Evading IDS in exploit development

Question

In the context of buffer overflow exploit development, I was asked:

Discuss how your exploit may be modified to evade an Intrusion Detection System.

I'm not asking for my homework to be done, but after using my best Google-Fu, the only answer I can find is to use encoders (like shikata_ga_nai).

Are there other methods in exploit development for evading IDS?

Given the context, it seems unlikely that this is the only thing I should discuss, but as I said, after spending the evening on it I can't find anything else.

Answer 1

While the other answer focuses on modifying the exploit itself, you can also modify the transport of the exploit, so that the IDS will not detect it (Disclaimer: some of this points to my own research).

Some examples on how to do this on the application layer with HTTP (i.e. for drive-by-downloads while browsing the web etc):

• Use a valid but less common HTTP compression method, which is supported by the browsers but often not by the IDS. Often a simple Content-Encoding: deflate is enough, like with ZScaler or Comodo Webinspector or Sophos UTM (fixed).
• Combine HTTP compression, e.g. use a Content-Encoding of deflate, deflate or gzip, deflate. IDS like Bro, Snort, Suricata or even VirusTotal only look at the first or last compression scheme, while browsers like Firefox or Google Chrome accept content which is compressed multiple times.

Similar evasions can be done by playing with content-transfer-encoding when sending the malware by e-mail.

And then there is a nice research about evading IDS at the transport layer. There is a paper about Evading Deep Inspection for Fun and Shell and also a video from Blackhat 13.

And of course you can also modify the exploit itself. Here is a nice description of how to modify existing exploits so that common AV will not detect them any longer.

Other evasion techniques use social methods to evade IDS, like putting the exploit into an encrypted ZIP file, attach it too a mail and write the password into the mail too. If done well the victim will be seduced to open the file with the supplied password just to get the content (like the alleged salary lists of his company or similar traps). Because the password is not known to the IDS it can not detect the malware.

Answer 2

1. Utilizing readily available system resources.
2. Alphanumeric shellcode.
3. Encrypt the shellcode.
4. Polymorphic shellcodes.
5. Metamorphic shellcode.

http://www.tenouk.com/Bufferoverflowc/Bufferoverflow5.html

Follow the link and skip down to "More Advanced Techniques" for additional information.

Answer 3

Rather than using google to find answers for "How to avoid IDS", turn it around. Search for IDS and read about the various IDS solutions. To answer this question, you need to first define what is meant by IDS. Not what the letters stand for, but what you understand the term refers to and the main techniques used. You will find these fall into a few typical types - for example, network/firewall IDS systems which can do things like deep packet and protocol inspection, suspicious connection patterns and port scanning detection, etc and OS IDS which look for unusual processes, filesystem changes, unusual network activity etc and application IDS which might monitor connections, data inputs, etc.

Once you have a clear definition, then read about the various techniques which fit with your definition. Then consider how you might be able to defeat those techniques.

As your question refers to discussing how YOUR exploit can be modified to avoid detection, it can be assumed you have a specific exploit. Look at how the various IDS you find could detect your exploit and then let your imagination fly. For example, if your exploit makes multiple connections, you might add a delay between each connection to defeat an IDS which looks for high levels of connections from an IP over a short period or you might change your exploit to use a different transport protocol that has a high level of traffic, such as http or maybe you can disguise it as DNS traffic etc.

The answer really depends on your exploit. To provide a good response, you will need to know which IDS techniques would detect your exploit.

Answer 4

Agree with Steffen on his first few approaches.

Additionally, I answered a similar question here -- https://security.stackexchange.com/a/83497/140 -- and the technique of using SniffJoke should apply. It is often better to change your network traffic than to modify your exploit stager or payload. However, every situation is different. Gather more information about your target environments and mock up an attack in a lab before doing the real thing.

The answer about encoding really comes down to these issues -- https://www.scriptjunkie.us/2011/04/why-encoding-does-not-matter-and-how-metasploit-generates-exes/ -- encoders are meant to handle NULL termination from whitespace, newline, and break characters. Encoders are not meant to provide obfuscation.