initconf / cve-2017-5638_struts Goto Github PK

Should the initial handler for the event http_header raise a Struts::struts_new event?

'victim' is set to the attacking ip:

struts_attack[domain]$victim= c$id$orig_h ; 

But then is overwritten with the client ip later:

if (struts_attack[domain]?$victim)
    struts_attack[domain]$victim= c$id$orig_h;

if (c$id$orig_h == struts_attack[domain]$victim)

I don't think that breaks anything but it appears that if statement is always true and that every Struts::MalwareURLClick will have a Struts::Compromise.

I think this section:

if (domain !in struts_attack)
{
    local rec: struts_MO;

    struts_attack[domain] = rec;
    struts_attack[domain]$web_host = domain;

    struts_attack[domain]$culprit_conn= set();
    add struts_attack[domain]$culprit_conn[c$id];

    struts_attack[domain]$mal_ips= set();
    add struts_attack[domain]$mal_ips[c$id$orig_h];
    add struts_attack[domain]$mal_ips[to_addr(domain)];
    struts_attack[domain]$victim= c$id$orig_h ;
}

should be

if (domain !in struts_attack)
{
    local rec: struts_MO;
    rec$culprit_conn = set();
    rec$mal_ips=set();
    struts_attack[domain] = rec;
}
struts_attack[domain]$web_host = domain;
add struts_attack[domain]$culprit_conn[c$id];
add struts_attack[domain]$mal_ips[c$id$orig_h];
add struts_attack[domain]$mal_ips[to_addr(domain)];
struts_attack[domain]$victim= c$id$resp_h ;
}

otherwise you're only tracking the first orig_h that uses a particular domain... Though it looks like mal_ips may be used to store both the attacking ips and the ips hosting the download.. so not sure.

Reporter::ERROR orphan field "do_notice" in initialization ([source=Struts_Script, do_notice=T])

I corrected this for my install by adding:
@load policy/frameworks/intel/do_notice

The next might not be related to the Struts script, but seemed to crop up after loading do_notice:
Reporter::ERROR no such index (Cluster::nodes[Intel::p$descr]) /bro/share/bro/base/frameworks/intel/./cluster.bro, line 35

I correct this for my install by adding:
@load policy/frameworks/intel/seen

Also seeing a couple other errors, which I haven't corrected for my install yet:

Reporter::ERROR no such index (Struts::parts[2]) /bro/spool/installed-scripts-do-not-touch/site/CVE-2017-5638_struts-cluster.bro, line 97

Reporter::WARNING non-void function returns without a value: Struts::extract_host (empty)

Reporter::ERROR Bad IP address: aaa.linuxa.club (empty)

The last type of error seems to crop up repeatedly with some of the domains seen in the Struts attempts. The example domain does return an IP for me.

This script only appears to monitor for s2-045 exploits, not s2-046. Both are being identified as CVE-2017-5638. Here is a related write-up, and ET has released a snort signature here.