Author: danny

To further test the Snort IDS setup I wanted to see if it would detect an incoming virus. There is no way for me to try this with a wild virus because my ISP blocks ports 139 and 445, the Microsoft Networking ports, because they are such common vectors for viruses. Nor would I be interested in catching a real virus, however NMAP includes a script that will crash a system that does not contain the MS08-067 patch. The nmap -PN -T4 -p139,445 -n -v --script smb-check-vulns,smb-os-discovery --script-args safe=1 [targetnetworks] command will cause a buffer overflow that will crash the remote procedure call server of an unpatched system, and if the script is run in unsafe mode, it can crash the entire system ans so should only be used in controlled environments. This is the exploit that the Conficker worm initially leveraged to spread itself. I set up an SMB share on my Ubuntu machine to open ports 139 and 445 and then ran the script. The results said that because I was attacking a Unix system, it was not likely to have a Windows specific exploit. I was not interested in crashing the system, however I was interested to see if snort would detect the attack. When I checked there was no new entry in the snort log meaning that it did not report the attack. This might be due to the configuration of my snort install; it is not setup to detect virus activity, but more tuned to network scans and break-ins