Eclectic Security

Your favourite Intrusion Detection/Prevention System (IDS/IPS) is just installed and running, and you are probably wondering if everything is working as it should, logging or dropping evil packets. Here it comes Pytbull, a python based flexible IDS/IPS testing framework shipped with more than 300 tests, grouped in 9 modules, covering a large scope of attacks (clientSideAttacks, testRules, badTraffic, fragmentedPackets, multipleFailedLogins, evasionTechniques, shellCodes, denialOfService, pcapReplay).

Testing your IDS/IPS with Pytbull will save you a big deal of time!

Lets  assume we have an Ubuntu Linux testing box A with ip address 192.168.1.25 and a Smooth-Sec installation B with ip address192.168.1.1.

On the testing box A 192.168.1.25, install all the required packages and dependencies.

#apt-get install python python-scapy nmap hping3 nikto tcpreplay python-iniparse

Download Pytbull

#wget https://downloads.sourceforge.net/project/pytbull/pytbull-1.3.tar.bz2
#bzip2 -cd pytbull-1.3.tar.bz2 | tar xf -
#cd pytbull

Edit the Pytbull configuration file:

vim config.cfg

#Pytbull config file
[CLIENT]
ipaddr                  = 192.168.1.1 #ip address of the IDS to test.
iface                   = eth0

[PATHS]
report                  = report.html
sudo                    = /usr/bin/sudo
nmap                    = /usr/bin/nmap
nikto                   = /usr/bin/nikto
niktoconf               = /root/pytbull/nikto.conf
hping3                  = /usr/sbin/hping3
tcpreplay               = /usr/bin/tcpreplay
urlpdf                  = http://droid-protector.com/borrar_ya/md5
alertsfile              = /var/log/suricata/fast.log

[CREDENTIALS]
ftpuser                 = pytbull
ftppasswd               = pytbull

Create a nikto configuration file and add the following content

#start nikto configuration file
SKIPPORTS=21 111
USERAGENT=Mozilla/4.75 (Nikto/@VERSION) (Evasions:@EVASIONS) (Test:@TESTID)
RFIURL=http://cirt.net/rfiinc.txt?
NIKTODTD=docs/nikto.dtd
DEFAULTHTTPVER=1.0
UPDATES=yes
MAX_WARN=20
CIRT=174.142.17.165
CHECKMETHODS=HEAD GET
@@MUTATE=dictionary;subdomain
@@DEFAULT=@@ALL;-@@MUTATE;tests(report:500)
#end nikto configuration file

Copy the Pytbull server script (reverse shell) used for client side attacks to the Smooth-Sec box 192.168.1.1:

#scp server/pytbull-server.py root@192.168.1.1:

Define the kind of tests that you want to run against Suricata, please refer to the end of the Pytbull configuration file config.cfg.

0 = disabled
1 = enabled

[TESTS]
clientSideAttacks = 1
testRules = 1
badTraffic = 1
fragmentedPackets = 1
multipleFailedLogins = 1
evasionTechniques = 1
shellCodes = 1
denialOfService = 1
pcapReplay = 1

On the Smooth-Sec box 192.168.1.1 B

#apt-get install vsftpd apache2
#adduser –home /var/log/suricata –shell /bin/bash pytbull
#usermod -G suricata pytbull

Start the reverse shell on the Smooth-Sec box 192.168.1.1

#python pytbull-server.py  --port 34567

                                 _   _           _ _
                     _ __  _   _| |_| |__  _   _| | |
                    | '_ \| | | | __| '_ \| | | | | |
                    | |_) | |_| | |_| |_) | |_| | | |
                    | .__/ \__, |\__|_.__/ \__,_|_|_|
                    |_|    |___/
                       Sebastien Damaye, aldeid.com

Checking root privileges......................................... [   OK   ]
Checking port to use............................................. [   OK   ]

Server started on port: 34567
Listening...

 Run the test from 192.168.1.25 to 192.168.1.1

#python pytbull.py -t 192.168.1.1

                     _ __  _   _| |_| |__  _   _| | |
                    | '_ \| | | | __| '_ \| | | | | |
                    | |_) | |_| | |_| |_) | |_| | | |
                    | .__/ \__, |\__|_.__/ \__,_|_|_|
                    |_|    |___/
                       Sebastien Damaye, aldeid.com

BASIC CHECKS
------------
Checking root privileges......................................... [   OK   ]
Checking remote port 21/tcp (FTP)................................ [   OK   ]
Checking remote port 22/tcp (SSH)................................ [   OK   ]
Checking remote port 80/tcp (HTTP)............................... [   OK   ]
Checking path for sudo........................................... [   OK   ]
Checking path for nmap........................................... [   OK   ]
Checking path for nikto.......................................... [   OK   ]
Checking path for niktoconf...................................... [   OK   ]
Checking path for hping3......................................... [   OK   ]
Checking path for tcpreplay...................................... [   OK   ]
Removing temporary file.......................................... [   OK   ]

TESTS
------------
Client Side Attacks.............................................. [   yes  ]
Test Rules....................................................... [   yes  ]
Bad Traffic...................................................... [   yes  ]
Fragmented Packets............................................... [   yes  ]
Multiple Failed Logins........................................... [   yes  ]
Evasion Techniques............................................... [   yes  ]
ShellCodes....................................................... [   yes  ]
Denial of Service................................................ [   yes  ]
Pcap Replay...................................................... [   yes  ]

-----------------------
DONE. Check the report.
-----------------------

Report view.

On the testing machine 192.168.1.25

cp report.html /var/www/

open http://192.168.1.25 with your web browser

Restore Suricata as it was. (192.168.1.1)

apt-get remove vsftpd apache2
deluser pytbull
rm pytbull-server.py

Scridb filter