Snort & Base Installation

Snort

View more presentations from bala150985.

SNORT's Offset, Depth, Distance, and Within

Source http://blog.joelesler.net/2010/03/offset-depth-distance-and-within.html

Ubuntu's Registry

WoW today I found out something which is almost equal to windows registry in Ubuntu  we can open it up with the command.

$ gconf-editor

Someone correct me if I am wrong.

Windows Update

Today I was performing Windows update it said that it needs to get two mandatory update I clicked on Okay and I was watching my SNORT IDS.  I saw two " FILE-IDENTIFY Portable Executable binary file magic detection" alerts in them what scared me was that they were from my ISP :-0. I know that we don't have any Micros0ft office in an around my place.

So I went to my windows machine and typed in netstat -aon sure enough I can see two established connection to the IP 122.165.249.90

ID	< Signature >	< Timestamp >	< Source Address >	< Dest. Address >	< Layer 4 Proto >
	#0-(5-49658)	[snort] DNS SPOOF query response with TTL of 1 min. and no authority	2012-02-24 05:38:37	192.168.1.1:53	192.168.56.200:57649	UDP
	#1-(5-49659)	[snort] FILE-IDENTIFY Portable Executable binary file magic detection	2012-02-24 05:39:33	122.165.249.90:80	192.168.56.200:49160	TCP
	#2-(5-49660)	[snort] FILE-IDENTIFY Portable Executable binary file magic detection	2012-02-24 05:39:34	122.165.249.90:80	192.168.56.200:49161	TCP

Next I clicked on the first IDS alert and found that it was trying to resolve dns.msftncsi.com and it resolves to the IP Address: 131.107.255.255. This increased my doubt, however drilling further down.  I started running PCAP and restarted my Windows machine.  I found that a second DNS query went out to download.windowsupdate.com which has a CNAME as shown below and my system at last ended up downloading from 122.165.xxx.xxx :-)

bala@bala-laptop:~$ nslookup download.windowsupdate.com
Server:        192.168.1.1
Address:    192.168.1.1#53

Non-authoritative answer:
download.windowsupdate.com    canonical name = download.windowsupdate.nsatc.net.
download.windowsupdate.nsatc.net    canonical name = main.dl.wu.akadns.net.
main.dl.wu.akadns.net    canonical name = intl.dl.wu.akadns.net.
intl.dl.wu.akadns.net    canonical name = dl.wu.ms.geo.akadns.net.
dl.wu.ms.geo.akadns.net    canonical name = a26.ms.akamai.net.
Name:    a26.ms.akamai.net
Address: 122.165.249.90
Name:    a26.ms.akamai.net
Address: 122.165.249.91

Regular expression regex

http://gskinner.com/RegExr/

Snort Action

Snort can take the following types of Actions.

The Activate and Dynamic are dropped for the more recent Tagging and Flowbits

The actions of Drop, Reject and SDrop are used when Snort is in Inline mode.

Functions In Assembly

Functions in Assembly
 * Defining a function in Assembly is as follows
.type MyFirstFunction, @fuction

MyFirstFunction:

ret


 * Function is called using "call MyFirstFunction"


Passing Arguments & Returing Values


 * Passing Arguments to Function
- Registers
- Global Memory locations
- Stack
 * Returning Value from a function
- Registers
- Global Memory locations


Program Starts here


.data
FirstString:
.asciz "firstfunctioncall\n"
SecondString:
.asciz "secondfunctioncall\n"
.text
.globl _start
.type MyFirstFunction , @function
MyFirstFunction: #String ptr & length will be added by caller
movl $4, %eax
movl $1, %ebx
int $0x80
ret
_start:
nop
#We will print firstfunctioncall here
movl $FirstString, %ecx
movl $18, %edx
call MyFirstFunction
#We will print secondfunctioncall here
movl $SecondString, %ecx
movl $19, %edx
call MyFirstFunction
#Now we will exit the program
movl $1, %eax
movl $0, %ebx
int $0x80


bala@bala-laptop:~/ASM$ as -ggstabs -o Function.o Function.s 
bala@bala-laptop:~/ASM$ ld -o Function Function.o
bala@bala-laptop:~/ASM$ ./Function 
firstfunctioncall
secondfunctioncall
bala@bala-laptop:~/ASM$ gdb ./Function 
(gdb) break *_start+1
Breakpoint 1 at 0x4000be: file Function.s, line 17.
(gdb) run
Starting program: /home/bala/ASM/Function 
Breakpoint 1, _start () at Function.s:17
17 movl $FirstString, %ecx
(gdb) print /x &FirstString 
$1 = 0x6000e8
(gdb) s
18 movl $18, %edx
(gdb) print /x $rcx
$3 = 0x6000e8
(gdb) s
19 call MyFirstFunction
(gdb) disassemble MyFirstFunction 
Dump of assembler code for function MyFirstFunction:
   0x00000000004000b0 <+0>: mov    $0x4,%eax
   0x00000000004000b5 <+5>: mov    $0x1,%ebx
   0x00000000004000ba <+10>: int    $0x80
   0x00000000004000bc <+12>: retq   
End of assembler dump.
(gdb) print /x $rip
$4 = 0x4000c8
(gdb) s
MyFirstFunction () at Function.s:10
10 movl $4, %eax
(gdb) print /x $rip
$5 = 0x4000b0
(gdb) s
11 movl $1, %ebx
(gdb) s
12 int $0x80
(gdb) s
firstfunctioncall
MyFirstFunction () at Function.s:13
13 ret
(gdb) s
_start () at Function.s:21
21 movl $SecondString, %ecx
(gdb) print /x $rip
$6 = 0x4000cd
(gdb) c
Continuing.
secondfunctioncall
Program exited normally.
(gdb) 


Program Starts here


.data
FirstString:
.asciz "firstfunctioncall\n"
SecondString:
.asciz "secondfunctioncall\n"
.bss
.lcomm StringPtr, 4
.lcomm StringLen, 4
.text
.globl _start
.type MyFirstFunction , @function
MyFirstFunction: #String ptr & length will be added by caller
movl $4, %eax
movl $1, %ebx
movl StringPtr, %ecx
movl StringLen, %edx
int $0x80
ret
_start:
nop
#We will print firstfunctioncall here
movl $FirstString, StringPtr
movl $18, StringLen
call MyFirstFunction
#We will print secondfunctioncall here
movl $SecondString, StringPtr
movl $19, StringLen
call MyFirstFunction
#Now we will exit the program
ExitCall:
movl $1, %eax
movl $0, %ebx
int $0x80


bala@bala-laptop:~/ASM$ as -ggstabs -o Function2.o Function2.s 
bala@bala-laptop:~/ASM$ ld -o Function2 Function2.o
bala@bala-laptop:~/ASM$ ./Function2
firstfunctioncall
secondfunctioncall
bala@bala-laptop:~/ASM$ gdb ./Function2
(gdb) break *_start+1
Breakpoint 1 at 0x4000cc: file Function2.s, line 22.
(gdb) run
Starting program: /home/bala/ASM/Function2 
Breakpoint 1, _start () at Function2.s:22
warning: Source file is more recent than executable.
22 movl $FirstString, StringPtr
(gdb) print /x &FirstString 
$1 = 0x600110
(gdb) x /1xw &StringPtr 
0x600138 : 0x00000000
(gdb) x /1xw &StringLen 
0x60013c : 0x00000000
(gdb) s
23 movl $18, StringLen
(gdb) s
24 call MyFirstFunction
(gdb) x /1xw &StringPtr 
0x600138 : 0x00600110
(gdb) x /1xw &StringLen 
0x60013c : 0x00000012
(gdb) x /1dw &StringLen 
0x60013c : 18
(gdb) s
MyFirstFunction () at Function2.s:13
13 movl $4, %eax
(gdb) s
14 movl $1, %ebx
(gdb) s
15 movl StringPtr, %ecx
(gdb) s
16 movl StringLen, %edx
(gdb) s
17 int $0x80
(gdb) s
firstfunctioncall
MyFirstFunction () at Function2.s:18
18 ret
(gdb) c
Continuing.
secondfunctioncall
Program exited normally.
(gdb)