Project Report on
Download 2.35 Mb.
|
- Navigate this page:
- 6.1 Crafting Linux rootkit “"lrkr0x"” attack packet as an Example.
- 6.2 Testing the script packet
Preparing AttacksIn this section we will explain how to use Packet Excalibur to craft 10 attacks. These attacks are listed in details in Appendix C. After studying these 10 (SID no 105, 214, 375 598, 668, 888, 978, 1082, 1256, 1488), we can categorize them into 2 classes. Out going traffic (rule No. 1) Incoming traffic ( rule No 2 - 10) Some of these attacks are TCP and some others are ICMP. There is also Web, mail and Telnet attacks. Rule 1 will be lunched from the internal network while all the others will be generated from the attacker in the external network. For attack1 a script file is attached to this document named (project rules 1 ) has the format of these attack packet ( see Appendix C.1 ). For attacks 2-10 a script file is attached to this document named (project rule 2-10) has the format of these attack packet (see Appendix C.2)
Summary of the 10 attacks For further details about each attack please read Appendix D. We will explain how we crafted one rule and for the rest you can refer to the attached scripts. 6.1 Crafting Linux rootkit “"lrkr0x"” attack packet as an Example.This attack indicates that the text "lrkr0x" was sent by an intruder on standard telnet port 23 encapsulated in TCP packet. This string may be used in a Linux rootkit that allows remote access to an intruder by using the default password “lrkr0x”. The rule statement for this attack is placed in our rule file alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"rule 2 BACKDOOR MISC Linux rootkit attempt lrkr0x"; flow:to_server, established; content:"lrkr0x"; classtype:attempted-admin; sid:214; rev:4;) We can understand from this rule the following: Send an Alert message when the system detects a TCP packet going to port 21 (telnet) and has the content “lrkr0x” which is the default rootkit root password. An intruder might be trying to access a Unix server on the telnet session. So we need to create a TCP packet with any payload but has the content “lrkrox”. Let see how we can do that with Packet Excalibur: 1) Open Packet Excalibur, we can see the window as Fig. 6.1.1. 
Fig. 6.1.1 Packet Excalibur Operation Window 2) Click add iso/iso option button 3 times to create Ethernet, Internet, and TCP layers (see figure Fig. 6.1.2) 
Fig. 6.1.2 Create a Package at TCP layer 3) Click on the Internet protocol layer and scroll down to source IP address, select “my IP address” from the selection field list.
6) Set the Acknowledge nbr to 1 (Set ACK field on) to indicate this is an already connected session. 7) Click on add ISO option again to add payload layer. 8) Type 32 byte in the field to indicate that the size of data is 32 bytes 9) Use any ASCII to Hex converter to convert a message contains the word lrk0x. For example we used this phrase “lrkr0x Say Hi to Dr. Aggarwal”. 10) Take the hexadecimal code and place it in the 32 bye field of the payload free input layer. Remember to add 0x before each live to indicate it is hex code. See Fig. 6.1.3 below. 
Fig. 6.1.3 Data in the Payload Field at TCP Layer 11) Save the file 12) Click edit and click append to script, give a name for this rule “rule 2” for this example 13) Click on the script window leaving this ISO decoder window 14) Click on Action from the title bar, then click on run script. 15) Click Save
Run Ethereal and start capturing the network traffic and keep it running. 1) From Packet Excalibur, click Generate as show in Fig. 6.2.1. 
Fig. 6.2.1 Destination IP Address 2) In the Dest IP field enter any IP you want (172.16.1.2 in this example). 3) Click ok to run the script. 4) Go back to Ethereal and click stop capture If you did everything right you should find a packet in Ethereal shown as Fig. 6.2.2. Make sure that the telnet data has the message you sent by reading it in the Ethereal. 
Fig. 6.2.1 Ethereal Catches the Package The process of crafting the 10 rules takes a lot of time. First you have to understand each rule then you need to construct it, test it and modify it. It was really one of the hardest parts in the project. Directory: courses courses -> Algorithms for Register Allocation Andrew Pardoe courses -> Ieor 4600 Mixed-Integer Rounding Inequalities courses -> San José State University Social Science/Psychology Psych 175, Management Psychology, Section 1, Spring 2014 courses -> Kennan's Telegram (Excerpt) courses -> The university of british columbia courses -> A hurricane track density function and empirical orthogonal function approach to predicting seasonal hurricane activity in the Atlantic Basin Elinor Keith April 17, 2007 Abstract courses -> Cover page need figure & title by Proposed Table of Contents courses -> Objectives courses -> Dr. Jeff Masters' WunderBlog Download 2.35 Mb. Share with your friends:
|