sorry,<br>I meant<br>content:"|00 5C 00 77 00 69 00 .......|" so o<br><br><div class="gmail_quote">On Tue, Aug 21, 2012 at 11:18 PM, Peter Manev <span dir="ltr"><<a href="mailto:petermanev@gmail.com" target="_blank">petermanev@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br><br>What happens if you change all the contents ...<div class="im"><br>content:"|00 5C 00|w|00|i|00|n|00|r|00|e|00|g|</div>
<div>00 00 00|"<br>change to content:"5C 00 77 00 69 00 ......." so on ?<br></div><br>
<br>Thanks<br><br><div class="gmail_quote"><div><div class="h5">On Wed, Aug 22, 2012 at 1:08 AM, rmkml <span dir="ltr"><<a href="mailto:rmkml@yahoo.fr" target="_blank">rmkml@yahoo.fr</a>></span> wrote:<br></div></div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
Hi,<br>
<br>
First, Congratulations for a new Suricata v1.3.1 !<br>
<br>
ok Im test this new version, and I have a complex netbios FP, based on this old netbios sig:<br>
alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg unicode create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.<u></u>connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|5C 00|w|00|i|00|n|00|r|00|e|00|g|<u></u>00 00 00|"; within:16; distance:51; nocase; flowbits:set,smb.tree.create.<u></u>winreg; classtype:protocol-command-<u></u>decode; sid:2477; rev:6;)<br>
<br>
<br>
ok I small change on this for reply FP with my joigned pcap file: (removed established and two flowbits)<br>
alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg unicode create tree attempt"; flow:to_server; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|5C 00|w|00|i|00|n|00|r|00|e|00|g|<u></u>00 00 00|"; within:16; distance:51; nocase; classtype:protocol-command-<u></u>decode; sid:2477; rev:66;)<br>
<br>
ok when I start v1.3.1, suricata fire:<br>
06/11/2012-11:51:51.690598 [**] [1:2477:66] NETBIOS SMB-DS winreg unicode create tree attempt [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} <a href="http://172.21.35.149:4345" target="_blank">172.21.35.149:4345</a> -> <a href="http://172.16.142.24:445" target="_blank">172.16.142.24:445</a><br>
Of course, snort not fire.<br>
<br>
ok hexa dump my pcap file:<br>
#000000C8 13 38 01 0A 96 A7 00 00 00 64 FF 53 4D 42 A2 00 00 00 00 18 .8.......d.SMB......<br>
# + ++++ ++++++++ 1 2 3 4 5<br>
#000000DC 07 C8 00 00 67 E1 67 45 78 C7 9C F1 00 00 06 10 B4 16 02 20 ....g.gEx..........<br>
# &128<br>
# 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25<br>
#000000F0 80 02 18 FF 00 DE DE 00 0E 00 16 00 00 00 00 00 00 00 9F 01 ....................<br>
# 26 27 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17<br>
#00000104 02 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 01 00 ....................<br>
# 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37<br>
#00000118 00 00 40 00 00 00 02 00 00 00 03 11 00 00 5C 00 77 00 69 00 ..@...........\.w.i.<br>
# ^<br>
# 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52<br>
#0000012C 6E 00 72 00 65 00 67 00 00 00 00 00 CC 00 00 00 n.r.e.g.........<br>
<br>
<br>
Why Suricata fire?<br>
<br>
ok modified sig for firing snort with my pcap: (added 0x00 and changed 16 -> 17)<br>
alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg unicode create tree attempt"; flow:to_server; content:"|00|"; depth:1;<br>
content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|00 5C 00|w|00|i|00|n|00|r|00|e|00|g|<u></u>00 00 00|";<br>
within:17; distance:51; nocase; classtype:protocol-command-<u></u>decode; sid:2477; rev:67;)<br>
and Suricata fire again.<br>
<br>
If anyone confirm, Im open a new redmine ticket...<br>
<br>
Regards<br>
Rmkml<br>
<br>
<a href="http://twitter.com/rmkml" target="_blank">http://twitter.com/rmkml</a><br></div></div>_______________________________________________<br>
Oisf-devel mailing list<br>
<a href="mailto:Oisf-devel@openinfosecfoundation.org" target="_blank">Oisf-devel@openinfosecfoundation.org</a><br>
<a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><span class="HOEnZb"><font color="#888888"><br></font></span></blockquote>
</div><span class="HOEnZb"><font color="#888888"><br><br clear="all"><br>-- <br><div>
Regards,</div>
<div>Peter Manev</div><br>
</font></span></blockquote></div><br><br clear="all"><br>-- <br><div>Regards,</div>
<div>Peter Manev</div><br>