Frank,
Thanks for the feedback.
The original rule only specified one attack path URL, turns out that
there are several attack URL's all having to use "TwikiUsers?rev=".
Second of all, shell code can only be executed in Twiki if you use a
metacharacter to jump it to shell..
However, you are correct in saying that it could be evaded. The
backtick will actually stop the command. It will cease to run the
function. However, they don't state than any other metacharacter
can jump it to shell either. They only example they give is the "|"
command will jump it to shell. So... there are two methods to the
madness here, after much discussion internally with many other wise
SOURCEfire employees, Jason Brvenik had the idea to look for anything
that is a number followed by anything that is not a number, or "&",
or a new line. We also wrote a rule with some pcre to look for
every metacharacter after the rev number, however, we found that this
method was much more efficient.
I saw that you and Brvenik had a discussion in #snort on
irc.freenode.net last night, and you updated the original rule with
the advanced pcre. So cool.. I have also resubmitted the rule into
Community. If accepted it will go into the community ruleset at
http://www.snort.org/pub-bin/downloads.cgi#COMM . I apologize for
any confusion.
So:
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-
MISC Twiki shell command execution"; flow:to_server,established;
uricontent:"/TwikiUsers?"; nocase; pcre:"/rev=\d*[^\d\&\n]/Ui";
classtype:web-application-activity; reference:url,secunia.com/
advisories/16820/; rev:3;)
Would be more accurate.
Joel
On Sep 17, 2005, at 2:20 PM, Frank Knobbe wrote:
On Fri, 2005-09-16 at 08:01 -0400, Joel Esler wrote:
Chas I took your rule that you provided yesterday and made it more
accurate. I submitted this rule for inclusion into the officially
community ruleset.
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-
MISC Twiki shell command execution"; flow:to_server,established;
uricontent:"/TwikiUsers?rev="; content:"|60|"; classtype:web-
application-activity; sid:<waitingonsid>; rev:2;)
I don't know if that is "more" accurate. You just modified the rule so
that it is subject to easy evasion. Perhaps you want to rethink the
rule.
Cheers,
Frank
--
Ciscogate: Shame on Cisco. Double-Shame on ISS.
-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
