Bug #5162: inspection of smb traffic without smb/dcerpc doesn't work correct. - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #5162

closed

inspection of smb traffic without smb/dcerpc doesn't work correct.

Added by Brandon Murphy about 2 years ago. Updated over 1 year ago.

Status:

Closed

Priority:

Normal

Assignee:

Victor Julien

Target version:

7.0.0-beta1

Affected Versions:

4.1.7, 5.0.8, 6.0.4, git master

Effort:

Difficulty:

Label:

Description

This is a very strange issue, I haven't a clue what is going on. In trying to figure out how to write this up, I seem to have found multiple ways to reproduce it.

Suricata 4.0.x appears to be unaffected by this.

Method 1¶

Consider the following rules.

alert tcp any any -> any 445 (msg:"SVCCTL CreateService Command via SMB"; flow:established,to_server; content:"SMB"; depth:8; content:"|09 00|"; distance:8; within:2; content:"|05 00 00|"; distance:0; content:"|0c 00|"; distance:19; within:2; content:"|15 00 00 00|"; distance:20; within:4; sid:1;)
alert tcp any any -> any 445 (msg:"SVCCTL CreateService Command via SMB"; flow:established,to_server; content:"|fe|SMB"; depth:8; content:"|09 00|"; distance:8; within:2; content:"|05 00 00|"; distance:0; content:"|0c 00|"; distance:19; within:2; content:"|15 00 00 00|"; distance:20; within:4; sid:2;)

The only difference in these two signatures is that sid:2; contains and extra byte in the first content match.

Only sid:2; alerts, despite, logically sid:1; should as well.

02/25/2022-16:33:47.258334  [**] [1:2:0] SVCCTL CreateService Command via SMB [**] [Classification: (null)] [Priority: 3] {TCP} 192.168.56.104:62618 -> 192.168.56.102:445
02/25/2022-16:33:47.426685  [**] [1:2:0] SVCCTL CreateService Command via SMB [**] [Classification: (null)] [Priority: 3] {TCP} 192.168.56.104:62619 -> 192.168.56.102:445

Method 1 - Workaround¶

Making use of a standalone "within" instead of a distance/within combination appears to work

alert tcp any any -> any 445 (msg:"SVCCTL CreateService Command via SMB"; flow:established,to_server; content:"SMB"; depth:8; content:"|09 00|"; distance:8; within:2; content:"|05 00 00|"; distance:0; content:"|0c 00|"; distance:19; within:2; content:"|15 00 00 00|"; within:24; sid:10;)

02/25/2022-16:33:47.258334  [**] [1:10:0] SVCCTL CreateService Command via SMB [**] [Classification: (null)] [Priority: 3] {TCP} 192.168.56.104:62618 -> 192.168.56.102:445
02/25/2022-16:33:47.426685  [**] [1:10:0] SVCCTL CreateService Command via SMB [**] [Classification: (null)] [Priority: 3] {TCP} 192.168.56.104:62619 -> 192.168.56.102:445

I have no idea why this works....

Method 2¶

Consider the following rules (separate or combined with the above rules, doesn't seem to matter) - I've just used the version that includes the |fe| to isolate/replicate the problem in another way.

alert tcp any any -> any 445 (msg:"SVCCTL CreateService Command via SMB"; flow:established,to_server; content:"|fe|SMB"; depth:8; content:"|09 00|"; distance:8; within:2; content:"|05 00 00|"; distance:0; content:"|0c 00|"; distance:19; within:2; content:"|15 00 00 00 00|"; distance:20; within:5; sid:3;)
alert tcp any any -> any 445 (msg:"SVCCTL CreateService Command via SMB"; flow:established,to_server; content:"|fe|SMB"; depth:8; content:"|09 00|"; distance:8; within:2; content:"|05 00 00|"; distance:0; content:"|0c 00|"; distance:19; within:2; content:"|15 00 00 00|"; distance:20; within:4; pcre:"/^\x00/R"; sid:4;)

Only sid:4; alerts, despite, the logic contained in sid:4; proving that sid:3 should have alerted as well.

02/25/2022-16:33:47.258334  [**] [1:4:0] SVCCTL CreateService Command via SMB [**] [Classification: (null)] [Priority: 3] {TCP} 192.168.56.104:62618 -> 192.168.56.102:445
02/25/2022-16:33:47.426685  [**] [1:4:0] SVCCTL CreateService Command via SMB [**] [Classification: (null)] [Priority: 3] {TCP} 192.168.56.104:62619 -> 192.168.56.102:445

Files

cool_1.pcap (377 KB) cool_1.pcap

Brandon Murphy, 02/26/2022 04:38 PM

Subtasks 2 (0 open — 2 closed)

Related issues 1 (0 open — 1 closed)

Actions

Copy link

Updated by Brandon Murphy about 2 years ago

File cool_1.pcap cool_1.pcap added

I forgot the pcap

Actions

Copy link

Updated by Brandon Murphy about 2 years ago

Quick update - this appears, to maybe be related to https://redmine.openinfosecfoundation.org/issues/5197? I'm not 100% sure, but I was able to replicate the same behavior with the following rules. sid:1; is the same as previously reported in this ticket and the only difference between these two rules is the fast_pattern assignment to "SMB" on sid:11;

alert tcp any any -> any 445 (msg:"SVCCTL CreateService Command via SMB"; flow:established,to_server; content:"SMB"; depth:8; content:"|09 00|"; distance:8; within:2; content:"|05 00 00|"; distance:0; content:"|0c 00|"; distance:19; within:2; content:"|15 00 00 00|"; distance:20; within:4; sid:1;)
alert tcp any any -> any 445 (msg:"SVCCTL CreateService Command via SMB"; flow:established,to_server; content:"SMB"; depth:8; fast_pattern; content:"|09 00|"; distance:8; within:2; content:"|05 00 00|"; distance:0; content:"|0c 00|"; distance:19; within:2; content:"|15 00 00 00|"; distance:20; within:4; sid:11;)

Fast Pattern analysis

-------------------------------------------------------------------
Date: 19/3/2022 -- 00:50:03
-------------------------------------------------------------------
== Sid: 1 ==
alert tcp any any -> any 445 (msg:"SVCCTL CreateService Command via SMB"; flow:established,to_server; content:"SMB"; depth:8; content:"|09 00|"; distance:8; within:2; content:"|05 00 00|"; distance:0; content:"|0c 00|"; distance:19; within:2; content:"|15 00 00 00|"; distance:20; within:4; sid:1;)
    Fast Pattern analysis:
        Fast pattern matcher: content
        Flags: Within Distance
        Fast pattern set: no
        Fast pattern only set: no
        Fast pattern chop set: no
        Original content: \x15\x00\x00\x00
        Final content: \x15\x00\x00\x00

== Sid: 11 ==
alert tcp any any -> any 445 (msg:"SVCCTL CreateService Command via SMB"; flow:established,to_server; content:"SMB"; depth:8; fast_pattern; content:"|09 00|"; distance:8; within:2; content:"|05 00 00|"; distance:0; content:"|0c 00|"; distance:19; within:2; content:"|15 00 00 00|"; distance:20; within:4; sid:11;)
    Fast Pattern analysis:
        Fast pattern matcher: content
        Flags: Depth
        Fast pattern set: yes
        Fast pattern only set: no
        Fast pattern chop set: no
        Original content: SMB
        Final content: SMB

============
Summary:
============
packet/stream payload, smallest pattern 3 byte(s), longest pattern 4 byte(s), number of patterns 2, avg pattern len 3.50 byte(s)

Only sid:11; fires

02/25/2022-16:33:47.258334  [**] [1:11:0] SVCCTL CreateService Command via SMB [**] [Classification: (null)] [Priority: 3] {TCP} 192.168.56.104:62618 -> 192.168.56.102:445
02/25/2022-16:33:47.426685  [**] [1:11:0] SVCCTL CreateService Command via SMB [**] [Classification: (null)] [Priority: 3] {TCP} 192.168.56.104:62619 -> 192.168.56.102:445

Actions

Copy link