<menu id="guoca"></menu>
<nav id="guoca"></nav><xmp id="guoca">
  • <xmp id="guoca">
  • <nav id="guoca"><code id="guoca"></code></nav>
  • <nav id="guoca"><code id="guoca"></code></nav>
    網安 - 專業的網絡安全產業、社區、知識平臺

    NIDS（suricata） 中的 ICMP隱蔽隧道檢測

    VSole2021-12-24 08:32:25

    介紹

    我們先介紹一下 ICMP協議，ICMP的內容是放在ip數據包的數據部分里傳輸的，ICMP是基于IP協議工作的，我們要區別于傳輸層，它仍然屬于網絡層協議。ICMP報文包含在IP數據報中，IP報頭在ICMP報文的最前面。一個ICMP報文包括IP報頭（至少20字節）、ICMP報頭（至少八字節）和ICMP報文（屬于ICMP報文的數據部分）。當IP報頭中的協議字段值為1時，就說明這是一個ICMP報文。ICMP報文如下圖所示：

    從上圖看，也就是說，我們重點關注 Checksum 字段和Data字段，因為我們改變Data字段的時候，Checksum也要改變,我們把我們的payload或者數據放到Data字段里面即可.我們分別使用，Linux和Windows測試一下， Linux ping 發出的Data的內容為 ：!\"#$%&'()*+,-./01234567 ， Windows ping 的發出的Data的內容為 abcdefghijklmnopqrstuvwabcdefghi

    如圖，我們用wireshark抓的包

    安裝

    我們測試一下，Linux 的icmp 的隱藏后門ish，如果是Windows，推薦 icmpsh，

    受控機CentOS7 ：172.19.25.53

    控制機Parrot Linux ：172.19.25.73

    我們在受控機上編譯（make linux），啟動 ishd，在控制機上啟動 ./ish 172.19.25.53

    我們可以在 Data 里面可以看到一個ls

    我們可以在響應里面發現 相關目錄的數據

    可以看出，payload 是放在Data字段的

    我們總結一下ICMP隱蔽隧道的特征：

    1、ICMP隧道短時間會產生大量 ICMP 數據包，用來數據發送，可能存在大于 64 比特的數據包。

    2、ICMP隧道發送的 ICMP 數據包前后Data字段不一樣，而且響應數據包中 payload 跟請求數據包不一致。

    3、ICMP 數據包的協議標簽可能存在特殊字段。例如，icmptunnel 會在所有的 ICMP Data 前面增加 ‘TUNL’ 標記以用于識別隧道

    4，Data 里面可能存在一些系統命令

    防御和檢測手段：

    1，禁止 ping（不太可能），會影響到很多運維和安全檢測設備的運行。

    2，ICMP Data字段 形成一個白名單，不在白名單內的告警

    pass icmp any any -> any any (msg:"Whitecap: OSX or Linux ICMP Echo Request"; icode:0; itype:8; dsize:56; content:"!\"#$%&'()*+,-./01234567"; classtype:misc-activity; sid:5110001; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: OSX or Linux ICMP Echo Reply"; icode:0; itype:0; dsize:56; content:"!\"#$%&'()*+,-./01234567"; classtype:misc-activity; sid:5110002; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Windows XP/7/8 ICMP Echo Request"; icode:0; itype:8; dsize:32; content:"abcdefghijklmnopqrstuvwabcdefghi"; classtype:misc-activity; sid:5110003; rev:1; nocase;)
pass icmp any any -> any any (msg:"Whitecap: Windows XP/7/8 ICMP Echo Reply"; icode:0; itype:0; dsize:32; content:"abcdefghijklmnopqrstuvwabcdefghi"; classtype:misc-activity; sid:5110004; rev:1; nocase;)
pass icmp any any -> any any (msg:"Whitecap: Nmap ICMP Echo Request"; icode:0; itype:8; dsize:0; classtype:misc-activity; sid:5110005; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Nmap ICMP Echo Reply"; icode:0; itype:0; dsize:0; classtype:misc-activity; sid:5110006; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Group Policy Slow Link Detection"; icode:0; itype:8; dsize:>1400; content:"WANG2"; classtype:misc-activity; sid:5110007; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Group Policy Slow Link Detection"; icode:0; itype:0; dsize:>1400; content:"WANG2"; classtype:misc-activity; sid:5110008; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Solarwinds Status Query"; icode:0; itype:8; dsize:23; content:"SolarWinds Status Query"; classtype:misc-activity; sid:5110009; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Solarwinds Status Query"; icode:0; itype:0; dsize:23; content:"SolarWinds Status Query"; classtype:misc-activity; sid:5110010; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Domain Controller ICMP Traffic"; icode:0; itype:8; dsize:1; content:"?"; classtype:misc-activity; sid:5110011; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Domain Controller ICMP Traffic"; icode:0; itype:0; dsize:1; content:"?"; classtype:misc-activity; sid:5110012; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: McAfee ICMP ping Request"; icode:0; itype:8; dsize:36; content:"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"; offset:3; classtype:misc-activity; sid:5110013; rev:2;)
pass icmp any any -> any any (msg:"Whitecap: McAfee ICMP ping Reply"; icode:0; itype:0; dsize:36; content:"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"; offset:3; classtype:misc-activity; sid:5110014; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Lots of Xs"; icode:0; itype:8; dsize:32; content:"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; classtype:misc-activity; sid:5110015; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Lots of Xs"; icode:0; itype:0; dsize:32; content:"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; classtype:misc-activity; sid:5110016; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: DHCP ICMP Duplicate IP Check"; icode:0; itype:8; dsize:11; content:"DhcpIcmpChk"; classtype:misc-activity; sid:5110017; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: DHCP ICMP Duplicate IP Check"; icode:0; itype:0; dsize:11; content:"DhcpIcmpChk"; classtype:misc-activity; sid:5110018; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Solarwinds ICMP Version 5"; icode:0; itype:8; dsize:<80; content:"SolarWinds.Net ICMP Version 5.0.4.16Copyright  1995-2005 SolarWinds.Net"; classtype:misc-activity; sid:5110019; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Solarwinds ICMP Version 5"; icode:0; itype:0; dsize:<80; content:"SolarWinds.Net ICMP Version 5.0.4.16Copyright  1995-2005 SolarWinds.Net"; classtype:misc-activity; sid:5110020; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Solarwinds Sonar ICMP Scan"; icode:0; itype:8; dsize:24; content:"Orion Network Sonar Scan"; classtype:misc-activity; sid:5110021; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Solarwinds Sonar ICMP Scan"; icode:0; itype:0; dsize:24; content:"Orion Network Sonar Scan"; classtype:misc-activity; sid:5110022; rev:1;)
pass icmp any any -> $DNS_SERVERS any (msg:"Whitecap: ICMP to DNS Servers"; icode:0; itype:8; dsize:<57; classtype:misc-activity; threshold:type limit, track by_src, count 1, seconds 60; sid:5110500; rev:2;) 
pass icmp any any -> $DNS_SERVERS any (msg:"Whitecap: ICMP to DNS Servers"; icode:0; itype:0; dsize:<57; classtype:misc-activity; threshold:type limit, track by_src, count 1, seconds 60; sid:5110501; rev:2;) 
pass icmp any any -> any any (msg:"Whitecap: Domain controller to domain controller"; icode:0; itype:8; dsize:32; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; classtype:misc-activity; threshold:type limit, track by_src, count 1, seconds 60; sid:5110502; rev:2;)
pass icmp any any -> any any (msg:"Whitecap: Domain controller to domain controller"; icode:0; itype:0; dsize:32; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; classtype:misc-activity; threshold:type limit, track by_src, count 1, seconds 60; sid:5110503; rev:2;)
pass icmp any any -> any any (msg:"Whitecap: All As"; icode:0; itype:8; dsize:64; content:"|AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA|"; classtype:misc-activity; sid:5110504; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: All As"; icode:0; itype:0; dsize:64; content:"|AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA|"; classtype:misc-activity; sid:5110505; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: All 0s"; icode:0; itype:8; dsize:56; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; classtype:misc-activity; sid:5110506; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: All 0s"; icode:0; itype:0; dsize:56; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; classtype:misc-activity; sid:5110507; rev:1;)
pass icmp [$ICMP_SRC_HOSTS_IGNORE] any -> any any (msg:"ICMP Pass: Ignore Hosts"; icode:0; itype:8; classtype:misc-activity; sid:5111000; rev:1;)
pass icmp [$ICMP_SRC_HOSTS_IGNORE] any -> any any (msg:"ICMP Pass: Ignore Hosts"; icode:0; itype:0; classtype:misc-activity; sid:5111001; rev:1;)
pass icmp any any -> [$ICMP_DST_HOSTS_IGNORE] any (msg:"ICMP Pass: Ignore Hosts"; icode:0; itype:8; classtype:misc-activity; sid:5111002; rev:1;)
pass icmp any any -> [$ICMP_DST_HOSTS_IGNORE] any (msg:"ICMP Pass: Ignore Hosts"; icode:0; itype:0; classtype:misc-activity; sid:5111003; rev:1;)

    3,檢測包大于多少，或者發送頻率高于某個數，報警

    alert icmp any any -> any any (msg:"Whitecap Echo Request Payload > 100 bytes"; icode:0; itype:8; dsize:>100; classtype:misc-activity; sid:5113000; rev:1;)
alert icmp any any -> any any (msg:"Whitecap Echo Reply Payload > 100 bytes"; icode:0; itype:0; dsize:>100; classtype:misc-activity; sid:5113001; rev:1;)

    4, 檢測 Data里面包含的特殊字段報警（例子是檢測base64）

    drop icmp any any -> any any (msg:"LOCAL ICMP Large ICMP Packet (Base64)"; dsize:>800; content:"="; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/"; reference:url,www.notsosecure.com/2015/10/15/icmp-tunnels-a-case-study/; classtype:bad-unknown; sid:1000028; rev:1;)
    icmpdata
    本作品采用《CC 協議》，轉載必須注明作者和本文鏈接
    NIDS（suricata） 中的 ICMP隱蔽隧道檢測
    2021-12-24 08:32:25
    一個ICMP報文包括IP報頭、ICMP報頭和ICMP報文。當IP報頭中的協議字段值為1時，就說明這是一個ICMP報文。
    信息熵在ICMP隧道檢測中的實踐
    2021-11-02 14:02:41
    ICMP協議通常用來測試網絡通不通、主機可不可達、路由可不可用。宅男們打游戲時也常用來ping一下，看看延遲高不高，太高迅雷就得關一關了。 而網絡攻擊者通過ICMP協議，可以進行隧道傳輸，實現數據竊取，規避掉一些防火墻規則。 如何檢測這種隧道？用傳統的簽名無法對抗負載加密，復雜的統計比對讓檢測引擎不堪重負，準確率也不高。 而基于ICMP常規的通訊數據和攻擊時產生的畸形數據，利用信息熵來分析，
    淺析Icmp原理及隱蔽攻擊的方式
    2021-11-26 06:38:49
    它是TCP/IP協議簇的一個子協議，用于在IP主機、路由器之間傳遞控制消息。這些控制消息雖然并不傳輸用戶數據，但是對于用戶數據的傳遞起著重要的作用ICMP協議主要提供兩種功能，一種是差錯報文，一種是信息類報文。標識符和序號字段分別是16 位的字段。對于標識符，應用程序執行期間送出的所有報文里填入相同的值。例如，icmptunnel會在所有的ICMP payload前添加”TUNL”標記來識別隧道。
    ICMPWatch：一款功能強大的ICMP數據包嗅探工具
    2023-11-06 14:55:17
    ICMPWatch是一款功能強大的ICMP數據包嗅探工具，該工具基于Python 3開發，可以幫助廣大研究人員捕捉和分析ICMP（Internet控制報文協議）數據包。該工具能提供有關捕捉數據包的詳細信息，包括數據包源IP地址、目標IP地址、MAC地址、ICMP類型以及Payload數據等。除此之外，該工具還支持將捕捉到的數據包存儲到SQLite數據庫中，并以pcap格式保存。
    CTF—流量分析題型整理總結
    2021-10-13 06:38:17
    我見過的流量分析類型的題目總結： 一，ping 報文信息? 二，上傳/下載文件 三，sql注入攻擊 四，訪問特定的加密解密網站 五，后臺掃描+弱密碼爆破+菜刀 六，usb流量分析 七，WiFi無線密碼破解 八，根據一組流量包了解黑客的具體行為例題：一，ping 報文信息?如果是菜刀下載文件的流量，需要刪除分組字節流前開頭和結尾的X@Y字符，否則下載的文件會出錯。
    內網滲透-判斷內網連通性
    2022-01-15 07:10:02
    判斷內網的連通性是指判斷機器能否上外網等。需要綜合判斷各種協議及端口通信的方式。
    CyberScan – 網絡取證工具包
    2023-05-10 13:55:56
    CyberScan是一個開源的網絡取證滲透測試工具包，可以分析IP，包括（緯度，經度，區域，國家……）的數據包，解碼，掃描端口，ping和地理定位。CyberScan模塊用法CyberScan能夠發送和捕獲多個協議的數據包，偽造并對它們進行解碼以用于大多數網絡任務，如掃描，ping，探測和攻擊。Pinging 網絡CyberScan支持使用多種協議執行ping操作，在本地以太網上發現主機的最快方法是使用ARP：ARP Ping$ CyberScan -s 192.168.1.0/24 -p arp. Received 0 packets, got 0 answers, remaining 256 packets. WARNING: No route found for IPv6 destination :: (no default route?
    發現內網存活主機的各種姿勢
    2022-08-12 08:05:09
    在滲透中，當我們拿下一臺服務器作為跳板機進一步進行內網滲透時，往往需要通過主機存活探測和端口掃描來收集內網資
    VSole
    網絡安全專家
      亚洲 欧美 自拍 唯美 另类