer Patrick, but sadly we did the demo some time ago. We decided to go with the teardrop and the heartbleed attacks.
    – Fernando Domínguez
    Jun 16, 2014 at 8:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .