New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

smb 检测逃逸方法 #7

Open

scarletttt opened this issue Nov 24, 2020 · 0 comments

Owner

scarletttt commented Nov 24, 2020 •

edited

Loading

smb协议解析：https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-cifs/089b6f3e-b91d-4659-83a7-3e50a1a5faf7?redirectedfrom=MSDN

SMB_COM_READ_ANDX:https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-cifs/7e6c7cc2-c3f1-4335-8263-d7412f77140e

逃逸方法：http://netsecinfo.blogspot.com/2010/04/smb-evasions-by-attackers-tips-to.html

总结一下，基于特征匹配的入侵检测逃逸方法：

乱序
填充
多个连续信息
信息分片

总结来说，安全检测设备要想避免这些逃逸方法，最好的办法是，终端设备怎么处理这些报文，安全设备就怎么处理这些报文。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment