In this clip,
we're going to discuss the first specific threat we're
attempting to detect with the rule sets we obtained from
open‑source and customer rule sources.
For this course,
we're going to detect attempts to trigger a back door
in our vulnerable UnrealIRC server.
The version of the software installed on our
Metasploitable 2 server has a back door.
It's triggered by starting a command with two specific characters, A and B.
When the server receives this sequence,
it hands it off to the system, along with any other characters after
those first two are run. We can trigger this back door easily using
Metasploit and send a reverse shell payload.
When we configure Metasploit to use this exploit in
combination with a reverse shell payload,
it sets up a listener and sends the AB command to the remote
server followed by our selected payload.
The IRC's back door is triggered,
and the commands we added after it execute to connect back to
our listener on the hacking workstation.
At this point, we have a shell and can execute more commands on the remote host.
We can also set the target to switch to a Meterpreter shell,
which runs in memory and allows us to explore the host.
When we simulate the traffic, we'll run a scan of the host,
use Metasploit to exploit the target,
and switch to a Meterpreter shell once we gain access.
This allows us to see what alerts are generated at each phase.
First, let's look at the potential rule sources that could detect this traffic.
We have the emerging threats rule source,
which contains a chat rule subset with multiple rules to detect IRC traffic.
We also have the threat hunting rule source,
which contained a rule set to detect the use of Meterpreter reverse HTTP shells.
And finally,
we have our custom rule source that contains a few
more IRC rules for our evaluation.
The trafficid rule set is not ideal for this scenario,
so we won't evaluate it here.
But before we dive into our rule evaluation,
let's take a closer look at capturing traffic and replaying it with PCAP files.