http:\/\/www.symantec.com\/connect\/articles\/forensic-log-parsing-microsofts-logparser<\/a>, and some of the topics covering blue team tactics on pauldotcom.com.<\/p>\nOnce you have downloaded and installed the latest version of logparser from Microsoft onto your webserver, do a basic Nikto scan of your test website to generate some entries in\u00a0the logs.<\/p>\n
If your using Bactrack simply open a shell and type
\u00a0\u00a0 \/pentest\/scanners\/nikto\/nikto.pl -host http:\/\/yourip\/<\/span><\/p>\nOnce that is done, let’s use loparser to check the logs on the webserver using the following command
C:\\Program Files\\Log Parser 2.2>logparser -o:xml “SELECT c-ip AS ClientIP, cs(user-agent) AS ClientUserAgent, cs-uri-stem as URIStem, cs-uri-query as URIQuery,COUNT(*) AS [Requests] INTO attacker.xml FROM C:\\WINDOWS\\system32\\LogFiles\\wherever your logs<\/span> are WHERE cs-uri-stem LIKE ‘%cmd.exe%’\u00a0OR cs-uri-stem LIKE ‘%…%’ OR cs-uri-stem LIKE ‘%\\%’ OR cs-uri-query LIKE ‘%\\%3c%’ <\/span>OR cs-uri-query LIKE ‘%\\%3e%’ OR cs-uri-query LIKE ‘%\\”%’ OR cs-uri-query LIKE ‘%\\’%’ OR cs-uri-query LIKE ‘%#%’ OR cs-uri-query LIKE ‘%\\%’ GROUP BY ClientIp, ClientUserAgent, URIStem, URIQuery ORDER BY Requests DESC”<\/span>
\u00a0
\u00a0
\u00a0Explanation<\/strong>
\u00a0 -o specifies the output type
\u00a0\u00a0SELECT is saying which log entries we are interested in. Refer back to part 2 for more details on the logging.
\u00a0\u00a0AS says we are going to treat each line as a whole
\u00a0\u00a0WHERE is now going trough each of the fields and looking for matches. For example, cs-uri-stem LIKE ‘%cmd.exe%’ is looking in the cs-uri-stem field in each log entry for\u00a0\u00a0 the word cmd.exe in the request.
NOTE: I highly encourage you to look into other types of attack data that can be gleaned from the logs and add searches for them in your logparser query. There are lot’s of good examples in the Symantec\/Security Focus\u00a0article above, or in the hacker sample script included with the logparser install<\/span>.
\u00a0 GROUP BY is used to select what we will write in our output
\u00a0 ORDER BY is used to sort the output. In this case it will be the same order as the logs.<\/p>\nSince we didn’t specify a location for the output of the file the xml will be in the logparser directory. Open it up and look through the results.<\/p>\n
You should see lots of entries like
\u00a0–
\u00a0 192.168.100.129<\/ClientIP>
\u00a0 Mozilla\/4.75+(Nikto\/2.1.3)+(Evasions:None)+(Test:003295)<\/ClientUserAgent>
\u00a0 \/cgi-bin\/..%5c..%5c..%5cwinnt\/system32\/cmd.exe<\/URIStem>
\u00a0 \/c+dir<\/URIQuery>
\u00a0 1<\/Requests>
\u00a0 <\/ROW>
–
\u00a0 192.168.100.129<\/ClientIP>
\u00a0 Mozilla\/4.75+(Nikto\/2.1.3)+(Evasions:None)+(Test:003296)<\/ClientUserAgent>
\u00a0 \/iisadmpwd\/..%5c..%5cwinnt\/system32\/cmd.exe<\/URIStem>
\u00a0 \/c+dir<\/URIQuery>
\u00a0 1<\/Requests>
\u00a0 <\/ROW><\/p>\nSo that we know how to get some data out of the log files, what can we do with it?<\/p>\n
Well, if we\u00a0create a batch file
c:\\scripts\\parse.bat
C:\\Program Files\\Log Parser 2.2\\logparserlogparser -i:iisw3c -o:csv -headers off “SELECT DISTINCT c-ip INTO c:\\block\\badguys.txt FROM %1 WHERE TO_LOWERCASE(cs-uri-stem) LIKE ‘%%cmd.exe’ OR TO_LOWERCASE(cs-uri-stem) LIKE ‘%%.exe%%’ OR TO_LOWERCASE(cs-uri-stem) = ‘%%select’ OR cs-uri-stem LIKE ‘%%&%%’ OR cs-uri-stem LIKE ‘select’ OR cs-uri-stem LIKE ‘%’ OR cs-uri-query LIKE ‘%%\\%%3c%%'”<\/span>
Explanation<\/strong>
\u00a0-i the input is going to be iis logs, -o the output will be csv turn off headers, select only distinct ips. <\/p>\nAnd\u00a0run it and provide a\u00a0logfile as an argument
c:\\scripts\\parse.bat c:\\windows\\system32\\logfiles\\<\/span>specificlogfile<\/span>
A file will be created\u00a0with the\u00a0attackers\u00a0IP\u00a0in it.
Then if we run\u00a0a script like this one
c:\\scripts\\simplewaf.bat<\/span>
@echo <\/span>
cd c:\\block<\/span>
for \/f %%i in (badguys.txt) do netsh ipsec static add filter filterlist=”Banned IPs” srcaddr=%%i dstaddr=yourip description=”Banned IPs” protocol=any srcport=0 dstport=0″ <\/span><\/p>\nExplanation<\/strong>
\u00a0We are doing a simple for loop that will iterate through each “line” in the file presented in argument. For each\u00a0IP it finds, it is adding the\u00a0IP\u00a0to the list of IPs in the IPSec policy that was created in part 3.<\/p>\nSo, assuming that the\u00a0IP of your attacker is different then the one you were using for testing in the previous post, or if you removed it, the IP that you ran the nikto scan from should be added to the IPSec rule and the attacker can no longer connect from that IP.<\/p>\n
We can do something similar on a Windows 2008 server
c:\\scripts\\simplewaf.bat
for \/f %i in (c:\\block\\badguys.txt) do netsh advfirewall firewall add rule name=”Bad IP %i” protocol=TCP dir=in localport=80 remoteip=%i action=block ENABLE<\/span>
Explanation<\/strong>
\u00a0This one, I’m not very happy with. It is creating a new firewall rule for each IP instead of just adding IPs to an existing rule. If I find a better way to do this in the future,\u00a0\u00a0I will edit this post.<\/p>\nNext Steps<\/strong>
By scheduling the parse.bat and the simplewaf.bat to run daily\/hourly or even\u00a0more frequently you could have a very simple web application firewall that blocks attacking IPs, but you can\u00a0\u00a0probably see we could run into some major problems. We will save that for next time….<\/p>\n","protected":false},"excerpt":{"rendered":"The following is based on my experiences and (limited) knowledge. I am not an expert in anything, nor will I likely ever be one. My hope is that this might help someone, somewhere, sometime. If nothing else, it might be a good start for discussion. PreambleThis series is for meant for educational use only, and […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,9],"tags":[],"class_list":["post-14","post","type-post","status-publish","format-standard","hentry","category-blue","category-iis"],"_links":{"self":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/14","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=14"}],"version-history":[{"count":0,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/14\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.somethingsomethingsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
|
|