9

In the context of buffer overflow exploit development, I was asked:

Discuss how your exploit may be modified to evade an Intrusion Detection System.

I'm not asking for my homework to be done, but after using my best Google-Fu, the only answer I can find is to use encoders (like shikata_ga_nai).

Are there other methods in exploit development for evading IDS?

Given the context, it seems unlikely that this is the only thing I should discuss, but as I said, after spending the evening on it I can't find anything else.

  • Can you add that this is about network based IDS? Or does is concern things like AIDE/tripwire too? – Jost Mar 16 '15 at 9:21
  • @Jost As it is unspecified in my assignment I'm assuming I should talk about both – Juicy Mar 17 '15 at 13:31
9

While the other answer focuses on modifying the exploit itself, you can also modify the transport of the exploit, so that the IDS will not detect it (Disclaimer: some of this points to my own research).

Some examples on how to do this on the application layer with HTTP (i.e. for drive-by-downloads while browsing the web etc):

  • Use a valid but less common HTTP compression method, which is supported by the browsers but often not by the IDS. Often a simple Content-Encoding: deflate is enough, like with ZScaler or Comodo Webinspector or Sophos UTM (fixed).
  • Combine HTTP compression, e.g. use a Content-Encoding of deflate, deflate or gzip, deflate. IDS like Bro, Snort, Suricata or even VirusTotal only look at the first or last compression scheme, while browsers like Firefox or Google Chrome accept content which is compressed multiple times.

Similar evasions can be done by playing with content-transfer-encoding when sending the malware by e-mail.

And then there is a nice research about evading IDS at the transport layer. There is a paper about Evading Deep Inspection for Fun and Shell and also a video from Blackhat 13.

And of course you can also modify the exploit itself. Here is a nice description of how to modify existing exploits so that common AV will not detect them any longer.

Other evasion techniques use social methods to evade IDS, like putting the exploit into an encrypted ZIP file, attach it too a mail and write the password into the mail too. If done well the victim will be seduced to open the file with the supplied password just to get the content (like the alleged salary lists of his company or similar traps). Because the password is not known to the IDS it can not detect the malware.

| improve this answer | |
4
  1. Utilizing readily available system resources.
  2. Alphanumeric shellcode.
  3. Encrypt the shellcode.
  4. Polymorphic shellcodes.
  5. Metamorphic shellcode.

http://www.tenouk.com/Bufferoverflowc/Bufferoverflow5.html

Follow the link and skip down to "More Advanced Techniques" for additional information.

| improve this answer | |
  • 1
    Using encoders to avoid IDS is bad practice. – Stolas Mar 16 '15 at 13:39
  • According to whom? – Jay Holister Mar 16 '15 at 15:01
  • 1
    Every exploit developer I know. But as I realise that is not a credible source have a look at : information.rapid7.com/rs/rapid7/images/… "Encoders are not meant to evade AV but handle bad characters" same goes for IDS. If you rewrite the shellcode to avoid the signature, you will have less chance to trigger a different (more generic) signature. The hide in plain side techniques. – Stolas Mar 16 '15 at 15:11
  • Rapid7 is a great resource. However, I would like to point out that in your link they're plugging dynamic Executable templates which are a feature of the Pro-Version of Metasploit... I would hardly view a marketing pamplet as a "credible" source. – Jay Holister Mar 19 '15 at 15:49
  • 1
    You are right, but I am not going to defend the answer. The.Exodus.Exploit.Dev master course.also said it. I can google and first a credible source. Or I can leave it at this. I choose to do the latter. – Stolas Mar 19 '15 at 20:51
0

Rather than using google to find answers for "How to avoid IDS", turn it around. Search for IDS and read about the various IDS solutions. To answer this question, you need to first define what is meant by IDS. Not what the letters stand for, but what you understand the term refers to and the main techniques used. You will find these fall into a few typical types - for example, network/firewall IDS systems which can do things like deep packet and protocol inspection, suspicious connection patterns and port scanning detection, etc and OS IDS which look for unusual processes, filesystem changes, unusual network activity etc and application IDS which might monitor connections, data inputs, etc.

Once you have a clear definition, then read about the various techniques which fit with your definition. Then consider how you might be able to defeat those techniques.

As your question refers to discussing how YOUR exploit can be modified to avoid detection, it can be assumed you have a specific exploit. Look at how the various IDS you find could detect your exploit and then let your imagination fly. For example, if your exploit makes multiple connections, you might add a delay between each connection to defeat an IDS which looks for high levels of connections from an IP over a short period or you might change your exploit to use a different transport protocol that has a high level of traffic, such as http or maybe you can disguise it as DNS traffic etc.

The answer really depends on your exploit. To provide a good response, you will need to know which IDS techniques would detect your exploit.

| improve this answer | |
0

Agree with Steffen on his first few approaches.

Additionally, I answered a similar question here -- https://security.stackexchange.com/a/83497/140 -- and the technique of using SniffJoke should apply. It is often better to change your network traffic than to modify your exploit stager or payload. However, every situation is different. Gather more information about your target environments and mock up an attack in a lab before doing the real thing.

The answer about encoding really comes down to these issues -- https://www.scriptjunkie.us/2011/04/why-encoding-does-not-matter-and-how-metasploit-generates-exes/ -- encoders are meant to handle NULL termination from whitespace, newline, and break characters. Encoders are not meant to provide obfuscation.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.