From: Philippe Antoine Date: Tue, 14 Apr 2020 12:05:16 +0000 (+0200) Subject: Adds test for smb padding evasion X-Git-Tag: suricata-6.0.4~142 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=435a812dfca7f11e4e7d3205cce50fae499217ea;p=thirdparty%2Fsuricata-verify.git Adds test for smb padding evasion --- diff --git a/tests/smb-eicar-padding/README.md b/tests/smb-eicar-padding/README.md new file mode 100644 index 000000000..32b445e57 --- /dev/null +++ b/tests/smb-eicar-padding/README.md @@ -0,0 +1,14 @@ +# Description + +Test SMB EICAR file rule with padding evasion. + +# PCAP + +The pcap comes from running Linux client smbclient against a Windows 2019 Server (with a shared forlder public wihtout needed authentication) +Command is +`smbclient //192.168.1.3/public/ -U % -m NT1` +Than in the smbclient shell : +`put eicar` where eicar is the name of a file with the EICAR contents : +https://en.wikipedia.org/wiki/EICAR_test_file + +The proxy changes the Write request with adding a dummy padding (by increasing unnecessarly the data_offset) diff --git a/tests/smb-eicar-padding/smb1_eicar_andx_write_padding2.pcap b/tests/smb-eicar-padding/smb1_eicar_andx_write_padding2.pcap new file mode 100644 index 000000000..78500803a Binary files /dev/null and b/tests/smb-eicar-padding/smb1_eicar_andx_write_padding2.pcap differ diff --git a/tests/smb-eicar-padding/test.rules b/tests/smb-eicar-padding/test.rules new file mode 100644 index 000000000..fcb9e4489 --- /dev/null +++ b/tests/smb-eicar-padding/test.rules @@ -0,0 +1 @@ +alert smb any any -> any any (msg:"EICAR file"; flow:established; file_data; content:"|58354f2150254041505b345c505a58353428505e2937434329377d2445494341522d5354414e444152442d414e544956495255532d544553542d46494c452124482b482a|"; sid:1; rev:1;) diff --git a/tests/smb-eicar-padding/test.yaml b/tests/smb-eicar-padding/test.yaml new file mode 100644 index 000000000..c1282b105 --- /dev/null +++ b/tests/smb-eicar-padding/test.yaml @@ -0,0 +1,14 @@ +requires: + features: + - HAVE_LIBJANSSON + +# disables checksum verification +args: +- -k none + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1