Research Project 2: Metasploit-able Honeypots Research questions - - PowerPoint PPT Presentation

▶
research project 2 metasploit able honeypots
SMART_READER_LITE
LIVE PREVIEW

Research Project 2: Metasploit-able Honeypots Research questions - - PowerPoint PPT Presentation

Aug 29, 2022 320 likes •625 views

Metasploit- able Honeypots Wouter Katz Research Project 2: Metasploit-able Honeypots Research questions Introduction Approach Wouter Katz Results wouter.katz@os3.nl Conclusions References University of Amsterdam July 4th 2013 Wouter

slide-1
SLIDE 1

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Research Project 2: Metasploit-able Honeypots

Wouter Katz wouter.katz@os3.nl

University of Amsterdam

July 4th 2013

Wouter Katz Metasploit-able Honeypots

slide-2
SLIDE 2

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Research questions

How feasible is an automated method to detect specific exploits on a honeypot by monitoring network traffic of exploits?

  • What setup is needed in order to have exploits successfully

complete their exploit against a honeypot?

  • What is the best method to process network traffic

to/from the honeypot to extract and match a unique signature from exploit traffic?

  • How successful are these methods?

Wouter Katz Metasploit-able Honeypots

slide-3
SLIDE 3

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Research questions summarized

Protocol independent

Wouter Katz Metasploit-able Honeypots

slide-4
SLIDE 4

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Introduction

Wouter Katz Metasploit-able Honeypots

slide-5
SLIDE 5

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Introduction

Wouter Katz Metasploit-able Honeypots

slide-6
SLIDE 6

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Introduction

Wouter Katz Metasploit-able Honeypots

slide-7
SLIDE 7

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Introduction

Wouter Katz Metasploit-able Honeypots

slide-8
SLIDE 8

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Introduction

Wouter Katz Metasploit-able Honeypots

slide-9
SLIDE 9

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Introduction

Wouter Katz Metasploit-able Honeypots

slide-10
SLIDE 10

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Why is this needed?

  • A lot of the honeypot software contain outdated

vulnerabilities

  • Analysis of what happened requires manual analysis
  • Having signatures for the most-used penetration testing

tool allows for valuable insight in attackers’ activities What we want is to automatically detect modern exploits and show which exploits were detected.

Wouter Katz Metasploit-able Honeypots

slide-11
SLIDE 11

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Exploits used within Metasploit

Within Metasploit, exploits targeting FTP server software were chosen as a test set for the research:

  • Large number of exploits (37)
  • FTP is plain-text protocol, makes development easier
  • Simple commands/responses

Wouter Katz Metasploit-able Honeypots

slide-12
SLIDE 12

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Testing environment

Wouter Katz Metasploit-able Honeypots

slide-13
SLIDE 13

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Process

Wouter Katz Metasploit-able Honeypots

slide-14
SLIDE 14

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Python honeypot script

  • Small database with 30 vulnerable FTP banners for all 37

exploits

  • Implemented responses to most used FTP commands
  • Saves all traffic
  • Detect ”suspicious” traffic

Wouter Katz Metasploit-able Honeypots

slide-15
SLIDE 15

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Detect suspicious traffic

Wouter Katz Metasploit-able Honeypots

slide-16
SLIDE 16

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Extract signatures from suspicious traffic

  • Collect multiple suspicious flows for the same exploit,

different payload

  • Find the longest string shared by all suspicious flows using

the Longest Common Substring (LCS) algorithm

  • The resulting string will be used as signature
  • This method depends on static parts in the exploit,

regardless of the payload

Wouter Katz Metasploit-able Honeypots

slide-17
SLIDE 17

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Extract signatures from suspicious traffic

Flow 1: ffeeddccacbefafabcdefbafcbaedfeaf Flow 2: aabcbeafffeeddccafbdeaabcdefbcffea Flow 3: feabcdefbfeacceafeabceffaecbeafabcaedd The string ”ffeeddcc” is the longest common substring in the first 2 flows, but it does not occur in the 3rd flow.

Wouter Katz Metasploit-able Honeypots

slide-18
SLIDE 18

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Extract signatures from suspicious traffic

Flow 1: ffeeddccacbefafabcdefbafcbaedfeaf Flow 2: aabcbeafffeeddccafbdeaabcdeffcffea Flow 3: feabcdefafeacceafeabceffaecbeafabcaedd The string ”abcdef” is the longest common substring occurring in all flows. This will be the signature.

Wouter Katz Metasploit-able Honeypots

slide-19
SLIDE 19

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Extract signatures from suspicious traffic

LCS found ”good” signatures for 20 exploits from their suspicious traffic flows. The rest either had no signature, or a too generic signature (e.g. ”USER”). Solution: for the remaining exploits, run LCS on all other flows. Resulted in 12 ”good” signatures for the remaining 17 exploits.

Wouter Katz Metasploit-able Honeypots

slide-20
SLIDE 20

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Matching signatures against traffic

With the signatures, we should be able to detect exploits:

  • Check each incoming flow in the honeypot for known

signatures

  • If a signature is found, print out the matching exploit

Wouter Katz Metasploit-able Honeypots

slide-21
SLIDE 21

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Matching signatures against traffic

Problem: some exploits share the same signature, causing false positives. Easy solution: only check for signatures of exploits belonging to the current FTP banner.

Wouter Katz Metasploit-able Honeypots

slide-22
SLIDE 22

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Results

In total found signatures for 32 out of 37 exploits (86%). Test how good these signatures detect exploits by firing all exploits against the FTP honeypot script, with every possible payload.

Wouter Katz Metasploit-able Honeypots

slide-23
SLIDE 23

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Results

Average detection rate of 89.95%

Wouter Katz Metasploit-able Honeypots

slide-24
SLIDE 24

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Answering the research questions

How feasible is an automated method to detect specific exploits on a honeypot by monitoring network traffic of exploits?

  • What setup is needed in order to have exploits successfully

complete their exploit against a honeypot?

  • What is the best method to process network traffic

to/from the honeypot to extract and match a unique signature from exploit traffic?

  • How successful are these methods?

Wouter Katz Metasploit-able Honeypots

slide-25
SLIDE 25

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Answering the research questions

What setup is needed in order to have exploits successfully complete their exploit against a honeypot? Many of the exploits check FTP banner and correct FTP

  • responses. In order to allow exploits to complete successfully,

we need to emulate both the banner and the correct responses.

Wouter Katz Metasploit-able Honeypots

slide-26
SLIDE 26

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Answering the research questions

What is the best method to process network traffic to/from the honeypot to extract and match a unique signature from exploit traffic? In this research, a granular method of storing and processing network traffic was used. Extract signatures using the LCS algorithm, match traffic against signatures on-the-fly proved very effective.

Wouter Katz Metasploit-able Honeypots

slide-27
SLIDE 27

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Answering the research questions

How successful are these methods? Not all exploits yielded a signature, but for the exploits that did, most signatures have a high detection rate.

Wouter Katz Metasploit-able Honeypots

slide-28
SLIDE 28

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Answering the research questions

How feasible is an automated method to detect specific exploits on a honeypot by monitoring network traffic of exploits? The methods presented work very well. Easily portable to other protocols/exploits. Can work standalone or as part of existing honeypot software.

Wouter Katz Metasploit-able Honeypots

slide-29
SLIDE 29

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

Questions

Questions?

Wouter Katz Metasploit-able Honeypots

slide-30
SLIDE 30

Metasploit- able Honeypots Wouter Katz Research questions Introduction Approach Results Conclusions References

References

Anley, Chris, Heasman, John, Lindner, Felix, & Richarte,

  • Gerardo. 2011.

The shellcoder’s handbook: discovering and exploiting security holes. Wiley. Baumann, Reto, & Plattner, Christian. 2002. White Paper: Honeypots.

Wouter Katz Metasploit-able Honeypots