Re: [Snort-users] Team0x42 Snort rules

permalink · #1 (**permalink**) 04-07-2008

--===============1794587161==
Content-Type: multipart/alternative;
boundary="_f2cc7d17-db1d-4faf-be3f-14886dc02f49_"

--_f2cc7d17-db1d-4faf-be3f-14886dc02f49_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Everyone knows Team0x41 pwns all

Shirkdog
' or 1=3D1-- =0A=

http://www.shirkdog.us

> From: lurene.grenier@sourcefire.com
> To: TheWell@team0x42.homeunix.org
> Date: Mon, 7 Apr 2008 18:05:44 -0400
> CC: snort-users@lists.sourceforge.net
> Subject: Re: [Snort-users] Team0x42 Snort rules
>=20
> In addition you might want to note that the MSF default behavior is to
> encode all shellcode and append a decoder to the beginning of the payload=
,
> so none of those MSF shellcode rules will work except the HPUX on PA-RISC
> because it lacks a valid encoder (though HPUX on ia64 should still be
> undetectable with that rule).
>=20
> I'm not in Brooklyn but I am crafty.
>=20
> _________________________
> Lurene A Grenier,=20
> Analyst Team Lead
> Senior Research Engineer
> =20
> Office: (410) 423-1918
> Mobile: (703) 839-3898
> ,,_
> SourceFire Inc. o" )~
> ''''
>=20
>=20
> -----Original Message-----
> From: snort-users-bounces@lists.sourceforge.net
> [mailto:snort-users-bounces@lists.sourceforge.net] On Behalf Of Brian
> Caswell
> Sent: Monday, April 07, 2008 6:00 PM
> To: TheWell
> Cc: snort-users@lists.sourceforge.net
> Subject: Re: [Snort-users] Team0x42 Snort rules
>=20
> On Apr 7, 2008, at 5:01 PM, TheWell wrote:
> > Some good snort rules by Team0x42
>=20
> Team B,
>=20
> Really?
>=20
> I see 5 rules that are all basically the same thing. Perhaps you =20
> should update your regular expression to include all 5 cases you =20
> attempt to cover in 1 rule.
>=20
> The following regular expression is released under the license to ill, =20
> however you may not use it unless you are in Brooklyn, and you did not =20
> sleep while traveling to said city.
>=20
> (\%(60|3b|7c|00)|<)
>=20
> Brian
>=20
> -------------------------------------------------------------------------
> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference=20
> Register now and save $200. Hurry, offer ends at 11:59 p.m.,=20
> Monday, April 7! Use priority code J8TLD2.=20
> http://ad.doubleclick.net/clk;198757...va.sun.com/ja=
vao
> ne
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.p...=3Dsnort-users
>=20
>=20
> -------------------------------------------------------------------------
> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference=20
> Register now and save $200. Hurry, offer ends at 11:59 p.m.,=20
> Monday, April 7! Use priority code J8TLD2.=20
> http://ad.doubleclick.net/clk;198757...va.sun.com/ja=
vaone
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/...fo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.p...=3Dsnort-users

__________________________________________________ _______________
Use video conversation to talk face-to-face with Windows Live Messenger.
http://www.windowslive.com/messenger...d=3DTXT_TAGLM=
_WL_Refresh_messenger_video_042008=

--_f2cc7d17-db1d-4faf-be3f-14886dc02f49_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<style>
..hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class=3D'hmmessage'><div style=3D"text-align: left;">Everyone knows T=
eam0x41 pwns all </div> Shirkdog ' or 1=3D1-- =0A=
 http://www.shirkdog.us <hr id=3D"stopSpelling">> From: lurene=
..grenier@sourcefire.com > To: TheWell@team0x42.homeunix.org > D=
ate: Mon, 7 Apr 2008 18:05:44 -0400 > CC: snort-users@lists.sourcefor=
ge.net > Subject: Re: [Snort-users] Team0x42 Snort rules > =
> In addition you might want to note that the MSF default behavior is to=
 > encode all shellcode and append a decoder to the beginning of the =
payload, > so none of those MSF shellcode rules will work except the =
HPUX on PA-RISC > because it lacks a valid encoder (though HPUX on ia=
64 should still be > undetectable with that rule). > > I=
'm not in Brooklyn but I am crafty. > > ______________________=
___ > Lurene A Grenier, > Analyst Team Lead > Senior Res=
earch Engineer > > Office: (410) 423-1918 > Mobile: (70=
3) 839-3898 > ,,_ > SourceFire Inc. o" )~ =
> '''' > > > -----Original Message-=
---- > From: snort-users-bounces@lists.sourceforge.net > [mailt=
o:snort-users-bounces@lists.sourceforge.net] On Behalf Of Brian > Cas=
well > Sent: Monday, April 07, 2008 6:00 PM > To: TheWell &g=
t; Cc: snort-users@lists.sourceforge.net > Subject: Re: [Snort-users]=
Team0x42 Snort rules > > On Apr 7, 2008, at 5:01 PM, TheWell =
wrote: > > Some good snort rules by Team0x42 > > Team=
B, > > Really? > > I see 5 rules that are all ba=
sically the same thing. Perhaps you > should update your regular e=
xpression to include all 5 cases you > attempt to cover in 1 rule.<=
br>> > The following regular expression is released under the lic=
ense to ill, > however you may not use it unless you are in Brookly=
n, and you did not > sleep while traveling to said city. > <b=
r>> (\%(60|3b|7c|00)|<) > > Brian > > -----=
-------------------------------------------------------------------- &gt=
; This SF.net email is sponsored by the 2008 JavaOne(SM) Conference &gt=
; Register now and save $200. Hurry, offer ends at 11:59 p.m., > Mon=
day, April 7! Use priority code J8TLD2. > http://ad.doubleclick.net/=
clk;198757673;13503038;p?http://java.sun.com/javao > ne > _____=
__________________________________________ > Snort-users mailing list=
 > Snort-users@lists.sourceforge.net > Go to this URL to change=
user options or unsubscribe: > https://lists.sourceforge.net/lists/l=
istinfo/snort-users > Snort-users list archive: > http://www.ge=
ocrawler.com/redir-sf.php3?list=3Dsnort-users > > > ---=
---------------------------------------------------------------------- &=
gt; This SF.net email is sponsored by the 2008 JavaOne(SM) Conference &=
gt; Register now and save $200. Hurry, offer ends at 11:59 p.m., > M=
onday, April 7! Use priority code J8TLD2. > http://ad.doubleclick.ne=
t/clk;198757673;13503038;p?http://java.sun.com/javaone > ____________=
___________________________________ > Snort-users mailing list &gt=
; Snort-users@lists.sourceforge.net > Go to this URL to change user o=
ptions or unsubscribe: > https://lists.sourceforge.net/lists/listinfo=
/snort-users > Snort-users list archive: > http://www.geocrawle=
r.com/redir-sf.php3?list=3Dsnort-users <hr />Use video conversatio=
n to talk face-to-face with Windows Live Messenger. <a href=3D'http://www.w=
indowslive.com/messenger/connect_your_way.html?ocid=3DTXT_TAGLM_WL_Refresh_ =
messenger_video_042008' target=3D'_new'>Get started!</a></body>
</html>=

--_f2cc7d17-db1d-4faf-be3f-14886dc02f49_--

--===============1794587161==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-------------------------------------------------------------------------
This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
Register now and save $200. Hurry, offer ends at 11:59 p.m.,
Monday, April 7! Use priority code J8TLD2.
http://ad.doubleclick.net/clk;198757...un.com/javaone
--===============1794587161==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users
--===============1794587161==--

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode