• Choose a category
• All
• Classic-Fiction

[+] Parsing Snort rules files...

[+] Found sid: 900001 in metasploit.rules

Successful translation

[+] Logfile: /var/log/fwsnort.log

[+] iptables script: /etc/fwsnort/fwsnort.sh

[iptablesfw]# grep -i metasploit /etc/fwsnort/fwsnort.sh

############ metasploit.rules ############

$ECHO "[+] Adding metasploit rules"

### alert tcp any 443 -> $HOME_NET any (msg:"Metasploit exploit DB update";

flow:established; content:"cacert@metasploit.com"; classtype:misc-activity;

sid:900001; rev:1;)

$IPTABLES -A FWSNORT_FORWARD_ESTAB -d 192.168.10.0/24 -p tcp --sport 443 -m

string --string "cacert@metasploit.com" --algo bm -m comment --comment

"sid:900001; msg: Metasploit exploit DB update; classtype: misc-activity; rev:

1; FWS:1.0;" -j LOG --log-ip-options --log-tcp-options "log-prefix "[1] REJ

SID900001 ESTAB "

$IPTABLES -A FWSNORT_FORWARD_ESTAB -d 192.168.10.0/24 -p tcp --sport 443 -m

string --string "cacert@metasploit.com" --algo bm -j REJECT --reject with

tcp-reset

$IPTABLES -A FWSNORT_INPUT_ESTAB -p tcp --sport 443 -m string --string

"cacert@metasploit.com" --algo bm -m comment --comment "sid:900001; msg:

Metasploit exploit DB update; classtype: misc-activity; rev: 1; FWS:1.0;" -j

LOG --log-ip-options --log-tcp-options --log-prefix "[1] REJ SID900001 ESTAB "

$IPTABLES -A FWSNORT_INPUT_ESTAB -p tcp --sport 443 -m string --string

"cacert@metasploit.com" --algo bm -j REJECT --reject-with tcp-reset

Let's execute the fwsnort.sh script shown above on the firewall and turn iptables into a detection and blocking mechanism for Metasploit updates:

[iptablesfw]# /etc/fwsnort/fwsnort.sh

[+] Adding metasploit rules

Rules added: 4

Although we're confident that iptables will not allow individual SSL sessions with the metasploit.com webserver to succeed, we would still like persistent iptables blocking rules to be created when a session is shut down. To do this, we use psad's auto-blocking functionality by setting the following configuration variables in /etc/psad/psad.conf like so:

ENABLE_AUTO_IDS Y;

AUTO_IDS_DANGER_LEVEL 4;

AUTO_BLOCK_TIMEOUT 3600;

ENABLE_AUTO_IDS_REGEX Y;

AUTO_BLOCK_REGEX ESTAB;

Next, we make psad aware of the new metasploit.rules file. To do so, we add an entry to the /etc/psad/snort_rule_dl file to map the Snort rule ID 900001 to a danger level of 4 (so that the AUTO_IDS_DANGER_LEVEL threshold will be tripped by the Metasploit update process):

[iptablesfw]# cp /etc/fwsnort/snort_rules/metasploit.rules /etc/psad/

snort_rules

[iptablesfw]# echo "900001 4;" >> /etc/psad/snort_rule_dl

[iptablesfw]# /etc/init.d/psad start

* Starting psad... [ ok ]

Now, our attempt to update the Metasploit exploit database from the int_scanner client system fails:

[int_scanner]$ cd framework-3.0

[int_scanner]$ svn update

svn: PROPFIND request failed on '/svn/framework3/tags/framework-3.0'

svn: PROPFIND of '/svn/framework3/tags/framework-3.0': SSL negotiation failed:

Connection reset by peer (https://metasploit.com)

We see the following messages written to syslog on the iptables system. The first message indicates that the fwsnort rules have dropped the SSL session with a TCP Reset packet. The remaining messages show that psad has instantiated a blocking rule against the metasploit.com IP address 216.75.15.231 for one hour:

Jul 31 17:42:12 iptablesfw kernel: REJ SID900001 ESTABLISHED IN=eth0 OUT=eth1

SRC=216.75.15.231 DST=192.168.10.200 LEN=1500 TOS=0x00 PREC=0x00 TTL=47 ID=19762

DF PROTO=TCP SPT=443 DPT=38528 WINDOW=46 RES=0x00 ACK URGP=0

Jul 31 17:42:14 iptablesfw psad: src: 216.75.15.231 signature match: "Metasploit

exploit DB update" (sid: 900001) tcp port: 38528 fwsnort chain: FWSNORT_FORWARD_

ESTAB rule: 1

Jul 31 17:42:14 iptablesfw psad: scan detected: 216.75.15.231 -> 192.168.10.200

tcp: [38528] flags: ACK tcp pkts: 1 DL: 4

Jul 31 17:42:14 iptables psad: added iptables auto-block against 216.75.15.231

for 3600 seconds

Note

Because our Snort rule detects the Metasploit SSL certificate coming from port 443, psad sees the source of the traffic as