# Snort Challenge - The Basics

**Room Link:** [https://tryhackme.com/room/snortchallenges1](https://tryhackme.com/room/snortchallenges1)





## Writing IDS Rules (HTTP)

\
**Navigate to the task folder.**\
**Use the given pcap file.**\
**Write rules to detect "all TCP port 80 traffic" packets in the given pcap file.**&#x20;

**What is the number of detected packets?**

**local.rules**

```
alert tcp any any <> any 80 (msg:"TCP Port 80 Traffic Detected inbound"; sid:10001;)
alert tcp any 80 <> any any (msg:"TCP Port 80 Traffic Detected outbound"; sid:10002;)
```

**Kali**

```
sudo snort -c local.rules -r mx-3.pcap -A full -l .
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2F1d4fKGcdctAsc6tXboCZ%2Fimage.png?alt=media&#x26;token=da812c46-e896-4823-b9d7-21890a69d961" alt=""><figcaption></figcaption></figure>

**What is the destination address of packet 63?**

The easiest way to look at a certain packet is to use -n to only show the amount of packets we want to see.

**Kali**

```
sudo snort -r snort.log.1690286170 -n63
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FRn2HPSdM5CRbzlv21mAk%2Fimage.png?alt=media&#x26;token=85ece33b-bf8f-44d6-81ba-b676c59ca49d" alt=""><figcaption></figcaption></figure>

**What is the ACK number of packet 64?**

**Kali**

```
sudo snort -r snort.log.1690286170 -n64
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FFRUYSOVjAqwZ367D3gBf%2Fimage.png?alt=media&#x26;token=35acc892-9fb3-4a3e-bd2d-60a29a685171" alt=""><figcaption></figcaption></figure>

**What is the SEQ number of packet 62?**

**Kali**

```
sudo snort -r snort.log.1690286170 -n62
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FUM3z8LanUqJpHiHEHpYg%2Fimage.png?alt=media&#x26;token=b72be68d-0ad3-43a7-8627-08ed57e25ac9" alt=""><figcaption></figcaption></figure>

**What is the TTL of packet 65?**

**Kali**

```
sudo snort -r snort.log.1690286170 -n65
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FCrxKb8zqukjZ2GQEmK3Q%2Fimage.png?alt=media&#x26;token=da712dce-6e87-4bbe-84d6-9e720219371d" alt=""><figcaption></figcaption></figure>

**What is the source IP of packet 65?**

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FBfGk5DxxMkpK3eojaWo9%2Fimage.png?alt=media&#x26;token=11660fe7-74c9-4553-80b5-d097f38f35c3" alt=""><figcaption></figcaption></figure>

**What is the source port of packet 65?**

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2F90ADz58yybLrjBXcRYrM%2Fimage.png?alt=media&#x26;token=406c48f6-a92d-4142-ab75-44784c005222" alt=""><figcaption></figcaption></figure>



## Writing IDS Rules (FTP)

**local.rules**

```
alert tcp any any <> any 21 (msg:"FTP inbound"; sid:10001;)
alert tcp any 21 <> any any (msg:"FTP outbound"; sid:10002;)
```

**What is the number of detected packets?**

**Kali**

```
sudo snort -c local.rules -r ftp-png-gif.pcap -A full -l .
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FU2FNTbkkJ5MbA56rbVjq%2Fimage.png?alt=media&#x26;token=2095dc9a-92ef-4883-ae95-898cdb1140e7" alt=""><figcaption></figcaption></figure>

**What is the FTP service name?**

**Kali**

```
sudo snort -r snort.log.1690287034 -X
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FPedlVnCoQNTmGUs9VXN9%2Fimage.png?alt=media&#x26;token=9d4fa7b6-d49d-49bf-b7f8-95c92cf3b798" alt=""><figcaption></figcaption></figure>

**Write a rule to detect failed FTP login attempts in the given pcap. What is the FTP service name?**

**local.rules**

```
alert tcp any any <> any 21 (msg: "Failed FTP Login"; content:"530 User"; sid: 100003; rev: 1;)alert tcp any any <> any 21 (msg: "Failed FTP Login"; content:"530 User"; sid: 100003; rev: 1;)alert tcp any any <> any 21 (msg: "Failed FTP Login"; content:"530 User"; sid: 100003; rev: 1;)
```

**Kali**

```
sudo snort -c local.rules -r ftp-png-gif.pcap -A full -l .
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FIN3CHxVXEsJUKP3GFM7e%2Fimage.png?alt=media&#x26;token=cf7841fc-9072-4ec1-89e0-dd6b2a4ea90b" alt=""><figcaption></figcaption></figure>



**Write a rule to detect successful FTP logins in the given pcap. What is the number of detected packets?**

**local.rules**

```
alert TCP any any <> any 21 (msg:"FTP Success Login"; content:"230 User"; sid:100000; rev:1;)
```

**Kali**

```
sudo snort -c local.rules -r ftp-png-gif.pcap -A full -l .
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2F2J4Pq1WBzFVDJ8kvujMR%2Fimage.png?alt=media&#x26;token=14f3cdd0-b3db-4f55-83d2-0cf697c4cf8f" alt=""><figcaption></figcaption></figure>

**Write a rule to detect failed FTP login attempts with a valid username but a bad password or no password. What is the number of detected packets?**

**local.rules**

```
alert tcp any any <> any 21 (msg: "FTP Failed Login-Bad or No Password"; content:"331 Password"; sid: 100005; rev: 1;)
```

**Kali**

```
sudo snort -c local.rules -r ftp-png-gif.pcap -A full -l .
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FMi4Cg9UzVB0hsDbv9BZt%2Fimage.png?alt=media&#x26;token=9ac5254d-b201-40f0-88db-2adf2e285b11" alt=""><figcaption></figcaption></figure>

**Write a rule to detect failed FTP login attempts with "Administrator" username but a bad password or no password. What is the number of detected packets?**

**local.rules**

```
alert tcp any any <> any 21 (msg: "FTP Failed Login-Bad or No Password"; content:"331 Password"; sid: 100005; rev: 1;)
```

**Kali**

```
sudo snort -c local.rules -r ftp-png-gif.pcap -A full -l .
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FlbDVxCq9J4BJrp9WjjUo%2Fimage.png?alt=media&#x26;token=95ee96d2-d2df-4296-9c1c-1ae7268a2a49" alt=""><figcaption></figcaption></figure>

## Writing IDS Rules (PNG)

**Write a rule to detect the PNG file in the given pcap.**

**local.rules**

```
alert TCP any any <> any any (msg:"PNG File Dectected"; content:"|89 50 4E 47 0D 0A 1A 0A|"; sid:100002; rev:1;)
```

**Investigate the logs and identify the software name embedded in the packet.**

**Kali**

```
sudo snort -c local.rules -r ftp-png-gif.pcap -A full -l .
sudo snort -r snort.log* -X
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FFIuNMNI8SNoW2FGtZkKT%2Fimage.png?alt=media&#x26;token=e64096d4-2874-4c78-af43-3bdc7e4bddd8" alt=""><figcaption></figcaption></figure>

**Write a rule to detect the GIF file in the given pcap.**

**local.rules**

```
alert TCP any any <> any any (msg:"GIF87a detected"; content:"|47 49 46 38 37 61|"; sid:10000003; rev:1;)
alert TCP any any <> any any (msg:"GIF89A detected"; content:"|47 49 46 38 39 61|"; sid:10000004; rev:1;)
```

**Investigate the logs and identify the software name embedded in the packet.**

**Kali**

```
sudo snort -c local.rules -r ftp-png-gif.pcap -A full -l .
sudo snort -r snort.log* -X
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FYoHM6NeOdkiPvjHmWOTA%2Fimage.png?alt=media&#x26;token=6254f255-69dc-4e4f-94ee-380c01a02d48" alt=""><figcaption></figcaption></figure>

## Writing IDS Rules (Torrent Metafile)

**Write a rule to detect the torrent metafile in the given pcap.**

**local.rules**

```
alert TCP any any <> any any (msg:"Torrent Detected"; content:".torrent"; sid:10000003; rev:1;)
```

**What is the number of detected packets?**

**Kali**

```
sudo snort -c local.rules -r torrent.pcap -A full -l .
sudo snort -r snort.log* -X
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2F2a9vozSLtn2TeDPTleKa%2Fimage.png?alt=media&#x26;token=d571a75a-7a35-4cb8-8624-dc13186cdbd9" alt=""><figcaption></figcaption></figure>

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FBHH4KzEAu0zUoRtVL32z%2Fimage.png?alt=media&#x26;token=8774b075-9dae-44d6-be1b-a06c30a3a64b" alt=""><figcaption></figcaption></figure>

## Troubleshooting Rule Syntax Errors

**Fix the syntax error in local-1.rules file and make it work smoothly.**

**local-1.rules**

```
alert TCP any 3372 -> any any (msg:"Troubleshooting 1"; sid:1000001; rev:1;)
```

**What is the number of the detected packets?**

**Kali**

```
sudo snort -c local-1.rules -r mx-1.pcap -A full -l .
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FaGGMwCHNoJfVLpR2bkw5%2Fimage.png?alt=media&#x26;token=d3d3d9b8-9fda-48fc-8094-cf71c6ba98b7" alt=""><figcaption></figcaption></figure>

**Fix the syntax error in local-2.rules file and make it work smoothly.**

**local-2.rules**

```
alert icmp any any -> any any (msg:"Troubleshooting 2"; sid:1000001; rev:1;)
```

**What is the number of the detected packets?**

**Kali**

```
sudo snort -c local-2.rules -r mx-1.pcap -A full -l .
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FFl3TAMrAeNkCeGGbJFOs%2Fimage.png?alt=media&#x26;token=282a99e7-115e-4f19-b10e-0751a94cc196" alt=""><figcaption></figcaption></figure>

**Fix the syntax error in local-3.rules file and make it work smoothly.**

**local-3.rules**

```
alert icmp any any -> any any (msg:"ICMP Packet Found"; sid:1000001; rev:1;)
alert tcp any any -> any 80,443 (msg:"HTTPX Packet Found"; sid:1000002; rev:1;)
```

**What is the number of the detected packets?**

**Kali**

```
sudo snort -c local-3.rules -r mx-1.pcap -A full -l .
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2Fcsm7UrmfOig7d77iVHTD%2Fimage.png?alt=media&#x26;token=c42474b1-711b-4cdf-ad2f-b8208f972186" alt=""><figcaption></figcaption></figure>



**Fix the syntax error in local-4.rules file and make it work smoothly.**

**local-4.rules**

```
alert icmp any any -> any any (msg:"ICMP Packet Found"; sid:1000001; rev:1;)
alert tcp any any -> any 80,443 (msg:"HTTPX Packet Found"; sid:1000002; rev:1;)
```

**What is the number of the detected packets?**

**Kali**

```
sudo snort -c local-4.rules -r mx-1.pcap -A full -l .
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FdTSjPTIx0AcnZheL6CWH%2Fimage.png?alt=media&#x26;token=fdb4a6c0-d46e-47d2-a204-bd54434fffc3" alt=""><figcaption></figcaption></figure>

**Fix the syntax error in local-5.rules file and make it work smoothly.**

**local-5.rules**

```
alert icmp any any <> any any (msg: "ICMP Packet Found"; sid:1000001; rev:1;)
alert icmp any any <> any any (msg: "Inbound ICMP Packet Found"; sid:1000002; rev:1;)
alert tcp any any -> any 80,443 (msg: "HTTPX Packet Found"; sid:1000003; rev:1;)
```

**What is the number of the detected packets?**

**Kali**

```
sudo snort -c local-5.rules -r mx-1.pcap -A full -l .
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FyQkaljDz7uiWRXB3zdwx%2Fimage.png?alt=media&#x26;token=4c943f6b-a9bc-4e2d-af9d-b85ce78ee7d2" alt=""><figcaption></figcaption></figure>

**Fix the syntax error in local-6.rules file and make it work smoothly.**

**local-6.rules**

```
alert tcp any any <> any 80  (msg: "GET Request Found"; content:"|47 45 5sudo snort -c local-6.rules -r mx-1.pcap -A full -l .4|"; sid:100001; rev:1;)
```

**What is the number of the detected packets?**

**Kali**

```
sudo snort -c local-6.rules -r mx-1.pcap -A full -l .
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FKg8Bii7g3qs9IqAHyd6F%2Fimage.png?alt=media&#x26;token=fe240989-3a34-4afc-8006-397bc5559d27" alt=""><figcaption></figcaption></figure>

**Fix the syntax error in local-7.rules file and make it work smoothly.**

**local-7.rules**

```
alert tcp any any <> any 80  (msg:"No Message"; content:"|2E 68 74 6D 6C|"; sid: 100001; rev:1;)
```

**Kali**

```
sudo snort -c local-7.rules -r mx-1.pcap -A full -l .
```



## Using External Rules (MS17-010)

**Use the given rule file (local.rules) to investigate the ms1710 exploitation. What is the number of detected packets?**

**Kali**

```
sudo snort -c local.rules  -A full -l . -r ms-17-010.pcap
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FSGJRYufYGnUrjMLX0CPR%2Fimage.png?alt=media&#x26;token=53ddbefa-f7f4-4f2d-a867-1c23f272f3f6" alt=""><figcaption></figcaption></figure>

**Clear the previous log and alarm files. Use local-1.rules empty file to write a new rule to detect payloads containing the "\IPC$" keyword. What is the number of detected packets?**

**local-1.rules**

```
alert tcp any any -> any 445 (msg: "Exploit Detected!"; flow: to_server, established; content: "IPC$"; sid:2094285; rev: 3;)
```

**Kali**

```
sudo snort -c local-1.rules  -A full -l . -r ms-17-010.pcap
sudo snort -r snort.log* -X
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2Fkom5ZaNMbXAJmlGHodLQ%2Fimage.png?alt=media&#x26;token=1426858b-c265-45b7-a592-0a406ab3b6f7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FzqAhStLevLnjFbYMgIuV%2Fimage.png?alt=media&#x26;token=5d605410-fc4a-4597-b90f-149489b245bf" alt=""><figcaption></figcaption></figure>

## Using External Rules (Log4j)

**Use the given rule file (local.rules) to investigate the log4j exploitation.**

**What is the number of detected packets?**

**Kali**

```
sudo snort -c local.rules  -A full -l . -r log4j.pcap
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FdfLLgsvQ6mIEp9O1KmqI%2Fimage.png?alt=media&#x26;token=afec39a2-5f1c-45da-8717-98e242233c67" alt=""><figcaption></figcaption></figure>

\
**Investigate the log/alarm files. How many rules were triggered?**

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FhSU744oBXIoGEedcqIfX%2Fimage.png?alt=media&#x26;token=81960b2d-ca54-41d8-9db9-b62cf495feda" alt=""><figcaption></figcaption></figure>

\
**Investigate the log/alarm files. What are the first six digits of the triggered rule sids?**

**Kali**

```
sudo snort -c local.rules  -A Full -l .  -r log4j.pcap
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FGmzxy1AeeWnq5M82bBHl%2Fimage.png?alt=media&#x26;token=8e531c8e-af88-4585-901a-d31c419aa4c8" alt=""><figcaption></figcaption></figure>

**local-1.rules**

```
alert tcp any any -> any any (msg:"Payload 770-855 bytes"; dsize:770<>855; sid:100001; rev:1;)
```

**What is the number of detected packets?**

**Kali**

```
sudo snort -c local-1.rules  -A full -l . -r log4j.pcap
sudo snort -eX -r snort.log* | vi -
```

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FPkC4ILUlYYg8hQw3kr8U%2Fimage.png?alt=media&#x26;token=4102b830-de58-436e-9975-406b1d2d1984" alt=""><figcaption></figcaption></figure>

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FvvTRJljvAFrwrrRBChbD%2Fimage.png?alt=media&#x26;token=dbd9680b-3a3f-4d9c-9e64-d8d93b4355d9" alt=""><figcaption></figcaption></figure>

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FlyseeWoobm9fMb6EKSNL%2Fimage.png?alt=media&#x26;token=1d9f30d8-a7dd-4587-9edb-b91795b8c93b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FBhnG1kQknTvpMGjNCG8t%2Fimage.png?alt=media&#x26;token=3d6e7b98-6256-49fd-82a4-11b24efefec9" alt=""><figcaption></figcaption></figure>

**Output**

```
KGN1cmwgLXMgNDUuMTU1LjIwNS4yMzM6NTg3NC8xNjIuMC4yMjguMjUzOjgwfHx3Z2V0IC1xIC1PLSA0NS4xNTUuMjA1LjIzMzo1ODc0LzE2Mi4wLjIyOC4yNTM6ODApfGJhc2g=
```



**CyberChef:** [https://gchq.github.io/CyberChef/](https://gchq.github.io/CyberChef/)

<figure><img src="https://726690082-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhJA9BLlGWiyJFjs4C2Mv%2Fuploads%2FyYrLB8Yweyph7bLXYr4d%2Fimage.png?alt=media&#x26;token=c418fb30-e5a8-4509-897b-173a341be61e" alt=""><figcaption></figcaption></figure>











