I am given a VM of a server running a vulnerable version of ProFTP and a attacker VM which exploits the server using an exploit provided with MetaSploit. I need to write a Snort rule to detect potential malicious attacks on the server as a part of my class assignment. Looking at the exploit code I can easily write a rule to look for the keyword
\x8d\xa0\xfc\xdf\xff\xff (as my vulnerable Vm is an Ubuntu machine). However, that would be pretty lame and also writing patches specific to the code of the exploit is not a good practice. I would like the rule to apply even if the exploit code is changed.
I have read about the bug and I know that the presence of special IAC character (255 or
\xFF) would potentially lead to buffer overflow. However, any normal packet could contain
\xFF and writing a rule for detecting
\xFF would to false positives. I want to know some specific details of the exploit which would either help me figure out where I need to look for the IAC character or help me find some details about the exploit which would allow me to find malicious packets without having to resort to look for IAC character
\xFF. How do I go about doing that? Any help or pointers would be appreciated.
Currently, I have installed udcli to try to understand the commands in the
ROPStack portion of the code. For ex: I am trying to evaluate line 100 (
0x805a544, # mov eax,esi / pop ebx / pop esi / pop ebp / ret) in the code. I have tried:
echo "08 05 a5 44" | udcli -32 -x echo "805a544" | udcli -32 -x echo "44 a5 05 08" | udcli -32 -x echo "44 a5 05 80" | udcli -32 -x
But none of them evaluates to the following sequence
mov eax,esi pop ebx pop esi pop ebp ret