ICMP隱蔽隧道攻擊分析與檢測（四）

巴韭特發表於2023-04-04

• ICMP隧道攻擊通訊特徵和特徵提取

一、ICMP Ping正常通訊特徵總結

一個正常的 ping 每秒最多隻會傳送兩個資料包，而使用 ICMP隧道的伺服器在同一時間會產生大量 ICMP 資料包
正常的icmp資料包裡，請求資料包與對應的響應資料包內容一樣
資料包中payload的大小固定，Windows下為32bytes，Linux下為48bytes
資料包中payload的內容固定，Windows下為 "abcdefghijklmnopqrstuvwabcdefghi" ，Linux下為 " !”#$%&’()+,-./01234567" ，如果指定ping傳送的長度，則為不斷重複的固定字串
type型別只有2種，8和0，8為請求資料，0為響應資料

二、ICMP隧道攻擊通訊特徵總結

一個正常的 ping 每秒最多隻會傳送兩個資料包，而使用 ICMP 隧道的伺服器在同一時間會產生大量 ICMP 資料包
請求資料包與對應的響應資料包內容不一樣
資料包中 payload 的大小可以是任意大小，通常大於64bytes，當然 icmptunnel 可以配置限制所有資料包的 payload 為64bytes
個別ICMP隧道工具產生的資料包內容前面會增加 'TUNL' 標記以用於識別隧道

三、ICMP隧道攻擊檢測思路

檢測同一來源資料包的數量：正常ping每秒只會傳送2個資料包，而ICMP隧道可以每秒傳送多個
檢測資料包中 Payload 的大小：正常ping產生的資料包Payload的大小是固定的，而ICMP隧道資料包大小可以任意
檢測響應資料包中 Payload 跟請求資料包是否不一致：正常Ping產生的資料包請求響應內容一致，而ICMP隧道請求響應資料包基本不一致
檢測資料包中 Payload 的內容：正常ping產生的Payload為固定字串，ICMP隧道的payload可以為任意
檢測資料包的協議標籤可能存在特殊欄位：icmptunnel 會在所有的 ICMP Data 前面增加 'TUNL' 標記以用於識別隧道
檢測資料包 ICMP Data 裡面可能存在一些系統命令：'whoami','ls','ipconfig',......

四、IDS檢測規則落地

1、禁止 ping ？？？

2、ICMP Data 欄位形成一個白名單，不在白名單內的告警

pass: 匹配到規則後，suricata停止掃描資料包，並跳到所有規則末尾(僅針對當前資料包)

dsize: 匹配一個指定payload大小的資料包

itype: 匹配指定的ICMP型別值

icode: 匹配指定的ICMP程式碼值

nocase: 匹配內容不區分大小寫

pass icmp any any -> any any (msg:"Whitecap: OSX or Linux ICMP Echo Request"; icode:0; itype:8; dsize:56; content:"!\"#$%&'()*+,-./01234567"; classtype:misc-activity; sid:5110001; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: OSX or Linux ICMP Echo Reply"; icode:0; itype:0; dsize:56; content:"!\"#$%&'()*+,-./01234567"; classtype:misc-activity; sid:5110002; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Windows XP/7/8 ICMP Echo Request"; icode:0; itype:8; dsize:32; content:"abcdefghijklmnopqrstuvwabcdefghi"; classtype:misc-activity; sid:5110003; rev:1; nocase;)
pass icmp any any -> any any (msg:"Whitecap: Windows XP/7/8 ICMP Echo Reply"; icode:0; itype:0; dsize:32; content:"abcdefghijklmnopqrstuvwabcdefghi"; classtype:misc-activity; sid:5110004; rev:1; nocase;)
pass icmp any any -> any any (msg:"Whitecap: Nmap ICMP Echo Request"; icode:0; itype:8; dsize:0; classtype:misc-activity; sid:5110005; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Nmap ICMP Echo Reply"; icode:0; itype:0; dsize:0; classtype:misc-activity; sid:5110006; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Group Policy Slow Link Detection"; icode:0; itype:8; dsize:>1400; content:"WANG2"; classtype:misc-activity; sid:5110007; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Group Policy Slow Link Detection"; icode:0; itype:0; dsize:>1400; content:"WANG2"; classtype:misc-activity; sid:5110008; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Solarwinds Status Query"; icode:0; itype:8; dsize:23; content:"SolarWinds Status Query"; classtype:misc-activity; sid:5110009; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Solarwinds Status Query"; icode:0; itype:0; dsize:23; content:"SolarWinds Status Query"; classtype:misc-activity; sid:5110010; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Domain Controller ICMP Traffic"; icode:0; itype:8; dsize:1; content:"?"; classtype:misc-activity; sid:5110011; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Domain Controller ICMP Traffic"; icode:0; itype:0; dsize:1; content:"?"; classtype:misc-activity; sid:5110012; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: McAfee ICMP ping Request"; icode:0; itype:8; dsize:36; content:"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"; offset:3; classtype:misc-activity; sid:5110013; rev:2;)
pass icmp any any -> any any (msg:"Whitecap: McAfee ICMP ping Reply"; icode:0; itype:0; dsize:36; content:"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"; offset:3; classtype:misc-activity; sid:5110014; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Lots of Xs"; icode:0; itype:8; dsize:32; content:"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; classtype:misc-activity; sid:5110015; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Lots of Xs"; icode:0; itype:0; dsize:32; content:"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; classtype:misc-activity; sid:5110016; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: DHCP ICMP Duplicate IP Check"; icode:0; itype:8; dsize:11; content:"DhcpIcmpChk"; classtype:misc-activity; sid:5110017; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: DHCP ICMP Duplicate IP Check"; icode:0; itype:0; dsize:11; content:"DhcpIcmpChk"; classtype:misc-activity; sid:5110018; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Solarwinds ICMP Version 5"; icode:0; itype:8; dsize:<80; content:"SolarWinds.Net ICMP Version 5.0.4.16Copyright  1995-2005 SolarWinds.Net"; classtype:misc-activity; sid:5110019; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Solarwinds ICMP Version 5"; icode:0; itype:0; dsize:<80; content:"SolarWinds.Net ICMP Version 5.0.4.16Copyright  1995-2005 SolarWinds.Net"; classtype:misc-activity; sid:5110020; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Solarwinds Sonar ICMP Scan"; icode:0; itype:8; dsize:24; content:"Orion Network Sonar Scan"; classtype:misc-activity; sid:5110021; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: Solarwinds Sonar ICMP Scan"; icode:0; itype:0; dsize:24; content:"Orion Network Sonar Scan"; classtype:misc-activity; sid:5110022; rev:1;)
pass icmp any any -> $DNS_SERVERS any (msg:"Whitecap: ICMP to DNS Servers"; icode:0; itype:8; dsize:<57; classtype:misc-activity; threshold:type limit, track by_src, count 1, seconds 60; sid:5110500; rev:2;) 
pass icmp any any -> $DNS_SERVERS any (msg:"Whitecap: ICMP to DNS Servers"; icode:0; itype:0; dsize:<57; classtype:misc-activity; threshold:type limit, track by_src, count 1, seconds 60; sid:5110501; rev:2;) 
pass icmp any any -> any any (msg:"Whitecap: Domain controller to domain controller"; icode:0; itype:8; dsize:32; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; classtype:misc-activity; threshold:type limit, track by_src, count 1, seconds 60; sid:5110502; rev:2;)
pass icmp any any -> any any (msg:"Whitecap: Domain controller to domain controller"; icode:0; itype:0; dsize:32; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; classtype:misc-activity; threshold:type limit, track by_src, count 1, seconds 60; sid:5110503; rev:2;)
pass icmp any any -> any any (msg:"Whitecap: All As"; icode:0; itype:8; dsize:64; content:"|AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA|"; classtype:misc-activity; sid:5110504; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: All As"; icode:0; itype:0; dsize:64; content:"|AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA AA|"; classtype:misc-activity; sid:5110505; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: All 0s"; icode:0; itype:8; dsize:56; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; classtype:misc-activity; sid:5110506; rev:1;)
pass icmp any any -> any any (msg:"Whitecap: All 0s"; icode:0; itype:0; dsize:56; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; classtype:misc-activity; sid:5110507; rev:1;)
pass icmp [$ICMP_SRC_HOSTS_IGNORE] any -> any any (msg:"ICMP Pass: Ignore Hosts"; icode:0; itype:8; classtype:misc-activity; sid:5111000; rev:1;)
pass icmp [$ICMP_SRC_HOSTS_IGNORE] any -> any any (msg:"ICMP Pass: Ignore Hosts"; icode:0; itype:0; classtype:misc-activity; sid:5111001; rev:1;)
pass icmp any any -> [$ICMP_DST_HOSTS_IGNORE] any (msg:"ICMP Pass: Ignore Hosts"; icode:0; itype:8; classtype:misc-activity; sid:5111002; rev:1;)
pass icmp any any -> [$ICMP_DST_HOSTS_IGNORE] any (msg:"ICMP Pass: Ignore Hosts"; icode:0; itype:0; classtype:misc-activity; sid:5111003; rev:1;)

3, 檢測包大於多少，或者傳送頻率高於某個數，報警

alert icmp any any -> any any (msg:"Whitecap Echo Request Payload > 100 bytes"; icode:0; itype:8; dsize:>100; classtype:misc-activity; sid:5113000; rev:1;)
alert icmp any any -> any any (msg:"Whitecap Echo Reply Payload > 100 bytes"; icode:0; itype:0; dsize:>100; classtype:misc-activity; sid:5113001; rev:1;)

4、檢測 Data 裡面包含的特殊欄位報警（例如檢測 base64、作業系統常見命令等）

alert icmp any any -> any any (msg:"LOCAL ICMP Large ICMP Packet (Base64)"; dsize:>800; content:"="; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/"; classtype:misc-activity; sid:1000028; rev:1;)

五、基於統計分析ICMP隧道攻擊

資料收集

讀入實時流量資料,設定15秒處理一次資料
根據資料包的源ip、目的ip大小排序拼接後進行分組，將同一個ip向目的ip傳送的請求/響應資料包分到一個組中
分組欄位time_sort_sip_dip 加上時間戳timestamp
為了過濾掉上一次15秒內該源ip、目的ip之間的資料包，保證每個15秒內只處理當前15秒內的同一ip、目的ip的資料

彙總統計

根據分組後的資料，分別統計以下特徵指標，作為最終是否檢出的依據：

在一個時間窗內，ICMP請求響應的資料包數量
捕獲到的ICMP請求響應中，其payload部分是否是作業系統的正常長度
序號相同的ICMP資料包應當屬於一對ICMP請求響應訊息，他們的payload是否一致
ICMP請求響應的payload內容是否正常
ICMP請求是否是畸形Ping報文(Type是否異常)

ICMP隱蔽隧道攻擊分析與檢測（二）
2023-04-03
ICMP隱蔽隧道攻擊分析與檢測（三）
2023-04-03
【技術向】SSH加密隧道流量攻擊與檢測技術
2021-04-01
加密
Data-Hack SQL隱碼攻擊檢測
2020-08-19
SQL
DNS Tunnel隧道隱蔽通訊實驗 && 嘗試復現特徵向量化思維方式檢測
2018-04-03
DNS特徵
內網-隱藏隧道通訊技術，場景復現（ICMP隧道）
2020-10-21
內網
ICMP隧道工具ptunnel
2017-11-02
學習內網安全--隱蔽隧道通訊技術
2021-05-15
內網
WordPress SQL隱碼攻擊漏洞與提權分析
2015-08-25
SQL
SQL隱碼攻擊關聯分析
2020-08-19
SQL
隱秘的攻擊形式：無檔案攻擊型別分析
2020-08-03
型別
反恐精英之動態SQL和SQL隱碼攻擊-SQL隱碼攻擊-防衛SQL隱碼攻擊-驗證檢查
2014-02-16
SQL
利用SSH隧道加密技術隱蔽C&C通訊流量
2019-07-29
加密
預防ddos攻擊檢測
2020-07-08
XSS與SQL隱碼攻擊
2020-12-25
SQL
WEB三大攻擊之—SQL隱碼攻擊與防護
2019-01-28
WebSQL
在Linux中，如何檢測和防止SQL隱碼攻擊和跨站指令碼（XSS）攻擊？
2024-04-09
LinuxSQL指令碼
SQL隱碼攻擊的檢測方式有幾種?常用方法介紹！
2021-10-26
SQL
13、利用 ICMP 隧道穿透防火牆
2018-06-09
穿透防火牆
SQL隱碼攻擊
2014-04-02
SQL
利用Sqlmap API介面聯動Google Hacking批次SQL隱碼攻擊檢測
2024-04-14
SQLAPIGo
SQL隱碼攻擊式攻擊掃描器
2008-07-15
SQL
SQL隱碼攻擊原理及程式碼分析(一)
2020-07-04
SQL
SQL隱碼攻擊原理及程式碼分析(二)
2020-07-09
SQL
軟體安全測試之SQL隱碼攻擊
2020-12-09
SQL
SQL隱碼攻擊漏洞測試工具比較
2012-02-02
SQL
MySQL隱碼攻擊技巧
2020-08-19
MySql
MYSQL SQL隱碼攻擊
2021-11-20
MySql
【SQL隱碼攻擊原理】
2018-01-17
SQL
防止SQL隱碼攻擊
2010-04-20
SQL
SQL隱碼攻擊（一）
2009-12-14
SQL
攻擊JavaWeb應用[3]-SQL隱碼攻擊[1]
2020-08-19
JavaWebSQL
攻擊JavaWeb應用[4]-SQL隱碼攻擊[2]
2020-08-19
JavaWebSQL
SQL隱碼攻擊的分類與防範
2009-04-23
SQL
SQL隱碼攻擊原理是什麼?如何防範SQL隱碼攻擊？
2022-11-24
SQL
Joomla CMS 3.2-3.4.4 SQL隱碼攻擊漏洞分析
2020-08-19
OOMSQL
反恐精英之動態SQL和SQL隱碼攻擊-SQL隱碼攻擊-SQL隱碼攻擊技術-語句注入
2014-02-16
SQL
反恐精英之動態SQL和SQL隱碼攻擊-SQL隱碼攻擊-SQL隱碼攻擊技術-語句修改
2014-02-16
SQL

ICMP隱蔽隧道攻擊分析與檢測（四）

• ICMP隧道攻擊通訊特徵和特徵提取

一、ICMP Ping正常通訊特徵總結

二、ICMP隧道攻擊通訊特徵總結

三、ICMP隧道攻擊檢測思路

四、IDS檢測規則落地

1、禁止 ping ？？？

2、ICMP Data 欄位形成一個白名單，不在白名單內的告警

3, 檢測包大於多少，或者傳送頻率高於某個數，報警

4、檢測 Data 裡面包含的特殊欄位報警（例如檢測 base64、作業系統常見命令等）

五、基於統計分析ICMP隧道攻擊

資料收集

彙總統計

相關文章