A minimal IPS

minips.py

#!/usr/bin/env python

import sys
import re
import datetime, time
import argparse
import nids

end_states = (nids.NIDS_CLOSE, nids.NIDS_TIMEOUT, nids.NIDS_RESET)

globs = {
    'device': None,
    'pcap': None,
    'killtcp': False,
    'regexstr': None,
    'regexobj': None,
    'regexflags': re.MULTILINE,
    'dispbytes': 0
}

matchstats = {
    'start': 0,
    'end': 0,
    'size': 0
}

def gettimestamp():
    return "%s %s" % (datetime.datetime.now().strftime("%d-%b-%Y %H:%M:%S.%f"), time.tzname[0])

def hexdump(data, length=16, sep='.'):
    lines = []
    FILTER = ''.join([(len(repr(chr(x))) == 3) and chr(x) or sep for x in range(256)])
    for c in xrange(0, len(data), length):
        chars = data[c:c+length]
        hex = ' '.join(["%02x" % ord(x) for x in chars])
        printablechars = ''.join(["%s" % ((ord(x) <= 127 and FILTER[ord(x)]) or sep) for x in chars])
        lines.append("%08x: %-*s |%s|\n" % (c, length*3, hex, printablechars))

    print ''.join(lines)

def inspect(data):
    matchobj = globs['regexobj'].search(data)

    if matchobj:
        matchstats['start'] = matchobj.start()
        matchstats['end'] = matchobj.end()
        matchstats['size'] = matchobj.end() - matchobj.start()
        return True
    else:
        return False

def udpcallback(addr, payload, pkt):
    ((src, sport), (dst, dport)) = addr
    matched = False

    print "[%s] UDP %s:%s - %s:%s (%dB)" % (gettimestamp(), src, sport, dst, dport, len(payload))
    if len(payload) > 0:
        matched = inspect(payload)
        if matched:
            print "[%s] UDP %s:%s - %s:%s matches regex \'%s\'" % (gettimestamp(), src, sport, dst, dport,
                    globs['regexstr']),
            print "@ [%d:%d] %dB" % (matchstats['start'], matchstats['end'], matchstats['size'])

            if globs['dispbytes'] > 0 and matchstats['size'] > globs['dispbytes']:
                hexdump(payload[matchstats['start']:matchstats['start'] + globs['dispbytes']])
            else:
                hexdump(payload[matchstats['start']:matchstats['end']])

def tcpcallback(tcp):
    ((src, sport), (dst, dport)) = tcp.addr
    matched = False

    if tcp.nids_state == nids.NIDS_JUST_EST:
        tcp.client.collect = 1
        tcp.server.collect = 1
        print "[%s] TCP %s:%s - %s:%s (NEW)" % (gettimestamp(), src, sport, dst, dport)

    elif tcp.nids_state == nids.NIDS_DATA:
        tcp.discard(0)
        print "[%s] TCP %s:%s - %s:%s (CTS: %dB | STC: %dB)" % (gettimestamp(), src, sport, dst, dport, 
                len(tcp.server.data[:tcp.server.count]),
                len(tcp.client.data[:tcp.client.count]))

        if len(tcp.server.data[:tcp.server.count]) > 0:
            matched = inspect(tcp.server.data[:tcp.server.count])
            if matched:
                print "[%s] TCP %s:%s - %s:%s matches regex \'%s\'" % (gettimestamp(), src, sport, dst, dport,
                        globs['regexstr']),
                print "@ CTS[%d:%d] %dB" % (matchstats['start'], matchstats['end'], matchstats['size'])

                if globs['dispbytes'] > 0 and matchstats['size'] > globs['dispbytes']:
                    hexdump(tcp.server.data[matchstats['start']:matchstats['start'] + globs['dispbytes']])
                else:
                    hexdump(tcp.server.data[matchstats['start']:matchstats['end']])

                tcp.client.collect = 0
                tcp.server.collect = 0

                if globs['killtcp']:
                    tcp.kill

                return

        if len(tcp.client.data[:tcp.client.count]) > 0:
            matched = inspect(tcp.client.data[:tcp.client.count])
            if matched:
                print "[%s] TCP %s:%s - %s:%s matches regex \'%s\'" % (gettimestamp(), src, sport, dst, dport,
                        globs['regexstr']),
                print "@ STC[%d:%d] %dB" % (matchstats['start'], matchstats['end'], matchstats['size'])
                hexdump(tcp.client.data[matchstats['start']:matchstats['end']])

                if globs['dispbytes'] > 0 and matchstats['size'] > globs['dispbytes']:
                    hexdump(tcp.server.data[matchstats['start']:matchstats['start'] + globs['dispbytes']])
                else:
                    hexdump(tcp.server.data[matchstats['start']:matchstats['end']])

                tcp.client.collect = 0
                tcp.server.collect = 0

                if globs['killtcp']:
                    tcp.kill

                return

    elif tcp.nids_state in end_states:
        print "[%s] TCP %s:%s - %s:%s (CLOSE)" % (gettimestamp(), src, sport, dst, dport)

def main():
    parser = argparse.ArgumentParser(description='minips.py - A minimal IPS', version='0.1',
            epilog='EXAMPLE: %(prog)s -p test.pcap -r \'shellcode\' \n')
    inputparser = parser.add_mutually_exclusive_group(required=True)
    inputparser.add_argument('-d', '--device', action='store', dest='device',
            help='network device to collect packets from')
    inputparser.add_argument('-p', '--pcap', action='store', dest='pcap',
            help='pcap file to read packets from')
    parser.add_argument('-r', '--regex', action='store', dest='regex', required=True,
            help='regex to match over network data')
    parser.add_argument('-i', '--igncase', action='store_true', dest='igncase', default=False,
            help='perform case insensitive regex match')
    parser.add_argument('-m', '--multiline', action='store_true', dest='multiline', default=False,
            help='perform multiline regex match')
    parser.add_argument('-k', '--killtcp', action='store_true', dest='killtcp', default=False,
            help='terminate matching tcp connections')
    parser.add_argument('-b', '--dispbytes', action='store', dest='dispbytes', required=False,
            help='max bytes to display')

    args = parser.parse_args()

    if args.device:
        globs['device'] = args.device
        nids.param('device', globs['device'])

    if args.pcap:
        globs['pcap'] = args.pcap
        nids.param('filename', globs['pcap'])

    if args.killtcp:
        globs['killtcp'] = True

    if args.igncase:
        globs['regexflags'] |= re.IGNORECASE

    if args.multiline:
        globs['regexflags'] |= re.MULTILINE
        globs['regexflags'] |= re.DOTALL

    if args.regex:
        globs['regexstr'] = args.regex
        globs['regexobj'] = re.compile(globs['regexstr'], globs['regexflags'])

    if args.dispbytes:
        globs['dispbytes'] = int(args.dispbytes)

    nids.init()
    nids.register_tcp(tcpcallback)
    nids.register_udp(udpcallback)

    try:
        nids.run()
    except nids.error, e:
        print "[-] Error: %s" % (e)
    except Exception, e:
        print "[-] Exception: %s" % (e)

if __name__ == '__main__':
    main()