Malware Forge

After some work, I have committed a patch to the Rule2Alert svn. When first run, Rule2Alert will display its help menu seen below:

famousjs@youbantoo:~/rule2alert$ sudo python r2a.py
Usage: python r2a.py [-vt] -f rule_file -c snort_config -w pcap

Options:
-h, --help show this help message and exit
-f RULE_FILE Read in snort rule file
-c SNORT_CONF Read in snort configuration file
-w PCAP Name of pcap file
-v Verbose hex output of raw alert
-t Test rule against current snort configuration
-m HOMENET Set $HOME_NET IP Address
-e EXTNET Set $EXTERNAL_NET IP Address

Rule2Alert now allows setting of the HOME_NET and EXTERNAL_NET variables via arguments. These variables will be used when crafting the packets. If using these options with the "-t" switch, the variables will have to conform to the networks set in the snort.conf file. If they "-m" or "-e" flags are not set, Rule2Alert will fill these variables in based off snort.conf.

The results of loading in emerging-all.rules are seen below (Not all Output Shown):

famousjs@youbantoo:~/rule2alert$ sudo python r2a.py -c /etc/snort/snort.conf -f /etc/snort/rules/emerging-all.rules -w emerging-all.pcap -t
Building Rule: 2004206
Building Rule: 2009700
Building Rule: 2002170
...
...
Loaded 7802 rules successfully!
Writing packets to pcap...
Running snort test...
Alerted on 972 rules
Failed to alert on 6830 rules

--------

This output can be verified by running snort and reading in the created pcap:

famousjs@youbantoo:~/rule2alert$ snort -c /etc/snort/snort.conf -K none -q -A console -r emerging-all.pcap | wc -l
command line overrides rules file alert plugin!
command line overrides rules file logging plugin!
1080

There are actually 1080 alerts in the pcap, however some are duplicates which Rule2Alert does not report. Rule2Alert now also has integrated a Reverse-Regex class written Blake (JsUnpack) that attempts to generate content matches for pcre content sections.