Practical IDS Evasion

Dave Aitel

May, 2005

www.immunitysec.com

Overview

Which IDS

Snort

What is Practical

TCP and Above

What are the Results

So far, good success

Some minor details of configuration

Reassemble ports: 21 23 25 53 80 143 110 111 513

Session timeout: 30 seconds

The version of Snort tested is found below.

1932336 Apr 20 15:05 ../snort-snapshots-CURRENT.tar.gz

Evasion Keys

URLS

Magic numbers

Optimize our “fragmentation” to only obscure the key

SMB

Recursively fun (ANDX)

Encryption, signing

Fragmentation can hide tunneled DCE-RPC from Snort and other IDS's

DCE-RPC

Ephemeral Ports

Highly complex

Tunneled through *

Encryption is good for us

Most signatures trigger on the bind

Rebinding is nice

Fragmentation

“Advanced” DCE fun

Custom ndr_marshall() routines that do fun games with pointers

Bizarre binds such as endian issues

Owning the “wrong” function

This exploits a hole in closed source policy, open source is largely immune

SunRPC (ONCRPC)

Cloaking packets (camouflage calls)

Fragmented packets

A generic alert is better than a specific alert for the attacker

Evasion Key is usually program number

XDR is easier than NDR, but complex bugs will still require a demarshaller...

HTTP

So many ways, but Immunity just does this (!=sixty second pause):

GET /!a!.!p!r!i!n!t!e!r HTTP/1.0\r\n

This works (as of May CANVAS release)

Use -C 10 or the magic slidey bar in CANVAS

Exciting 28 minute demo? :>

Conclusion

Similar techniques work on Sunlogin and other signatures

Goal: 100% Snort invisibility

Currently, only HTTP, MSRPC, DCE-RPC, and some manual effort has succeeded

They don't succeed all the time?

Some techniques may be foiled by future snort improvements

But they work now. Maybe they work on some other IDS's. ;>

2005-05-06T19:56:12