DNS Reverse Shell sig

[James Lay <jlay () slave-tothe-box net>]

In my testing of 
http://lockboxx.blogspot.com/2015/01/python-reverse-dns-shell.html I 
noticed that during the reverse shell session a semi-constant showed 
up...namely a character followed by a dash, followed by 56 other 
characters.  Pretty sure this could be changed in the python code, but 
this will catch this in it's current form.  It will not fire on each and 
every dns query, but will most likely fire at least during the session.

alert udp $HOME_NET any -> any 53 (msg:"Possible Python Reverse DNS 
Shell"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; 
fast_pattern; pcre:"/[a-z]-[a-z0-9]{56}/i"; 
reference:url,lockboxx.blogspot.com/2015/01/python-reverse-dns-shell.html; 
classtype:bad-unknown; sid:10000150; rev:1;)

This WILL most likely FP if you're looking for a domain that matches 
the above style, but I couldn't find any such domain in my logs.  Enjoy.

James

Attachment: reversednsshell-select.pcapng
Description:

------------------------------------------------------------------------------
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net/

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!