Search code examples
linuxsnortpenetration-testing

Snort signature explanation

SHELLCODE x86 OS agnostic fnstenv geteip dword xor decoder [Classification: Executable Code was Detected] [Priority: 1] {TCP} 192.168.202.50:60322 -> 192.168.22.252:445

1) what does this alert mean? what is the signature is looking for? and if its get through what will happen? 2) Which ip is the attacker?

2)Data on SYN packet [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 192.168.199.58:63000 -> 192.168.28.100:60000

1) what does this alert mean? what is the signature is looking for? and if its get through what will happen? 2) in which part of the snort architecture this alert came from?

3)SPYWARE-PUT Hacker-Tool timbuktu pro runtime detection - udp port 407 [Classification: Misc activity] [Priority: 3] {UDP} 192.168.199.58:59173 -> 192.168.22.201:407 1) what does this alert mean? what is the signature is looking for? and if its get through what will happen? 2) who is host and who is victim?

4) snort: [1:3815:6] SMTP eXchange POP3 mail server overflow attempt [Classification: Misc Attack] [Priority: 2] {TCP} 192.168.199.58:60327 -> 192.168.21.151:25 1) what does this alert mean? what is the signature is looking for? and if its get through what will happen? 2) who is host and who is attacker?

I have done a ton of searchers but could not understand or find any details information about those signature. please help

Solution

  • So, let me structure this in one Answer:

    1)

    • This event indicates that shellcode has been detected in network traffic so if that code gets through, and gets executed you end up with a backdoor.

    • 192.168.202.50:60322 seems to be the attacking IP and it is trying to exploit some vulnerability on the Windows box 192.168.22.252:445

    2)

    • 192.168.199.58:63000 -> 192.168.28.100:60000 = for this I am not sure, as port 60000 could be used for various things..

    3)

    • SPYWARE-PUT Hacker-Tool timbuktu pro runtime detection - udp port 407 = this is a bit self explanatory .. 192.168.199.58:59173 is trying to push requests towards 192.168.22.201 port 407..

    4)

    • Same for 192.168.199.58:60327 trying to exploit a memory overfly towards SMTP on: 192.168.21.151:25

    But in all those cases, it seems 192.168.199.58 is probably exploited, or something from that box is probing the LAN network..

    I would also scan 192.168.199.50 and .58 to figure out who is on those boxes, any current connections from foreign addresses, that might have exploited these two boxes..