topic Re: IPS Prevent with wrong signature in General Topics

IPS Prevent with wrong signature

Sarm_Chanatip — Thu, 09 Apr 2020 07:56:18 GMT

Hi Guys,

I had a chance to test IPS functional with detecting or preventing in R80.30 version, so my experiment is to use the Metasploit tool in kali with Exploit Eternalblue.

After exploited successfully, found that the security gateway was able to block some malicious code with IPS module but the signature is being shown on the screenshot below is MS10-012 ( Microsoft SMB server race condition denial of service)

Actually it should be prevented with MS17-010 (SMB Remote Code Execution)

Does anyone here explain to me regarding this behavior?

Thank you in advance.

Regards,

Sarm

Re: IPS Prevent with wrong signature

Sarm_Chanatip — Fri, 10 Apr 2020 07:49:48 GMT

Does anyone know?

Re: IPS Prevent with wrong signature

Timothy_Hall — Fri, 10 Apr 2020 12:38:59 GMT

First off, the firewall blocked it correctly so it doesn't really matter which IPS signature got matched.

But to answer your question if I am reading the CVEs correctly, MS10-012 (Microsoft SMB server race condition denial of service- CVE-2010-0021) was the ability to corrupt and crash the system (DoS) through a vulnerability in the SMB v1 server and was revealed in 2010. MS17-010 (SMB Remote Code Execution - CVE-2017-0143) appears to be very similar in that it is the weaponization of that earlier vulnerability in 2017 that can execute arbitrary code via SMB v1, instead of just cause a DoS. So to me it looks like the same vulnerability with just different outcomes (DoS in 2010 vs. running arbitrary code in 2017). In that case it would make sense that the 2010 IPS signature would get triggered, even though your kit was attempting the 2017 code exploit as they are basically the same thing, just different outcomes. I don't think your exploit got far enough to inject the arbitrary code before the 2010 IPS signature was triggered and stopped it.

Check out this other CheckMates thread which is very similar to your situation:

IPS signature does not match with attack type

Re: IPS Prevent with wrong signature

Sarm_Chanatip — Fri, 17 Apr 2020 14:48:51 GMT

Hi Timthy_Hall

Thank you for sharing.

I appreciate your comment.