<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body>Hi Anoop,<div>Ok opened redmine ticket #529.</div><div>Regards</div><div>Rmkml</div><div><br></div></body></html><br><br>Anoop Saldanha <anoopsaldanha@gmail.com> a écrit :<br><br><body>rmkml,<br><br>Can you open a ticket on this?<br><br>On Wed, Aug 22, 2012 at 2:49 AM, Peter Manev <petermanev@gmail.com> wrote:<br>> sorry,<br>> I meant<br>> content:"|00 5C 00 77 00 69 00 .......|" so o<br>><br>><br>> On Tue, Aug 21, 2012 at 11:18 PM, Peter Manev <petermanev@gmail.com> wrote:<br>>><br>>> Hi,<br>>><br>>> What happens if you change all the contents ...<br>>><br>>> content:"|00 5C 00|w|00|i|00|n|00|r|00|e|00|g|<br>>> 00 00 00|"<br>>> change to content:"5C 00 77 00 69 00 ......." so on ?<br>>><br>>><br>>> Thanks<br>>><br>>> On Wed, Aug 22, 2012 at 1:08 AM, rmkml <rmkml@yahoo.fr> wrote:<br>>>><br>>>> Hi,<br>>>><br>>>> First, Congratulations for a new Suricata v1.3.1 !<br>>>><br>>>> ok Im test this new version, and I have a complex netbios FP, based on<br>>>> this old netbios sig:<br>>>> alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg<br>>>> unicode create tree attempt"; flow:established,to_server;<br>>>> flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1;<br>>>> content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,&,128,6,relative;<br>>>> pcre:"/^.{27}/R"; content:"|5C 00|w|00|i|00|n|00|r|00|e|00|g|00 00 00|";<br>>>> within:16; distance:51; nocase; flowbits:set,smb.tree.create.winreg;<br>>>> classtype:protocol-command-decode; sid:2477; rev:6;)<br>>>><br>>>><br>>>> ok I small change on this for reply FP with my joigned pcap file:<br>>>> (removed established and two flowbits)<br>>>> alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg<br>>>> unicode create tree attempt"; flow:to_server; content:"|00|"; depth:1;<br>>>> content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,&,128,6,relative;<br>>>> pcre:"/^.{27}/R"; content:"|5C 00|w|00|i|00|n|00|r|00|e|00|g|00 00 00|";<br>>>> within:16; distance:51; nocase; classtype:protocol-command-decode; sid:2477;<br>>>> rev:66;)<br>>>><br>>>> ok when I start v1.3.1, suricata fire:<br>>>> 06/11/2012-11:51:51.690598 [**] [1:2477:66] NETBIOS SMB-DS winreg<br>>>> unicode create tree attempt [**] [Classification: Generic Protocol Command<br>>>> Decode] [Priority: 3] {TCP} 172.21.35.149:4345 -> 172.16.142.24:445<br>>>> Of course, snort not fire.<br>>>><br>>>> ok hexa dump my pcap file:<br>>>> #000000C8 13 38 01 0A 96 A7 00 00 00 64 FF 53 4D 42 A2 00 00 00 00 18<br>>>> .8.......d.SMB......<br>>>> # + ++++ ++++++++ 1 2 3 4 5<br>>>> #000000DC 07 C8 00 00 67 E1 67 45 78 C7 9C F1 00 00 06 10 B4 16 02 20<br>>>> ....g.gEx..........<br>>>> # &128<br>>>> # 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25<br>>>> #000000F0 80 02 18 FF 00 DE DE 00 0E 00 16 00 00 00 00 00 00 00 9F 01<br>>>> ....................<br>>>> # 26 27 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17<br>>>> #00000104 02 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 01 00<br>>>> ....................<br>>>> # 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37<br>>>> #00000118 00 00 40 00 00 00 02 00 00 00 03 11 00 00 5C 00 77 00 69 00<br>>>> ..@...........\.w.i.<br>>>> # ^<br>>>> # 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52<br>>>> #0000012C 6E 00 72 00 65 00 67 00 00 00 00 00 CC 00 00 00<br>>>> n.r.e.g.........<br>>>><br>>>><br>>>> Why Suricata fire?<br>>>><br>>>> ok modified sig for firing snort with my pcap: (added 0x00 and changed 16<br>>>> -> 17)<br>>>> alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS winreg<br>>>> unicode create tree attempt"; flow:to_server; content:"|00|"; depth:1;<br>>>> content:"|FF|SMB|A2|"; within:5; distance:3;<br>>>> byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; content:"|00 5C<br>>>> 00|w|00|i|00|n|00|r|00|e|00|g|00 00 00|";<br>>>> within:17; distance:51; nocase; classtype:protocol-command-decode;<br>>>> sid:2477; rev:67;)<br>>>> and Suricata fire again.<br>>>><br>>>> If anyone confirm, Im open a new redmine ticket...<br>>>><br>>>> Regards<br>>>> Rmkml<br>>>><br>>>> http://twitter.com/rmkml<br>>>> _______________________________________________<br>>>> Oisf-devel mailing list<br>>>> Oisf-devel@openinfosecfoundation.org<br>>>> https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel<br>>><br>>><br>>><br>>><br>>> --<br>>> Regards,<br>>> Peter Manev<br>>><br>><br>><br>><br>> --<br>> Regards,<br>> Peter Manev<br>><br>><br>> _______________________________________________<br>> Oisf-devel mailing list<br>> Oisf-devel@openinfosecfoundation.org<br>> https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel<br><br><br><br>-- <br>Anoop Saldanha<br> </body>