Skip to content

Commit

Permalink
Add Shellscript risk detection.
Browse files Browse the repository at this point in the history 
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
  • Loading branch information
@utoni
utoni committed Apr 7, 2024
1 parent f5905a6 commit 6b68274
Show file tree
Hide file tree
Showing 3 changed files with 62 additions and 0 deletions.
24 changes: 24 additions & 0 deletions src/lib/ndpi_main.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8160,6 +8160,29 @@ static int ndpi_is_ntop_protocol(ndpi_protocol *ret) {

/* ********************************************************************************* */

static void ndpi_search_shellscript(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow)
{
struct ndpi_packet_struct const * const packet = &ndpi_struct->packet;

NDPI_LOG_DBG(ndpi_struct, "search Shellscript\n");

if (packet->payload_packet_len < 3)
{
return;
}

if (packet->payload[0] != '#' ||
packet->payload[1] != '!' ||
(packet->payload[2] != '/' && packet->payload[2] != ' '))
{
return;
}

NDPI_LOG_INFO(ndpi_struct, "found Shellscript\n");
ndpi_set_risk(flow, NDPI_POSSIBLE_EXPLOIT, "Shellscript found");
}

/* ELF format specs: https://man7.org/linux/man-pages/man5/elf.5.html */
static void ndpi_search_elf(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow)
Expand Down Expand Up @@ -8620,6 +8643,7 @@ static ndpi_protocol ndpi_internal_detection_process_packet(struct ndpi_detectio
{
ndpi_search_portable_executable(ndpi_str, flow);
ndpi_search_elf(ndpi_str, flow);
ndpi_search_shellscript(ndpi_str, flow);
}

if(flow->first_pkt_fully_encrypted == 0 &&
Expand Down
Binary file added tests/cfgs/default/pcap/shell.pcap
View file
Binary file not shown.
38 changes: 38 additions & 0 deletions tests/cfgs/default/result/shell.pcap.out
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
DPI Packets (TCP): 12 (6.00 pkts/flow)
DPI Packets (UDP): 2 (1.00 pkts/flow)
Confidence Unknown : 3 (flows)
Confidence DPI : 1 (flows)
Num dissector calls: 490 (122.50 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/9/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)
LRU cache tls_cert: 0/0/0 (insert/search/found)
LRU cache mining: 0/3/0 (insert/search/found)
LRU cache msteams: 0/0/0 (insert/search/found)
LRU cache stun_zoom: 0/2/0 (insert/search/found)
Automa host: 0/0 (search/found)
Automa domain: 0/0 (search/found)
Automa tls cert: 0/0 (search/found)
Automa risk mask: 0/0 (search/found)
Automa common alpns: 0/0 (search/found)
Patricia risk mask: 0/0 (search/found)
Patricia risk mask IPv6: 0/0 (search/found)
Patricia risk: 0/0 (search/found)
Patricia risk IPv6: 0/0 (search/found)
Patricia protocols: 8/0 (search/found)
Patricia protocols IPv6: 0/0 (search/found)

Unknown 10 11941 3
FTP_DATA 8 1481 1

Acceptable 8 1481 1
Unrated 10 11941 3

1 TCP 127.0.0.1:47638 <-> 127.0.0.1:33333 [proto: 175/FTP_DATA][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: Download/7][4 pkts/1209 bytes <-> 4 pkts/272 bytes][Goodput ratio: 77/0][4.14 sec][bytes ratio: 0.633 (Upload)][IAT c2s/s2c min/avg/max/stddev: 4140/0 1380/0 4140/0 1952/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 302/68 1003/74 405/3][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][PLAIN TEXT (/bin/sh)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]


Undetected flows:
1 TCP 127.0.0.1:54970 <-> 127.0.0.1:33333 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][DPI packets: 8][5 pkts/5526 bytes <-> 3 pkts/206 bytes][Goodput ratio: 94/0][1.26 sec][bytes ratio: 0.928 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 315/0 1259/0 545/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 1105/69 5254/74 2074/4][Risk: ** Possible Exploit Attempt **][Risk Score: 150][Risk Info: Shellscript found][PLAIN TEXT ( /bin/sh)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100]
2 UDP 127.0.0.1:58538 -> 127.0.0.1:33333 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/5230 bytes -> 0 pkts/0 bytes][Goodput ratio: 99/0][< 1 sec][Risk: ** Possible Exploit Attempt **** Unidirectional Traffic **][Risk Score: 160][Risk Info: No server to client traffic / Shellscript found][PLAIN TEXT ( /bin/sh)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100]
3 UDP 127.0.0.1:54112 -> 127.0.0.1:33333 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/979 bytes -> 0 pkts/0 bytes][Goodput ratio: 96/0][< 1 sec][Risk: ** Possible Exploit Attempt **** Unidirectional Traffic **][Risk Score: 160][Risk Info: No server to client traffic / Shellscript found][PLAIN TEXT (/bin/sh)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

0 comments on commit 6b68274

Please sign in to comment.