Developers and researchers are confronted with a huge number of tools and technologies in their daily work, each of which has its own pros and cons. This realization is important for network devices intended to stop attacks — they should be “omnivores” with regard to network protocols. The speaker’s passion is to study and recreate various hacker attacks, exploits and tactics at the network level in order to develop reliable detection techniques for intrusion detection systems. While working on lots of attacks he noticed some tiny network conditions when a packet sequence slip away from IDS system but get to the target. Will your IDS system detect data network connection was broken? Using nc and a Linux machine, the speaker will demonstrate 4 CVEs he found for bypassing IDS systems, based on the example of the popular Suricata IDS.

1. How to bypass an IDS with
netcat and linux
Kirill Shipulin
Attack Detection Team

2. IDS Briefly
alert http … “POST”; http_method;
● Inspects all the traffic around
● Reassemble TCP/UDP streams
● High level protocol parsers
● Suricata IDS
Signature

3. TCP rules your network

4. ● TCP/IP fragmentation
● Reassembling fragmentation
● HTTP encodings
● Non-standard ports
● Timeout attacks
● Signature bypass
Classical IDS bypasses
Not today

5. Briefly 3 way handshake
SYN
SYN ACK
ACK

6. Client Server
3 way handshake
HTTP 200 OK
GET / HTTP/1.1
Bypass #1
A normal HTTP
traffic flow
What if use NetCat for HTTP 200 OK?
nc -lp 80 < payload.txt

7. Client NC
What NC does?
SYN
SYN/ACK
HTTP 200 OK
ACK
GET / HTTP/1.1
nc -lp 80 < payload.txt
HTTP?
I haven’t
heard

8. What IDS sees? nc -lp 80 < payload.txt
Client Server
3 way handshake
HTTP 200 OK
GET / HTTP/1.1

9. IDS Bypassed:
Bypassed
IDS miss:
- Exploit KIT
- CnC
- Miner
5000 signatures
affected
Client Server
3 way handshake
HTTP 200 OK
GET / HTTP/1.1
CVE-2018-6794

10. Client Server
⅓ SYN
⅔ SYN-ACK
HTTP 200 OK
FIN
ACK
You need be fast:
seconds
Some switches don’t allow
data until TCP 3whs
Both Windows/Linux accept
Problems of Exploiting

11. https://github.com/kirillwow/ids_bypass
PoC
Run on controlled
server
● Sniffer
● Do not bind to
port
● Disable kernel
RST

12. TCP normally:
Bypass #2 TCP SYN
Port
Open ?
TCP
ACK
TCP
RST
YES NO
SERVER
PORT 80

13. PORT 80
1 2
Bypass #2
● One day I played with
Bypass #1
● And forgot disable
RST packets
● Kernel sent RST back
RSTSYN

14. 3
Bypass #2
● One day I played with
Bypass #1
● And forgot disable
RST packets
● Kernel sent RST back
● Then my script worked
PORT 80
RSTSYN
SYN-ACK
DATA

15. ● One day I played with
Bypass #1
● And forgot disable
RST packets
● Kernel sent RST back
● Then my script worked
● And Windows got it
Bypass #2
3
PORT 80
RSTSYN
SYN-ACK
DATA

16. Bypass #2
0.5 sec
○ Windows only
○ 0.5 seconds MAX
● Kernel sent RST back
● Then my script worked
● And Windows got it
3
PORT 80
RSTSYN
SYN-ACK
DATA

17. OK, what IDS sees?
(nothing)

18. IDS doesn’t see
L7 protocols
Bypassed
TCP streams
Bypassed
Bypassed

19. Bypass #2
CVE-2018-14568
● More powerful than Bypass #1
● But limited to Windows
https://github.com/kirillwow/ids_bypass

20. Bypass #3
UDP normally:
Incoming UDP
Port
Open ?
UDP
Answer
???
YES NO
SERVER
PORT 80

21. Bypass #3
UDP normally:
Incoming UDP
Port
Open ?
UDP
Answer
ICMP
YES NO
SERVER
PORT 80

22. DUPLICATE
How it works?
Closed
Port
IP/UDP
duplicated
ICMP
Destination
Unreachable
IP UDP “hello”
IPUDP“hello” IPICMP

23. Bypass #3 = UDP + Bypass #2
Client Server
Incoming UDP
ICMP
UDP answer
I tried this:

24. Good news:
IDS bypassed
Bad news:
Client bypassed
Bypass #3 = UDP + Bypass #2
Client
Evil
Server
Incoming UDP
ICMP
UDP answer
I tried this:

25. The Fix
IP/UDP
duplicated
ICMP
Destination
Unreachable
C SIPUDP“hello” IPICMP

26. The Fix
ICMP
Destination
Unreachable
C S
UDP
IP
Client Server
Client Server
Opposite
Direction
Inside
Change it!
UDP
IP
Client Server
Client Server
IPUDP“hello” IPICMP

27. The Fix
C S
Gotcha!
Broken for client
Accepted by IDS
CVE-2016-10728
IPUDP“hello” IPICMP

28. Example: DNS Tunneling
● Is a covert channel encapsulated into
DNS requests/responses
● DNS uses UDP usually
Malware C2
Malware C2
DNS query
Broken ICMP DNS response

29. Top HOT signatures
3,000,000,000 Ticks
~ 1 second
Bypass #4: Can signatures do harm?

30. How signature works?
Static Content
Regular Expression
Byte operations
Base64
Protocol Specific

31. “one two SECOND three four FIRST five six
SECOND seven eight nine”
content: “FIRST”; content: “SECOND”; distance: 0;
Signature:
Content:
How signature works?
Static Content
Regular Expression
Byte operations
Base64
Protocol Specific

32. “one FIRST three FIRST five six FIRST eight FIRST ten”
The issue
Checks for SECOND didn’t stop
if no content found:
“one FIRST three FIRST five six FIRST eight FIRST ten”
“one FIRST three FIRST five six FIRST eight FIRST ten”
“one FIRST three FIRST five six FIRST eight FIRST ten”
Checks

33. “one FIRST three FIRST five six FIRST eight FIRST ten”
The issue
“one FIRST three FIRST five six FIRST eight FIRST ten”
“one FIRST three FIRST five six FIRST eight FIRST ten”
“one FIRST three FIRST five six FIRST eight FIRST ten”
Checks
3000 checks for 1 TCP packet
Let’s hire PRCE!

34. The Result
3 Billion Ticks!
Num Rule Avg Ticks
-------- ------------ -----------
1 2016204 3302218139

35. The Result
3 Billion Ticks!
Num Rule Avg Ticks
-------- ------------ -----------
1 2016204 3302218139
NOW
1 TCP
1 Code
1 Second
Usually
80,000 TCP
1 Code
1 Second
CVE-2017-15377

36. POST / HTTP/1.1
<a type='yaml"<a
type='yaml"!ruby
1) Generate payload
while [ true ];
do nc 192.168.235.136 80 < payload.txt;
2) Send it
Exploiting with NetCat
82 times

37. Traffic Rate:
● 250 Kbps
● 10 POST/s
Result:
● 8 Cores
● 100% Load
Result

38. ● Logic bugs are evil
● The approach may be applied
to other detection systems
● There are many more!
What did just happen?
CVE-2017-15377
CVE-2016-10728
CVE-2018-14568
CVE-2018-6794

39. PT Network Attack Discovery

40. Des questions?

41. Me
@kirill_wow
@attackdetection