WAF>> doublepulsar-detection-script>> 返回
项目作者： countercept

项目描述 ：
A python2 script for sweeping a network to find windows systems compromised with the DOUBLEPULSAR implant.
高级语言： Python
项目地址: git://github.com/countercept/doublepulsar-detection-script.git
创建时间： 2017-04-15T19:35:01Z
项目社区：https://github.com/countercept/doublepulsar-detection-script
开源协议：BSD 3-Clause "New" or "Revised" License
下载


Author: Luke Jennings (luke.jennings@countercept.com - @jukelennings)

Company: Countercept (@countercept)

Website: https://countercept.com

A set of python2 scripts for sweeping a list of IPs for the presence of both SMB and RDP versions of the DOUBLEPULSAR implant that was released by the Shadow Brokers. Supports both single IP checking and a list of IPs in a file with multi-threading support. The SMB version also supports the remote uninstall of the implant for remediation, which was helped by knowledge of the opcode mechanism reversed by @zerosum0x0.

This is an early release in the interests of allowing people to find compromises on their network now that these exploits are in the wild and no doubt being used to target organizations. It re-implements the ping command of the implant, which can be used remotely without authentication, in order to determine if a system is infected or not. Both SMB and RDP versions of the implant are supported.

Not all OS versions have been tested and some currently fail. For example, 2012 will reject the SMB sequence with ACCESS_DENIED. However, this system is not vulnerable to the ETERNALBLUE exploit and the DOUBLEPULSAR implant receives the same error when trying to ping a target. Therefore, it is possible that errors against certain windows versions may be indicative that the system is not compromised.

Usage

  1. root@kali:~# python detect_doublepulsar_smb.py --ip 192.168.175.128
  2. [-] [192.168.175.128] No presence of DOUBLEPULSAR SMB implant
  4. root@kali:~# python detect_doublepulsar_smb.py --ip 192.168.175.128
  5. [+] [192.168.175.128] DOUBLEPULSAR SMB IMPLANT DETECTED!!!
  7. root@kali:~# python detect_doublepulsar_rdp.py --file ips.list --verbose --threads 1
  8. [*] [192.168.175.141] Sending negotiation request
  9. [*] [192.168.175.141] Server explicitly refused SSL, reconnecting
  10. [*] [192.168.175.141] Sending non-ssl negotiation request
  11. [*] [192.168.175.141] Sending ping packet
  12. [-] [192.168.175.141] No presence of DOUBLEPULSAR RDP implant
  13. [*] [192.168.175.143] Sending negotiation request
  14. [*] [192.168.175.143] Server chose to use SSL - negotiating SSL connection
  15. [*] [192.168.175.143] Sending SSL client data
  16. [*] [192.168.175.143] Sending ping packet
  17. [-] [192.168.175.143] No presence of DOUBLEPULSAR RDP implant
  18. [*] [192.168.175.142] Sending negotiation request
  19. [*] [192.168.175.142] Sending client data
  20. [*] [192.168.175.142] Sending ping packet
  21. [+] [192.168.175.142] DOUBLEPULSAR RDP IMPLANT DETECTED!!!
  23. root@kali:~# python2 detect_doublepulsar_smb.py --ip 192.168.175.136 --uninstall
  24. [+] [192.168.175.136] DOUBLEPULSAR SMB IMPLANT DETECTED!!! XOR Key: 0x7c3bf3c1
  25. [+] [192.168.175.136] DOUBLEPULSAR uninstall successful

Scanning your network

  1. # target network (adapt this to your network)
  2. NETWORKRANGE=192.168.33.0/24
  3. # install the required scanning tools
  4. brew install masscan || apt-get install masscan
  5. git clone https://github.com/countercept/doublepulsar-detection-script.git
  6. cd doublepulsar-detection-script
  7. # scan open ports
  8. masscan -p445  $NETWORKRANGE > smb.lst
  9. masscan -p3389 $NETWORKRANGE > rdp.lst
  10. # clean the list of IPs
  11. sed -i "s/^.* on //" smb.lst
  12. sed -i "s/^.* on //" rdp.lst
  13. # check vulnerabilities on the hosts who have the service open
  14. python detect_doublepulsar_smb.py --file smb.lst
  15. python detect_doublepulsar_rdp.py --file rdp.lst
  17. # Or, if you have the python netaddr library
  18. python detect_doublepulsar_smb.py --net 192.168.0.1/24

Snort

This repository also contains three Snort signatures that can be used for detecting the use of the unimplemented SESSION_SETUP Trans2 command that the SMB ping utility uses and different response cases. While we do not condone the reliance on signatures for effective attack detection, due to how easily they are bypassed, these rules are highly specific and should provide some detection capability against new threat groups reusing these exploits and implants without modification.

More info

https://www.countercept.com/our-thinking/analyzing-the-doublepulsar-kernel-dll-injection-technique/
https://zerosum0x0.blogspot.co.uk/2017/04/doublepulsar-initial-smb-backdoor-ring.html