Root Entropy

Edit: Added short guide from Ryan Dewhurst (@ethicalhack3r) on how to get it running on Ubuntu [see bottom of post].

MS11-083 has arrived and people are getting both excited and scared, it looks like its going to be the next MS08-067. Which if you remember, Conficker used to bend windows over and have a jol. Time for a honeypot?

Disclaimer: This script is not intended to be a complete, efficient or stable. It’s just quick and dirty.

In anycase I took a moment and decided to write a script that would capture potential MS11-083 traffic in an attempt to capture this exploit in the wild (once its out there, might as well start looking). According to the security bulletin “The vulnerability could allow remote code execution if an attacker sends a continuous flow of specially crafted UDP packets to a closed port on a target system”. So that’s exactly what I looked at, I used netstat -un and -lun to find all open and listening ports and filtered them out. UDP packets to a closed port normally results in a ICMP Port Unreachable response or no response at all, so I’ve ignored them.

The code is commented and you need the little bash script in the same folder to get the ports. Remember to make it executable (sudo chmod +x getports.sh) and run ms11-083_sniffer.py as root. It will create a pcap file named the <current datetime.pcap> and any UDP traffic heading towards a closed port will be logged.

Once you have some pcaps and you think they might contain exploit traffic remember that sharing is caring and karma is a bitch, don’t share if it was just Chuck Testa. My code is dirty and I wrote it quickly so don’t hate, feel free to modify and make it better (in fact, you probably should).

I’ll try and add my nmap enumeration script tomorrow, it does a portscan and OS fingerprint on a given host and inserts that data into a sqlitedb. That way you can check if the traffic was coming from a windows host.

ms11-083_sniffer.py

getports.sh

With the bash script, just remove the .txt file extension (my hosting is being annoying). Below is the code if you want to have a peek.

from pcapy import *
from impacket import ImpactDecoder, ImpactPacket
from socket import *
import fcntl
import struct
import os
import time

class Sniffer:    
    def __init__(self):
        self.promiscuous = True
        self.called = 0 #silly habits
        self.interface = 'eth0'
        self.max_bytes = 65535  # Theoretical max size for a UDP packet
        self.read_timeout = 100
        self.ip = self.get_ip_address(self.interface)
        self.bpf = 'ip dst host %s and not src net 192.168.1.0/30'%self.ip
        
        print "\n---------------------------------------------------"
        print "Sniffing for unsolicited UDP packets to closed ports."
        print "      \"Open ports are for losers\" - MS11-083"
        print "Pcap log started, listening from %s"%time.strftime("%d:%m:%Y %H:%M:%S", time.localtime())
        print "---------------------------------------------------"
 
    def get_ip_address(self, ifname):
        s = socket(AF_INET, SOCK_STREAM)
        return inet_ntoa(fcntl.ioctl(s.fileno(), 0x8915, struct.pack('256s', ifname[:15]))[20:24])
    
    def start(self):
        self.reader = open_live(self.interface, self.max_bytes, self.promiscuous, self.read_timeout)
        # Pcapy uses BPF to filter packets, not src net 192.168.1.0/30 
        # should be changed, it just filters out 1.0, 1.1, 1.2 and 1.3
        # which I use for diffrent gateways and dont want traffic
        # from the router hitting the logs.
        self.reader.setfilter(self.bpf)
        # Run the packet capture loop
        self.reader.loop(0, self.callback)
          
    def callonce(self):
        self.dumper = self.reader.dump_open(time.strftime("%d-%m-%Y_%H-%M-%S.pcap", time.localtime()))    
        self.called = 1
    
    def callback(self, hdr, data):  
        # Parse the Ethernet packet
        decoder = ImpactDecoder.EthDecoder()
        ether = decoder.decode(data)
        # Parse the IP packet inside the Ethernet packet, typep
        iphdr = ether.child()
        udphdr = iphdr.child()
        
        # First check that the packets are not comming from the local host
        # Then check that it is a UDP packet (incase you changed the BPF) also
        # Check that the destination port for the packet is a closed port on the host
        if (iphdr.get_ip_src() != self.ip):
            self.refresh_portlist()
            if (iphdr.get_ip_p() == ImpactPacket.UDP.protocol and udphdr.get_uh_dport() not in self.portlist):
                if self.called == 0:
                    self.callonce()
                print "Incoming UDP packet from %s"%iphdr.get_ip_src()
                self.dumper.dump(hdr, data)
     
    def refresh_portlist(self):
        # bash script to get all the open and listening UDP ports
        # used in the callback function as criteria for logging traffic  
        output = os.popen("./getports.sh")
        pl = output.readlines()
        self.portlist = []
        for p in pl:
            self.portlist.append(int(p))
                    
def main():
    snf = Sniffer()
    snf.start()

if __name__ == "__main__":
    main()

Getting it up and running:

If anyone is stuck getting this working on ubuntu, Ryan Dewhurst (http://www.ethicalhack3r.co.uk/) made a short guide. Thanks!

Getting ms11-083_sniffer.py running on Ubuntu:

wget http://rootentropy.co.za/honeypot/ms11-083_sniffer.py
wget http://rootentropy.co.za/honeypot/getports.sh.txt
mv getports.sh.txt getports.sh
sudo chmod +x getports.sh
sudo apt-get install g++ python2.7-dev libpcap-dev
get http://oss.coresecurity.com/repo/pcapy-0.10.5.tar.gz
tar -xvf pcapy-0.10.5.tar.gz
cd pcapy-0.10.5/
sudo python setup.py install
cd ..
wget http://oss.coresecurity.com/repo/Impacket-0.9.6.0.tar.gz
tar -xvf Impacket-0.9.6.0.tar.gz
cd Impacket-0.9.6.0/
sudo python setup.py install
cd ..

I had to change line 82 in ms11-083_sniffer.py to include ‘sh’:
output = os.popen(“sh ./getports.sh”)

Then just run:
sudo python ms11-083_sniffer.py