| 1 |
PE Hunter is a plugin for snort (aka dynamic preprocessor) for extracting |
|---|
| 2 |
Windows executables (files in PE format) from the network stream. |
|---|
| 3 |
|
|---|
| 4 |
It first spots a PE header and then uses a simple heuristik to calculate the |
|---|
| 5 |
file length. Starting at the header offset in a stream, the resulting number of |
|---|
| 6 |
bytes is then dumped to a file. |
|---|
| 7 |
|
|---|
| 8 |
This technique does not work for some specially crafted binaries, e.g., self- |
|---|
| 9 |
extracting archives or programs with additional data after the end of the last |
|---|
| 10 |
section since there is no way to passively identify such data in a stream. |
|---|
| 11 |
|
|---|
| 12 |
|
|---|
| 13 |
Compiling and Installation |
|---|
| 14 |
-------------------------- |
|---|
| 15 |
|
|---|
| 16 |
Copy the pehunter source directory to src/dynamic-preprocessors in the snort |
|---|
| 17 |
source tree. You have to add a line like |
|---|
| 18 |
|
|---|
| 19 |
#define PP_PEHUNTER 28 |
|---|
| 20 |
|
|---|
| 21 |
to src/preprocids.h. Then modify the autoconf stuff to include the module in |
|---|
| 22 |
the build process. The usual configure [opts] && make && make install places |
|---|
| 23 |
installs snort with PEHunter preprocessor. |
|---|
| 24 |
|
|---|
| 25 |
Use snort in inline mode (configure with --enable-inline on Linux) to make sure |
|---|
| 26 |
that no packet gets missed. This quarantees full and fault-free stream |
|---|
| 27 |
reassembly and is the recommended mode for PEHunter. |
|---|
| 28 |
|
|---|
| 29 |
|
|---|
| 30 |
Configuration |
|---|
| 31 |
------------- |
|---|
| 32 |
|
|---|
| 33 |
Files are stored as their md5 checksum of the corresponding data in a |
|---|
| 34 |
configurable location. Snort must be configured to use PE Hunter. Please include |
|---|
| 35 |
the following lines in your snort.conf: |
|---|
| 36 |
|
|---|
| 37 |
|
|---|
| 38 |
# make sure to load the stream4 preprocessor first |
|---|
| 39 |
dynamicpreprocessor file /location/of/libsf_smtp_preproc.so |
|---|
| 40 |
|
|---|
| 41 |
# Configure PE Hunter module |
|---|
| 42 |
# -------------------------- |
|---|
| 43 |
preprocessor pehunter: dump_dir /var/log/snort/binaries |
|---|
| 44 |
|
|---|
| 45 |
|
|---|
| 46 |
Add a 'debug' option to the above line to produce verbose logging. |
|---|
| 47 |
|
|---|
| 48 |
|
|---|
| 49 |
PEHunter is licensed under the GNU General Public License version 2. |
|---|
| 50 |
Copyright (C) 2007 Tillmann Werner <tillmann.werner@gmx.de> |
|---|
