藍隊工具小抄

tags: 藍隊 資安

Suricata

https://docs.suricata.io/en/latest/rules/index.html

rule format

<action> <protocol> <src ip> <src port> <direction> <dst ip> <dst port> (<rule option>; <rule option>)

actions

• alert : 發出告警訊息
• pass : 接受封包
• drop : 丟棄封包，不會發出訊息給來源端，同時發出告警訊息
• reject : 拒絕封包，會發送 RST / ICMP 錯誤訊息給來源端，此外也會發出告警訊息
• rejectsrc : 與 reject 相同
• rejectdst : 與 reject 相同，但是是發送給⽬的端
• rejectboth : 與 reject 相同，但是是發送給來源端和⽬的端

header

• ip: CIDR, ! inverse, [] grouping, any, $HOME_NET
• port: : range, ! inverse, [] grouping, any
• direction: ->, <>

example

• alert tls any any -> any any (msg: "[TLS test] client hello"; ssl_state: client_hello; sid: 1;)
• alert tcp any any -> $HOME_NET any (msg: "[SYN Scan test]"; tcp.flags: S; threshold: type both, track by_dst, count 1000, seconds 3; sid: 1;)

Yara

https://yara.readthedocs.io/en/stable/writingrules.html

rule format

rule <rule name>
{
    meta:
        <metadata> = <metadata>
    strings:
        $<string name> = "<string>"
        $<string name> = { <hex string> }
    condition:
        $<string name> <op> $<string name>
}

metadata

optional

condition

• and, or
• #<string name> counting
• at offset, in (<start>..<end>) range
• filesize file size keyword
• entrypoint entrypoint keyword
• uint32(<addr>) address pointer
• <number> of ($<string name>, $<string name>)
• for expression of string_set : ( boolean_expression )

example

rule silent_banker
{
    meta:
        description = "This is just an example" 
        threat_level = 3
        in_the_wild = true
    strings:
        $a = {6A 40 68 00 30 00 00 6A 14 8D 91}
        $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9} 
        $c = "UVODFRYSIHLNWPEJXQZAKCBGMT"
    condition:
        $a or $b or $c
}

mitmproxy script

https://docs.mitmproxy.org/stable/api/events.html
example: https://github.com/mitmproxy/mitmproxy/blob/main/examples/addons/http-trailers.py

from mitmproxy import http
from mitmproxy.http import Headers


def request(flow: http.HTTPFlow):
    if flow.request.trailers:
        print("HTTP Trailers detected! Request contains:", flow.request.trailers)

    if flow.request.path == "/inject_trailers":
        if flow.request.is_http10:
            # HTTP/1.0 doesn't support trailers
            return
        elif flow.request.is_http11:
            if not flow.request.content:
                # Avoid sending a body on GET requests or a 0 byte chunked body with trailers.
                # Otherwise some servers return 400 Bad Request.
                return
            # HTTP 1.1 requires transfer-encoding: chunked to send trailers
            flow.request.headers["transfer-encoding"] = "chunked"
        # HTTP 2+ supports trailers on all requests/responses

        flow.request.headers["trailer"] = "x-my-injected-trailer-header"
        flow.request.trailers = Headers([(b"x-my-injected-trailer-header", b"foobar")])
        print("Injected a new request trailer...", flow.request.headers["trailer"])


def response(flow: http.HTTPFlow):
    assert flow.response
    if flow.response.trailers:
        print("HTTP Trailers detected! Response contains:", flow.response.trailers)

    if flow.request.path == "/inject_trailers":
        if flow.request.is_http10:
            return
        elif flow.request.is_http11:
            if not flow.response.content:
                return
            flow.response.headers["transfer-encoding"] = "chunked"

        flow.response.headers["trailer"] = "x-my-injected-trailer-header"
        flow.response.trailers = Headers([(b"x-my-injected-trailer-header", b"foobar")])
        print("Injected a new response trailer...", flow.response.headers["trailer"])