Rebound shell defense method, device, storage medium and system

Abstract

The invention discloses a rebound shell defense method and device, a storage medium and a system, and belongs to the technical field of rebound shell defens.The method comprises the steps that a rebound shell process initiated by an attacker is detected through a monitoring defense party; sending a starting instruction to a bash forward proxy honeypot connected with a real business server of a defense party; obtaining a process deception hijacking module code and injecting the process deception hijacking module code into a rebound shell process; intercepting a command sent by an attacker for the rebound shell process through a process deception hijacking module code, sending the command to the bash forward proxy honeypot, then receiving a false response generated by the bash forward proxy honeypot according to the received command, and sending the false response to the rebound shell process; the false response is sent to the attacker through the rebound shell process; false response is realized by transferring and executing the command, and the defense capability and effect are improved.

Description

Technical Field

[0001] The invention relates to a rebound shell defense method, device, storage medium and system, and belongs to the technical field of rebound shell defense. Background Art

[0002] In the field of network security, Reverse Shell technology, as an advanced and covert remote attack method, has increasingly attracted the attention of hackers and network security researchers. Reverse Shell technology allows attackers to induce the victim's computer to actively establish a reverse connection to the server controlled by the attacker, thereby bypassing traditional firewalls and intrusion detection mechanisms and achieving remote control of the victim's system.

[0003] The basic principle of this technology is that the attacker first sets up a listening port on the server under his control, and constructs malicious code or exploits system vulnerabilities to induce the victim to execute the code. Once executed, the victim's computer will actively initiate a connection to the listening port preset by the attacker to establish a reverse shell session. Through this session, the attacker can execute arbitrary commands on the victim's computer, steal sensitive data, and even perform further malicious operations just like operating the local system. The concealment and efficiency of the rebound shell technology make it one of the most threatening means of network attacks. It can not only penetrate strict network access control policies, but also carry out attacks without being easily detected by traditional security devices. Therefore, it is particularly important for the network security protection system to identify and defend against rebound shell attacks.

[0004] With the continuous evolution and complexity of network attack methods, such as rebound shell technology, traditional defense mechanisms such as firewalls and intrusion detection systems can no longer meet the needs of comprehensive protection. In this context, deception defense technology has emerged as an innovative network security strategy. Deception defense technology deliberately introduces false information or builds a simulated environment (such as honeypots, honeynets, etc.) into the network to induce attackers to consume resources on insignificant baits, thereby effectively protecting real assets from being harmed.

[0005] This technology can not only significantly reduce the probability of successful intrusion by attackers, but also collect and analyze the attacker's behavior data when an attack occurs, providing valuable information for subsequent threat intelligence analysis and defense strategy optimization. Honeypots, as a classic deception defense method, simulate the vulnerabilities and weaknesses of real systems to attract attackers to test and attack, while recording the attacker's behavior patterns, tools and techniques to help defenders understand the latest attack trends and methods. Honeynets further expand this concept by building a complex network environment containing multiple honeypots, simulating the real-world network topology and application scenarios, and achieving the trapping and analysis of more extensive and complex attack behaviors.

[0006] Although existing deception defense technologies have played an important role in practical applications, there are still some common problems. First, existing deception defense technologies cannot perform deception trapping inside the real business server of the defender. Honeypots and secret networks generally occupy idle resources in the network, such as idle IPs and idle ports. Second, existing deception technologies mainly rely on attackers to actively discover secret networks to attack honeypots. They lack the ability to actively implement deception defense against the attack process, and are relatively passive in trapping attacks. In addition, existing deception defense technologies cannot interact with attack resources such as Trojan backdoors and rebound shell processes that have been created by attackers. Summary of the invention

[0007] The purpose of the present invention is to provide a rebound shell defense method, device, storage medium and system to solve the problems existing in the prior art of being unable to defend within the defender, lacking active defense capabilities, and being unable to interact and deceive with attack resources created by the attacker.

[0008] To achieve the above objectives, the present invention is implemented by adopting the following technical solutions: In a first aspect, the present invention provides a rebound shell defense method, comprising: By monitoring the host process and network session of the defender's real business server, the rebound shell process initiated by the attacker is detected; Send a startup command to the bash forward proxy honeypot connected to the defender's real business server; Obtaining a process deception hijacking module code, and injecting the process deception hijacking module code into the rebound shell process; Through the process deception hijacking module code, the command issued by the attacker to the rebound shell process is intercepted and sent to the bash forward proxy honeypot, and then the false response generated by the bash forward proxy honeypot according to the received command is received, and the false response is sent to the rebound shell process; The false response is sent to the attacker through the rebound shell process.

[0009] Furthermore, the bash forward proxy honeypot is provided with a forward proxy port, the command is sent to the forward proxy port, and the received false response is also sent from the forward proxy port.

[0010] Furthermore, the process deception hijacking module code is injected into the rebound shell process through the process injection technology.

[0011] Furthermore, after injecting the process deception hijacking module code into the rebound shell process, it also includes: constructing a process deception hijacking module according to the process deception hijacking module code, and the process deception hijacking module is a .so file.

[0012] Furthermore, the process deception hijacking module is constructed according to the process deception hijacking module code, and is implemented by the following command: g++ -fPIC -shared -o libdefense.so defense.cpp -ldl.

[0013] Furthermore, the command issued by the attacker to the rebound shell process is intercepted and sent to the bash forward proxy honeypot, including: the process deception hijacking module code changes the execution flow of the rebound shell process after receiving the command, releases the execution function of the rebound shell process for the command, and forwards the command to the bash forward proxy honeypot.

[0014] In a second aspect, the present invention provides a rebound shell defense device, comprising: The process detection module is configured to: detect the rebound shell process initiated by the attacker by monitoring the host process and network session of the real business server of the defender; The honeypot startup module is configured to: send a startup command to the bash forward proxy honeypot connected to the real business server of the defender; The code injection module is configured to: obtain the process deception hijacking module code, and inject the process deception hijacking module code into the rebound shell process; The false response generation and forwarding module is configured to: intercept the command issued by the attacker to the rebound shell process through the process deception hijacking module code and send it to the bash forward proxy honeypot, then receive the false response generated by the bash forward proxy honeypot according to the received command, and send the false response to the rebound shell process; The false response sending module is configured to send the false response to the attacker through the rebound shell process.

[0015] Furthermore, the false response generation and forwarding module intercepts the command issued by the attacker to the rebound shell process and sends it to the bash forward proxy honeypot, including: the process deception hijacking module code changes the execution flow of the rebound shell process after receiving the command, releases the execution function of the rebound shell process for the command, and forwards the command to the bash forward proxy honeypot.

[0016] In a third aspect, the present invention provides a computer-readable storage medium having a computer program / instruction stored thereon. When the computer program / instruction is executed by a processor, the steps of the rebound shell defense method described in any one of the first aspects are implemented.

[0017] In a fourth aspect, the present invention provides a rebound shell defense system, including a defender and a bash forward proxy honeypot; The defender is configured to perform the steps of the rebound shell defense method described in any one of the first aspects; A forward proxy port is provided in the bash forward proxy honeypot, and the bash forward proxy honeypot performs the following operations: receiving a command issued by an attacker to the rebound shell process from the process deception hijacking module code in the defender through the forward proxy port, executing the command in the bash forward proxy honeypot, obtaining a false response, and sending the false response to the rebound shell process in the defender.

[0018] Compared with the prior art, the beneficial effects achieved by the present invention are: The present invention provides a rebound shell defense method, device, storage medium and system. The method discovers the rebound shell process initiated by the attacker through monitoring, then injects the process deception hijacking module code into the rebound shell process, modifies its operation logic, intercepts the command (malicious command) issued by the attacker and sends it to the bash forward proxy honeypot. Through the above means, the attacker's malicious command to the rebound shell process in the real business server can be transferred to the virtual honeypot module during the normal interaction between the attacker and the rebound shell process. The attacker actually interacts with the bash forward proxy honeypot in the virtual honeypot, which greatly improves the integration of deception defense technology and real business, improves the ability of the dense network to actively trap the attacker's actions, and enables the deception defense technology to actively deceive the attack process; the interaction process with the rebound shell process also solves the problem in the prior art that it is impossible to interact and deceive with the attack resources created by the attacker; the method is performed inside the real business server of the defender throughout the process, and at the same time solves the problem in the prior art that it is impossible to defend inside the defender.

[0019] Additional advantages, purposes, and features of the present invention will be described in part in the following description, and will become apparent to those skilled in the art after studying the following, or may be learned from the practice of the present invention. The purposes and other advantages of the present invention may be achieved and obtained by the structures specifically indicated in the specification and the accompanying drawings.

[0020] Those skilled in the art will appreciate that the objectives and advantages that can be achieved with the present invention are not limited to the above specific description, and the above and other objectives that can be achieved by the present invention will be more clearly understood from the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a flowchart of a rebound shell defense method corresponding to Embodiment 1 of the present invention; Figure 2 It is a flow chart of a rebound shell defense method corresponding to Embodiment 2 of the present invention; Figure 3 It is a schematic diagram of the interaction between a rebound shell defense system and an attacker corresponding to Example 5 of the present invention. DETAILED DESCRIPTION

[0022] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and are not intended to limit the protection scope of the present invention.

[0023] It should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, only structures and / or processing steps closely related to the solutions according to the present invention are shown in the accompanying drawings, while other details that are not closely related to the present invention are omitted.

[0024] It should be emphasized that the term “include / comprises” when used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0025] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In the accompanying drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0026] It should be emphasized here that the step marks mentioned below are not intended to limit the order of the steps, but it should be understood that the steps can be executed in the order mentioned in the embodiment, or in a different order from the embodiment, or several steps can be executed simultaneously.

[0027] Example 1.

[0028] like Figure 1As shown, the present invention provides a rebound shell defense method, comprising the following steps: By monitoring the host process and network session of the defender's real business server, the rebound shell process initiated by the attacker is detected; Send a startup command to the bash forward proxy honeypot connected to the defender's real business server; Obtaining a process deception hijacking module code, and injecting the process deception hijacking module code into the rebound shell process; Through the process deception hijacking module code, the command issued by the attacker to the rebound shell process is intercepted and sent to the bash forward proxy honeypot, and then the false response generated by the bash forward proxy honeypot according to the received command is received, and the false response is sent to the rebound shell process; The false response is sent to the attacker through the rebound shell process.

[0029] The present invention adopts the above method, specifically, by monitoring and discovering the rebound shell process initiated by the attacker, and then injecting the process deception hijacking module code into the rebound shell process, modifying its operation logic, intercepting the command (malicious command) issued by the attacker and sending it to the bash forward proxy honeypot. By the above means, during the normal interaction between the attacker and the rebound shell process, the malicious command of the attacker to the rebound shell process in the real business server can be transferred to the virtual honeypot module, and the attacker actually interacts with the bash forward proxy honeypot in the virtual honeypot, which greatly improves the integration of the deception defense technology and the real business, improves the ability of the dense network to actively trap the attacker's actions, and enables the deception defense technology to actively deceive the attack process; wherein the interaction process with the rebound shell process also solves the problem in the prior art that it is impossible to interact and deceive with the attack resources created by the attacker; the method is performed inside the real business server of the defender throughout the process, and at the same time solves the problem in the prior art that it is impossible to defend inside the defender.

[0030] Example 2.

[0031] In order to solve the problems of existing deception defense solutions, the deception defense technology cannot be used to deceive and trap the real business of the defender, and relies on the attacker to actively discover the honeypot of the dense network attack, lacks the ability to actively implement deceit defense during the attack process, is relatively passive in attack trapping, and cannot interact with the Trojan backdoors, rebound shells and other attack resources created by the attacker. Figure 2 As shown, the present invention provides a rebound shell defense method, comprising the following steps: (1) Deploy a rebound shell detection module, a process injection module, and a process deception hijacking module inside the defender’s real business server; (2) The rebound shell detection module monitors the host process and network session of the real business server of the defender to promptly detect the rebound shell process initiated by the attacker; (3) The rebound shell detection module detects the rebound shell process initiated by the attacker and records the id of the rebound shell process (shell_pid); (4) In the honeypot module, start the bash forward proxy honeypot and record the IP (honey_ip) and port (honey_port) of the bash forward proxy honeypot. The bash forward proxy honeypot is used to receive the attacker's commands, give false responses, and record the attacker's command operations. (5) The process injection module in the defender's real business server injects the process deception hijacking module code (hookshell_so) into the process with the process ID shell_pid (i.e., the rebound shell process); (6) In the process deception hijacking module code (hookshell_so), the command passed by the attacker to the shell_pid process is intercepted and forwarded. The forwarding address is the bash forward proxy honeypot address, that is, honey_ip:honey_port; (7) The process deception hijacking module obtains a false response from the bash forward proxy honeypot (honey_ip:honey_port) and returns a false response to the attacker through the shell_pid process; (8) The bash forward proxy honeypot records the attacker’s malicious commands and other attack behaviors.

[0032] To facilitate a better understanding, the existing honeynet solution is further explained. In the traditional honeynet solution, firstly, honeypots and secret networks generally occupy idle resources in the network, such as idle IPs and idle ports, and cannot be deceiving and trapping inside the real business of the defender. Secondly, the existing deception technology mainly relies on the attacker to actively discover the secret network to attack the honeypot, lacks the ability to actively implement deception defense against the attack process, and is relatively passive in trapping the attack. In addition, the existing deception defense technology cannot interact with the Trojan backdoors, rebound shells and other attack resources that the attacker has created.

[0033] Based on the defects of the above-mentioned prior art solutions, the method proposed by the present invention has the following principle: Figure 2As shown in the figure. In response to the attacker's rebound shell attack behavior, from the perspective of deception attack, we integrate rebound shell detection, process injection, process deception hijacking, Bash forward proxy honeypot and other modules to build an attack deception technology that is unaware of the attacker, highly integrated with the business, and actively interacts with the attack process and attack resources, aiming to improve the success rate of deception defense technology trapping.

[0034] Bash, the full name of "Bourne-Again SHell", is a Unix shell developed by the GNU project and is the most commonly used command line interpreter in Linux systems. It was developed from the original shell of the famous programmer Steve Bourne, hence the name "Bourne-Again". Bash is not only widely used on Linux, but also adopted in other UNIX-like operating systems such as macOS. It is part of the GNU project and follows the GPL (GNU General Public License) open source agreement. The Unix shell is the main interface for the UNIX operating system to interact with the user. It is not only a command interpreter, but also a powerful programming environment that allows users to automate daily tasks by writing scripts.

[0035] In step (2), the rebound shell detection module monitors the host process and network session of the real business server of the defender to promptly detect the rebound shell process initiated by the attacker.

[0036] The rebound shell detection module monitors the newly started processes and subprocesses on the business server, and monitors the network sessions on the business server, discovers the attacker's behavior of launching a rebound shell process, and records the rebound shell process id, i.e., shell_pid. The specific rebound shell detection technology is a common technology in host security defense in the field of network security, and will not be further explained here.

[0037] In step (4), the virtual honeypot module starts the bash forward proxy honeypot and records the bash forward proxy honeypot IP (honey_ip) and port (honey_port). The bash forward proxy honeypot is used to receive the attacker's commands, give false responses, and record the attacker's command operations. The bash forward proxy honeypot refers to a honeypot that uses the listening port (honey_port) as a forward proxy port. The malicious commands received by the attacker on this port are executed in the honeypot, and the execution results (false responses) are returned to the initiator through the forward proxy port (honey_port). The common way to establish a bash forward proxy is to use the Ncat tool to execute the following command: In Linux system: nc -lvp 4444 -e / bin / bash; In Windows system: NC.exe -ldp 4444 -e C:\windows\system32\cmd.exe; In addition to performing the above operations, the bash forward proxy honeypot also needs to record the attacker's malicious commands received by the listening port (honey_port) and the command execution results.

[0038] In step (5), the process injection module located on the real business server injects the process deception hijacking module code (hookshell_so) into the process with the process id shell_pid; After obtaining the attacker's rebound shell process, i.e., the shell_pid process, the process injection technology (a conventional technology for injecting code into a process, which is common knowledge) is used to inject the process deception hijacking module code (hookshell_so) into the shell_pid process, and the running logic of the shell_pid process is modified without the attacker's awareness. Here is an explanation of the process injection technology, which is to inject a piece of code (such as so or dll) into another running process to modify the logic of the running process. Through process injection, the injected code can use the permissions and resources of the injected process to perform operations.

[0039] The process injection module used in the present invention implements the following code samples and code explanations: #include<stdio.h> #include<stdlib.h> #include<string.h> #include<unistd.h> #include<sys / user.h> #include<wait.h> #include "utils.h" #include "ptrace.h" / * * injectSharedLibrary() * * This code will be injected into the target process.

[0040] * This code is responsible for loading the shared library into the address space of the target process. First, it calls malloc() to allocate a buffer, * This buffer is used to save the name of the library file to be loaded. Then, it calls __libc_dlopen_mode(), which is the dlopen() implemented by libc. * to load the required shared library. Finally, it calls free() to release the buffer containing the library name. Each time control needs to be returned to the injected process, * It breaks by executing the "int $3" instruction.

[0041] * * / void injectSharedLibrary(long mallocaddr, long freeaddr, longdlopenaddr) { / / Here it is assumed that the target will have the following data when executing this code: / / / / rdi = the address of malloc() in the target process / / rsi = the address of free() in the target process / / rdx = the address of __libc_dlopen_mode() in the target process / / rcx = size of the shared library path to load / / Save the addresses of free() and __libc_dlopen_mode() on the stack for later use asm( / / rsi will contain the address of free(). It will be overwritten by the malloc() call, so save it on the stack for later use "push %rsi \n" / / The same is true for rdx, which will contain the address of _dlopen() "push %rdx" ); / / Call malloc() in the target process asm( / / Save the previous value of r9, as we will use it to call malloc() "push %r9 \n" / / Now move the address of malloc() to r9 "mov %rdi,%r9 \n" / / Choose the amount of memory to allocate using malloc() based on the size of the shared library path passed via rcx "mov %rcx,%rdi \n" / / Now call r9; malloc() "callq *%r9 \n" / / After returning from malloc(), pop the previous r9 value from the stack "pop %r9 \n" / / Break so we can see the return value of malloc() "int $3" ); / / Call __libc_dlopen_mode() to load the shared library asm( / / Pop the address of __libc_dlopen_mode() off the stack so we can call it "pop %rdx \n" / / As before, save the previous value of r9 onto the stack "push %r9 \n" / / Copy the address of __libc_dlopen_mode() to r9 "mov %rdx,%r9 \n" / / The first parameter of __libc_dlopen_mode(): filename = the buffer address returned by malloc() "mov %rax,%rdi \n" / / The second parameter of __libc_dlopen_mode(): flag = RTLD_LAZY "movabs $1,%rsi \n" / / Call __libc_dlopen_mode() "callq *%r9 \n" / / Restore the old r9 value "pop %r9 \n" / / Break so you can see the return value of __libc_dlopen_mode() "int $3" ); / / Call free() to release the previously allocated buffer.

[0042] / / / / NOTE: If there is a non-zero value in r9, free() seems to interpret it as an address to be freed, even though it should only take one argument.

[0043] / / Therefore, it must be called using a register that is not used in the x64 calling convention. rbx is chosen.

[0044] asm( / / At this point, rax should still contain the buffer we malloc()ed earlier. We're about to free it, so we move rax into rdi to make it the first argument to free().

[0045] "mov %rax,%rdi \n" / / Pop rsi so that the address of free() pushed onto the stack can be obtained.

[0046] "pop %rsi \n" / / Save the previous rbx value "push %rbx \n" / / Load the address of free() into rbx "mov %rsi,%rbx \n" / / Clear rsi to zero, because free() might think it contains something that should be freed "xor %rsi,%rsi \n" / / Break so that arguments can be checked before calling "int $3 \n" / / Call free() "callq *%rbx \n" / / Restore the previous rbx value "pop %rbx" ); / / The RET instruction at the end of this function has been overwritten with INT 3, so at this point the dropper will regain execution control of the target.

[0047] } / * * injectSharedLibrary_end() * * The only purpose of this function is to be continuation with injectSharedLibrary() so that its address can be used to more accurately calculate the length of injectSharedLibrary().

[0048] * * / void injectSharedLibrary_end() { } int main(int argc, char** argv) { if(argc<4) { usage(argv[0]); return 1; } char* command = argv[1]; char* commandArg = argv[2]; char* libname = argv[3]; char* libPath = realpath(libname, NULL); char* processName = NULL; pid_t target = 0; if(!libPath) { fprintf(stderr, "Cannot find file \"%s\"\n", libname); return 1; } if(!strcmp(command, "-n")) { processName = commandArg; target = findProcessByName(processName); if(target == -1) { fprintf(stderr, "There seems to be no process named \"%s\" running\n",processName); return 1; } printf("The pid of the target process\"%s\" is %d\n", processName, target); } else if(!strcmp(command, "-p")) { target = atoi(commandArg); printf("The pid of the target process is %d\n", target); } else { usage(argv[0]); return 1; } int libPathLength = strlen(libPath) + 1; int mypid = getpid(); long mylibcaddr = getlibcaddr(mypid); / / Find the address of the system call you want to use in the target process in the current process long mallocAddr = getFunctionAddress("malloc"); long freeAddr = getFunctionAddress("free"); long dlopenAddr = getFunctionAddress("__libc_dlopen_mode"); / / Use the base address of libc to calculate the offset of the system call you want to use long mallocOffset = mallocAddr - mylibcaddr; long freeOffset = freeAddr - mylibcaddr; long dlopenOffset = dlopenAddr - mylibcaddr; / / Get the target process's libc address and use it to find the system call address you want to use in the target process long targetLibcAddr = getlibcaddr(target); long targetMallocAddr = targetLibcAddr + mallocOffset; long targetFreeAddr = targetLibcAddr + freeOffset; long targetDlopenAddr = targetLibcAddr + dlopenOffset; struct user_regs_struct oldregs, regs; memset(&oldregs, 0, sizeof(struct user_regs_struct)); memset(®s, 0, sizeof(struct user_regs_struct)); ptrace_attach(target); ptrace_getregs(target,&oldregs); memcpy(®s,&oldregs, sizeof(struct user_regs_struct)); / / Find a suitable address to copy the code long addr = freespaceaddr(target) + sizeof(long); / / Now that we have an address to copy the code to, set the target's rip to this address. We have to advance 2 bytes because rip increments by the size of the current instruction, and the instruction at the beginning of a function is always 2 bytes long.

[0049] regs.rip = addr + 2; / / Pass the arguments to my function injectSharedLibrary() by loading them into the correct registers. Note that this absolutely only works on x64, as it relies on the x64 calling convention where arguments are passed via registers rdi, rsi, rdx, rcx, r8, and r9.

[0050] / / See the comments in injectSharedLibrary() for more details.

[0051] regs.rdi = targetMallocAddr; regs.rsi = targetFreeAddr; regs.rdx = targetDlopenAddr; regs.rcx = libPathLength; ptrace_setregs(target,®s); / / Calculate the size of injectSharedLibrary() so we know how big a buffer to allocate.

[0052] size_t injectSharedLibrary_size = (intptr_t)injectSharedLibrary_end- (intptr_t)injectSharedLibrary; / / Also find out where the RET instruction is at the end of injectSharedLibrary() so that we can overwrite it with INT 3 to reenter the target process. Note that on x64, both gcc and clang force function addresses to be word aligned, meaning functions are padded with NOPs. So even if we find the length of the function, it will most likely be padded with NOPs, so we need to actually search to find RET.

[0053] intptr_t injectSharedLibrary_ret = (intptr_t)findRet(injectSharedLibrary_end) - (intptr_t)injectSharedLibrary; / / Back up the data of the address to be modified.

[0054] char* backup = malloc(injectSharedLibrary_size * sizeof(char)); ptrace_read(target, addr, backup, injectSharedLibrary_size); / / Set up a buffer to hold the code to be injected into the target process.

[0055] char* newcode = malloc(injectSharedLibrary_size * sizeof(char)); memset(newcode, 0, injectSharedLibrary_size * sizeof(char)); / / Copy the code of injectSharedLibrary() to the buffer.

[0056] memcpy(newcode, injectSharedLibrary, injectSharedLibrary_size - 1); / / Overwrite RET instruction with INT 3.

[0057] newcode[injectSharedLibrary_ret] = INTEL_INT3_INSTRUCTION; / / Copy the code of injectSharedLibrary() to the target address in the target process address space.

[0058] ptrace_write(target, addr, newcode, injectSharedLibrary_size); / / Now that the new code is in place, have the target run the injected code.

[0059] ptrace_cont(target); / / At this point, the target should have run malloc(). Check its return value to see if it succeeded, and exit if not.

[0060] struct user_regs_struct malloc_regs; memset(&malloc_regs, 0, sizeof(struct user_regs_struct)); ptrace_getregs(target,&malloc_regs); unsigned long long targetBuf = malloc_regs.rax; if (targetBuf == 0) { fprintf(stderr, "malloc() failed to allocate memory\n"); restoreStateAndDetach(target, addr, backup, injectSharedLibrary_size, oldregs); free(backup); free(newcode); return 1; } / / If we get here, malloc probably succeeded, so we now need to copy the shared library path to be injected into the buffer that the target process just malloc'ed. This is needed so that it can be passed as an argument to __libc_dlopen_mode later.

[0061] / / Read the current value of rax, which contains the return value of malloc, and copy the name of the shared library to that address in the target process.

[0062] ptrace_write(target, targetBuf, libPath, libPathLength); / / Continue target execution again to call __libc_dlopen_mode.

[0063] ptrace_cont(target); / / Check the registers after calling dlopen.

[0064] struct user_regs_struct dlopen_regs; memset(&dlopen_regs, 0, sizeof(struct user_regs_struct)); ptrace_getregs(target,&dlopen_regs); unsigned long long libAddr = dlopen_regs.rax; / / If rax is 0 at this point, __libc_dlopen_mode failed and should exit cleanly.

[0065] if(libAddr == 0) { fprintf(stderr, "__libc_dlopen_mode() failed to load %s\n", libname); restoreStateAndDetach(target, addr, backup, injectSharedLibrary_size, oldregs); free(backup); free(newcode); return 1; } / / Now check / proc / pid / maps to see if the injection was successful.

[0066] if(checkloaded(target, libname)) { printf("\"%s\"Injection successful\n", libname); } else { fprintf(stderr, "Unable to inject \"%s\"\n", libname); } / / Free the buffer allocated in the target process. Whether this succeeds or not is unimportant, so don't check the return value.

[0067] ptrace_cont(target); / / At this point, if everything went according to plan, the shared library has been loaded in the target process, so we are done. Restore the old state and detach from the target.

[0068] restoreStateAndDetach(target, addr, backup, injectSharedLibrary_size, oldregs); free(backup); free(newcode); return 0; }.

[0069] In the above code, the process pid injected by process injection is externally input, which is the shell_pid process in the present invention.

[0070] In step (6), the process deception hijacking module code (hookshell_so) intercepts and forwards the malicious command passed by the attacker to the shell_pid process. The forwarding address is the bash forward proxy honeypot address, that is, honey_ip:honey_port The process deception hijacking module is a .so file. Its code (hookshell_so) is used to obtain the malicious commands passed by the attacker to the shell_pid process, change the execution flow of the shell_pid process after receiving the malicious commands, release the execution function of shell_pid for the malicious commands, forward the malicious commands to the bash forward proxy honeypot address, that is, honey_ip:honey_port, and accept the false response returned by the bash forward proxy honeypot, and return the false response to the shell_pid process, so that the attacker obtains the false response content.

[0071] The process deception hijacking module used in this patent, the implementation code sample and code explanation are as follows: #include<unistd.h> #include<sys / types.h> #include<sys / socket.h> #include<netinet / in.h> #include<arpa / inet.h> #include<string.h> #include<dlfcn.h> #include <iostream> #define SHELL_PID $shell_pid / / Process ID to be protected #define HONEY_IP $honey_ip / / Honeypot IP address #define HONEY_PORT $honey_port / / Honeypot port / / Original execution function pointer typedef int (*exec_func_t)(const char *path, char *const argv[]); exec_func_t original_exec_func = NULL; / / Rewritten execution function int exec(const char *path, char *const argv[]) { / / Get the current process ID pid_t current_pid = getpid(); / / If the current process ID is the same as the process ID to be protected if (current_pid == SHELL_PID) { / / Connect to the honeypot int sock = socket(AF_INET, SOCK_STREAM, 0); struct sockaddr_in addr; addr.sin_family = AF_INET; addr.sin_port = htons(HONEY_PORT); inet_pton(AF_INET, HONEY_IP,&addr.sin_addr); connect(sock, (struct sockaddr*)&addr, sizeof(addr)); / / Forward malicious commands to the honeypot write(sock, argv[0], strlen(argv[0])); / / Receive the false response returned by the honeypot char buffer

[1024] ; read(sock, buffer, sizeof(buffer)); / / Return a false response to the original process std::cout<<"Returning fake response: "< <buffer<<std::endl; close(sock); return 0; } else { / / Call the original execution function return original_exec_func(path, argv); } } __attribute__((constructor)) void initialize() { / / Get the original execution function pointer original_exec_func = (exec_func_t)dlsym(RTLD_NEXT, "execvp"); if (original_exec_func == NULL) { std::cerr<<"Error getting original exec function: "< <dlerror()<<std::endl; return; } / / Replace the exec function with the rewritten execution function original_exec_func = (exec_func_t)dlsym(RTLD_NEXT, "exec"); if (original_exec_func == NULL) { std::cerr<<"Error getting original exec function: "< <dlerror()<<std::endl; return; } original_exec_func = exec; }.

[0072] In the above code, the variable value of $shell_pid is the pid of the rebound shell process initiated by the attacker, the variable value of $honey_ip is the IP of the Bash forward proxy honeypot, and the variable value of $honey_port is the forward proxy port of the Bash forward proxy honeypot. Use the following command to build the above code into a so file, and then inject it into shell_pid through the process injection module: g++ -fPIC -shared -o libdefense.so defense.cpp -ldl.

[0073] When the attacker launches a rebound shell attack on the real business server of the defender, after generating the rebound shell process shell_pid, the shell_pid process is discovered through the rebound shell detection module, the process injection module is called, and the process deception hijacking module is injected into the shell_pid process. The process deception hijacking module changes the execution flow of the shell_pid process after receiving the malicious command, releases the execution function of the shell_pid for the malicious command, forwards the malicious command to the bash forward proxy honeypot address, i.e., honey_ip:honey_port, and accepts the false response returned by the bash forward proxy honeypot, returns the false response to the shell_pid process, and then the attacker obtains the false response content. At this time, the attacker interacts with the rebound shell process, i.e., the shell_pid process, and executes the attack process such as malicious commands. The malicious command issued by the actual attacker has been forwarded to the bash forward proxy honeypot for execution, and the malicious command response received by the attacker is a false response given by the bash forward proxy honeypot, which the attacker cannot perceive. Through the method mentioned in this patent, a kind of attack deception technology that realizes deception inside the business server and actively interacts with the attack process and attack resources is established, which greatly improves the ability of active trapping of the existing deception defense technology.

[0074] Example 3.

[0075] The present invention provides a rebound shell defense device, comprising: The process detection module is configured to: detect the rebound shell process initiated by the attacker by monitoring the host process and network session of the real business server of the defender; The honeypot startup module is configured to: send a startup command to the bash forward proxy honeypot connected to the real business server of the defender; The code injection module is configured to: obtain the process deception hijacking module code, and inject the process deception hijacking module code into the rebound shell process; The false response generation and forwarding module is configured to: intercept the command issued by the attacker to the rebound shell process through the process deception hijacking module code and send it to the bash forward proxy honeypot, then receive the false response generated by the bash forward proxy honeypot according to the received command, and send the false response to the rebound shell process; The false response sending module is configured to send the false response to the attacker through the rebound shell process.

[0076] Example 4.

[0077] The present invention provides a computer-readable storage medium on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of the rebound shell defense method provided in Example 1 are implemented: By monitoring the host process and network session of the defender's real business server, the rebound shell process initiated by the attacker is detected; Send a startup command to the bash forward proxy honeypot connected to the defender's real business server; Obtaining a process deception hijacking module code, and injecting the process deception hijacking module code into the rebound shell process; Through the process deception hijacking module code, the command issued by the attacker to the rebound shell process is intercepted and sent to the bash forward proxy honeypot, and then the false response generated by the bash forward proxy honeypot according to the received command is received, and the false response is sent to the rebound shell process; The false response is sent to the attacker through the rebound shell process.

[0078] Example 5.

[0079] like Figure 3 As shown, the present invention provides a rebound shell defense system, including a defense party and a bash forward proxy honeypot; The defender performs the steps of the rebound shell defense method provided in Example 1; A forward proxy port is set in the bash forward proxy honeypot. The bash forward proxy honeypot performs the following operations: it receives commands issued by the attacker for the rebound shell process from the process deception hijacking module code in the defender through the forward proxy port, executes the command in the bash forward proxy honeypot, obtains a false response, and sends the false response to the rebound shell process in the defender.

[0080] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0081] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0082] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0083] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0084] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.< / iostream>

Claims

1. A rebound shell defense method, characterized in that: include: By monitoring the host process and network session of the defender's real business server, the rebound shell process initiated by the attacker is detected; Send a startup command to the bash forward proxy honeypot connected to the defender's real business server; Obtaining a process deception hijacking module code, and injecting the process deception hijacking module code into the rebound shell process; Through the process deception hijacking module code, the command issued by the attacker to the rebound shell process is intercepted and sent to the bash forward proxy honeypot, and then the false response generated by the bash forward proxy honeypot according to the received command is received, and the false response is sent to the rebound shell process; The false response is sent to the attacker through the rebound shell process.

2. The rebound shell defense method according to claim 1, characterized in that: The bash forward proxy honeypot is provided with a forward proxy port, the command is sent to the forward proxy port, and the received false response is also sent from the forward proxy port.

3. The rebound shell defense method according to claim 1, characterized in that: The process deception hijacking module code is injected into the rebound shell process through the process injection technology.

4. The rebound shell defense method according to claim 1, characterized in that: After the process deception hijacking module code is injected into the rebound shell process, it also includes: constructing a process deception hijacking module according to the process deception hijacking module code, and the process deception hijacking module is a .so file.

5. The rebound shell defense method according to claim 4, characterized in that: The process deception hijacking module is constructed according to the process deception hijacking module code, and is implemented by the following command: g++ -fPIC -shared -olibdefense.so defense.cpp -ldl.

6. The rebound shell defense method according to claim 1, characterized in that: The method intercepts the command sent by the attacker to the rebound shell process and sends it to the bash forward proxy honeypot, including: the process deception hijacking module code changes the execution flow of the rebound shell process after receiving the command, releases the execution function of the rebound shell process for the command, and forwards the command to the bash forward proxy honeypot.

7. A rebound shell defense device, characterized in that: include: The process detection module is configured to: detect the rebound shell process initiated by the attacker by monitoring the host process and network session of the real business server of the defender; The honeypot startup module is configured to: send a startup command to the bash forward proxy honeypot connected to the real business server of the defender; The code injection module is configured to: obtain the process deception hijacking module code, and inject the process deception hijacking module code into the rebound shell process; The false response generation and forwarding module is configured to: intercept the command issued by the attacker to the rebound shell process through the process deception hijacking module code and send it to the bash forward proxy honeypot, then receive the false response generated by the bash forward proxy honeypot according to the received command, and send the false response to the rebound shell process; The false response sending module is configured to send the false response to the attacker through the rebound shell process.

8. The rebound shell defense device according to claim 7, characterized in that: The false response generation and forwarding module intercepts the command issued by the attacker to the rebound shell process and sends it to the bash forward proxy honeypot, including: the process deception hijacking module code changes the execution flow of the rebound shell process after receiving the command, releases the execution function of the rebound shell process for the command, and forwards the command to the bash forward proxy honeypot.

9. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instruction is executed by a processor, the steps of the rebound shell defense method described in any one of claims 1 to 6 are implemented.

10. A rebound shell defense system, characterized in that: Includes defender and bash forward proxy honeypot; The defender is used to perform the steps of the rebound shell defense method described in any one of claims 1 to 6; A forward proxy port is provided in the bash forward proxy honeypot, and the bash forward proxy honeypot performs the following operations: receiving a command issued by an attacker to the rebound shell process from the process deception hijacking module code in the defender through the forward proxy port, executing the command in the bash forward proxy honeypot, obtaining a false response, and sending the false response to the rebound shell process in the defender.

Images