102 lines
2.4 KiB
Ruby
102 lines
2.4 KiB
Ruby
module Msf
|
|
###
|
|
#
|
|
# This class hooks all sockets created by a running exploit
|
|
# and prevents data from being sent that matches a known IPS
|
|
# signature.
|
|
#
|
|
###
|
|
|
|
class Plugin::IPSFilter < Msf::Plugin
|
|
|
|
###
|
|
#
|
|
# This class implements a socket communication logger
|
|
#
|
|
###
|
|
class IPSSocketEventHandler
|
|
include Rex::Socket::Comm::Events
|
|
|
|
def on_before_socket_create(comm, param); end
|
|
|
|
def on_socket_created(_comm, sock, param)
|
|
# Sockets created by the exploit have MsfExploit set and MsfPayload not set
|
|
if (param.context['MsfExploit'] && !param.context['MsfPayload'])
|
|
sock.extend(IPSFilter::SocketTracer)
|
|
sock.context = param.context
|
|
end
|
|
end
|
|
end
|
|
|
|
def initialize(framework, opts)
|
|
super
|
|
@ips_eh = IPSSocketEventHandler.new
|
|
Rex::Socket::Comm::Local.register_event_handler(@ips_eh)
|
|
end
|
|
|
|
def cleanup
|
|
Rex::Socket::Comm::Local.deregister_event_handler(@ips_eh)
|
|
end
|
|
|
|
def name
|
|
'ips_filter'
|
|
end
|
|
|
|
def desc
|
|
'Scans all outgoing data to see if it matches a known IPS signature'
|
|
end
|
|
|
|
end
|
|
end
|
|
|
|
# This module extends the captured socket instance
|
|
module IPSFilter
|
|
module SocketTracer
|
|
attr_accessor :context
|
|
|
|
# Hook the write method
|
|
def write(buf, opts = {})
|
|
if ips_match(buf)
|
|
print_error 'Outbound write blocked due to possible signature match'
|
|
return 0
|
|
end
|
|
super(buf, opts)
|
|
end
|
|
|
|
# Hook the read method
|
|
def read(length = nil, opts = {})
|
|
r = super(length, opts)
|
|
if ips_match(r)
|
|
print_error 'Incoming read may match a known signature'
|
|
end
|
|
return r
|
|
end
|
|
|
|
def ips_match(data)
|
|
# lp = localport
|
|
# rp = peerport
|
|
|
|
SIGS.each do |s|
|
|
r = Regexp.new(s[1])
|
|
if data.match(r)
|
|
print_error "Matched IPS signature #{s[0]}"
|
|
return true
|
|
end
|
|
rescue ::Exception
|
|
print_error "Compiled error: #{s[1]}"
|
|
end
|
|
|
|
return false
|
|
end
|
|
|
|
# Extend this as needed :-)
|
|
SIGS =
|
|
[
|
|
['DCOM.C', ".*\\\x5c\x00\\\x5c\x00\x46\x00\x58\x00\x4e\x00\x42\x00\x46\x00\x58\x00\x46\x00\x58\x00.*\xcc\xe0\xfd\x7f.*"],
|
|
['BLASTER', ".*\\\x5c\x00\\\x5c\x00\x46\x00\x58\x00\x4e\x00\x42\x00\x46\x00\x58\x00\x46\x00\x58\x00.*\xcc\xe0\xfd\x7f.*"],
|
|
['REMACT', ".*\xb8\x4a\x9f\x4d\x1c\\}\xcf\x11\x86\x1e\x00\x20\xaf\x6e.*"],
|
|
['x86 NOP SLED', "\x90\x90"],
|
|
].freeze
|
|
end
|
|
end
|