Red Hat NETWORK BASIC - USER REFERENCE GUIDE 4.0 Guide de l'utilisateur télécharger pdf (Page 64)

Contents of password file:

root:.*:0:0:.*:.*

2) client <------------------------- server:port 80

Our match pattern would key on the contents in packet 2) and our pmatch pattern would key on packet 1) payload contents.

The Passive Vulnerability Scanner can Match Binary Data

The PVS also allows matching against binary patterns. Here is an example plugin that makes use of binary pattern

matching to detect the usage of the well-known community string “public” in SNMPv1 response packets (The “#” is used

to denote a comment.):

###

# SNMPv1 response

# Matches on the following:

# 0x30 - ASN.1 header

# 0x02 0x01 0x00 - (integer) (byte length) (SNMP version - 1)

# 0x04 0x06 public - (string) (byte length) (community string - "public")

# 0xa2 - message type - RESPONSE

# 0x02 0x01 0x00 - (integer) (byte length) (error status - 0)

# 0x02 0x01 0x00 - (integer) (byte length) (error index - 0)

###

id=1001

udp

sport=161

name=SNMP public community string

description=The remote host is running an SNMPv1 server that uses a well-known

community string - public

bmatch=>0:30

bmatch=>2:020100

bmatch=>5:04067075626c6963a2

bmatch=020100020100

Binary match patterns take the following form:

bmatch=[<>[off]:]<hex>

Binary match starts at <off>’th offset of the packet or at the last <offset> of the packet, depending on the use of > (start) or

< (end). <hex> is a hex string we look for.

bmatch=<:ffffffff

This will match any packet whose last four bytes are set to 0xFFFFFFFF.

bmatch=>4:41414141

This will match any packet that contains the string “AAAA” (0x41414141 in hex) starting at its fourth byte.

bmatch=123456789ABCDEF5

This will match any packet that contains the hex string above.

Negative Matches

PVS plugins can also be negated. Here are two examples:

pmatch=!pattern

pbmatch=>0:!414141

1 2 ... 59 60 61 62 63 64 65 66 67 68 69 ... 78 79

Pas de commentaire

Red Hat NETWORK BASIC - USER REFERENCE GUIDE 4.0 Guide de l'utilisateur Page 64