Sneeze

1. !/usr/bin/perl
2. sneeze.pl v 1.0
3. 8/3/2001
4. Don Bailey (baileydl@mitre.org) and Brian Caswell (bmc@mitre.org)

require 'getopts.pl';

1. require destination and rule file or help

Getopts('d:f:c:s:p:i:h:x'); if ($opt_h || (!$opt_d && !$opt_f)) { die "Usage $0 -d <dest host> -f <rule file> [options]\ \t-c count\tLoop X times. -1 == forever. Default is 1.\ \t-s ip\t\tSpoof this IP as source. Default is your IP.\ \t-p port\t\tForce use of this source port.\ \t-i interface\tOutbound interface. Default is eth0.\ \t-x debug\tTurn on debugging information.\ \t-h help\t\tDuh? This is it.\n"; }

use Net::RawIP;

1. setup our sneeze objects for tcp, icmp, and udp

$sneeze_tcp = new Net::RawIP ({tcp => {}}); $sneeze_icmp = new Net::RawIP ({icmp => {}}); $sneeze_udp = new Net::RawIP ({udp => {}}); $sneeze_ip = new Net::RawIP ({generic => {}});

my $DEBUG = 0; if ($opt_x) { $DEBUG = 1; }

my $refurls; $refurls{bugtraq} = "http://www.securityfocus.com/bid/"; $refurls{cve} = "http://cve.mitre.org/cgi-bin/cvename.cgi?name="; $refurls{arachnids} = "http://www.whitehats.com/info/IDS"; $refurls{mcafee} = "http://vil.nai.com/vil/dispVirus.asp?virus_k="; $refurls{url} = "http://";

1. parse some options if they exist or set default values

chomp($forcesrc = `hostname`);

$setsrc = $opt_s; if ($opt_p) { $srcport = $opt_p; } if($opt_i) { $sneeze_tcp->ethnew($opt_i); $sneeze_icmp->ethnew($opt_i); $sneeze_udp->ethnew($opt_i); $sneeze_ip->ethnew($opt_i); } $loop = ($opt_c) ? $opt_c : 1;

1. add rules

my @rulez = add_rules($opt_f);

sub add_rules {

  my ($file) = @_;
  my @rules;

  open(RULES,$file) || die "Cannot open $file!\n";
  my @lines = <RULES>;
  close (RULES);

  foreach my $line (@lines) {
     chomp ($line);
     if ($line =~ /^include (.*)$/) {
         if ($opt_x) { print "Adding include of $1\n";}
         my @line_rules = add_rules($1);
         push (@rules,@line_rules);
     }
     else {push (@rules,$line);}
  }
  return (@rules);

}

@rulez = set_vars(@rulez);

sub set_vars {

  my (@rules) = @_;
  my @returns;
  my $vars;
  foreach my $line (@rulez)
  {
     if ($line =~ /^var ([\w]+)(.*)/)
     {
        if ($DEBUG) { print "Got variable $1 set to $2\n";}
        $vars{$1} = $2;
     }
     foreach my $key (keys (%vars))
     {
        $line =~ s/\$$key/$vars{$key}/g;
     }
     push (@returns, $line);
  }
  return (@returns);

}

1. for every rule in rule file, parse and send a packet like that to dest

foreach $rule (@rulez) {

my $dsize;

       if ($rule =~ /^\s*#/ || $rule eq "\n") {
               next;
       }

       # only use "alert" and "log" rules
       # if ($rule !~ /^(alert|log)/) { next; }

       # ALERT|LOG PROTO src srcport direction dst dstport
       $rule =~ /(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(->|<>|<-)\s+(\S+)\s+(\S+)(.*)$/;
 $attack = $1;
       $proto = $2;
       $rule_src = $3;
       if (!$setsrc) {

if ($rule_src =~ /^(\d+\.\d+\.\d+\.\d+)/ ) { $src = $1; } else { $src = $forcesrc; }

       }

       $srcport = $4;
       $direction = $5;
       #$dst = $6;
       $dstport = $7;
       $rest = $8;

       $content = undef;
       if ($rest =~ /msg\s*:\s*"([^"]+)/i) { $msg = $1; }
       if ($rest =~ /flags\s*:\s*([^;]+)/i ) { $flags = $1; }
       if ($rest =~ /dsize\s*:\s*([^;]+)/i ) { $dsize= $1; }
       if ($rest =~ /classtype\s*:\s*([^;]+)/i ) {$type= $1; }
       if ($rest =~ /depth\s*:\s*([^;]+)/g ) {$depth = $1; }
       if ($rest =~ /sameip;/i) { $src = $opt_d; }
       $rest =~ s/nocase;//g;

       my $payload;
       my $contents = $rest;

       if ($contents =~ /content\s*:\s*"[^"]+.*content\s*:\s*"[^"]+/)
       {
          while ($contents =~ /content/)
          {
          if ($contents =~ s/content:"([^"]+)\"\;\s+offset:(\d+)\;(.*)/$3/i)
          {
             my $tmp = $1;

my $offset = $2;

             my $pad = 'A' x $offset;

push (@contents,parse_content($pad . $tmp)); }

          elsif ($contents =~ s/content\s*:\s*"([^"]+)(.*)/$2/i)
          {
             push (@contents,parse_content($1));

}

          }
 }

foreach (@contents) { $payload = $payload . $_; }

       $ref = $rest;
       my @refs;
       while ($ref =~ s/(.*)reference:([^\;]+)(.*)$/$1 $3/)
       {
          my $tmp = $2;
          if ($tmp =~ /(\w+),(.*)/i) { $tmp = $refurls{$1} . $2; }
          push (@refs,$tmp);
       }

if($dsize) {

               my $dsize_len = $dsize;
               $dsize_len =~ s/dsize: //;
               $dsize_len =~ /([\D]{0,1})(\d+)$/;
               $dsize_len = $2;
               my $gtolt = $1;
               my $length = length ($payload);
               my $need = $dsize_len - $length;
               if ($gtolt eq ">") {
                       $need++;
               } elsif ($gtolt eq "<") {
                       $need--;
               }

               my $pad = 'A' x $need;
               $payload = $payload . $pad;
       }

push @attacks, { src => $src, dst => $opt_d, dstport => $dstport, srcport => $srcport, payload => $payload, msg => $msg, proto => $proto, refs => \@refs, type => $type, sig => $rule }; }

1. loop for loop amount of times or forever if loop was -1

$count = 0; while (($count < $loop) || ($loop == -1)) { foreach my $attack (@attacks) {

  if ($attack->{srcport} !~ /\d+/) {
     $attack->{srcport} = int(rand(65535));
  }

  if ($attack->{dstport} !~ /\d+/) {
     $attack->{dstport} = int(rand(65535));
  }

  print "ATTACK: $attack->{msg}\n";
  if ($attack->{type}) { print "ATTACK TYPE: $attack->{type}\n"; }
  print "$attack->{proto} $attack->{src}:$attack->{srcport} -> $attack->{dst}:$attack->{dstport}\n";
  $refs = $attack->{refs};
  if ($refs) { foreach (@$refs) { print "Reference => $_\n"; } }
  if ($DEBUG) { print "SIGNATURE $attack->{sig}\n"; }
  print "\n";

  if ($attack->{proto} =~ /tcp/i) {
    $sneeze_tcp->set({ip =>{saddr => $attack->{src}, daddr => $attack->{dst}},

tcp => {source => $attack->{srcport} ,dest => $attack->{dstport},

       ack => 1, data => $attack->{payload} }});
     $sneeze_tcp->send;
  } elsif ($attack->{proto} =~ /icmp/i ) {
     $sneeze_icmp->set({ip => {saddr =>$attack->{src},daddr =>$attack->{dst}},
         icmp => {data => $attack->{payload} }});
     $sneeze_icmp->send;
  } elsif ($attack->{proto} =~ /udp/i ) {

$sneeze_udp->set({ip =>{saddr => $attack->{src},daddr =>$attack->{dst}}, udp => {source => $attack->{srcport},dest => $attack->{dstport}, data =>$attack->{payload} }}); $sneeze_udp->send;

  } else {

$sneeze_ip->set({ip => {saddr => $attack->{src},daddr =>$attack->{dst}}, generic => {data => $attack->{payload} }});

  } # end if elsif for packet gen stuff

} # end foreach

$count++; } # end while

sub parse_content {

  my ($content) = @_;
  my $end; my $hex2a;
  $content =~ s/([^|]*)(.*)/$2/;
  my $pre = $1;
  if ($content =~ /\|/) {
     $content =~ s/([^|]+)\|(.*)/$1/;
     my $hex = $1; my $post = $2;
     while ($hex =~ s/(\w{2})(.*)/$2/) {
        $hex2a .= chr(hex $1);
     }
    if ($post) { $end = parse_content($post); }
  }
  return ($pre . $hex2a . $end);