Thread by @ItsReallyNick

🚨 New blog with @_bromiley on CVE-2019-19781 - "I Promise It'll Be 200 OK", covering:
• ASCII encoding trick evading most (all?) public rules /.%2e/%76pns/ 👀
• @snort 🐷 #detection tricks (negative distance, exploitation flowbits)
👉🔗 fireeye.com/blog/products-…
• #DFIR tips ⤵️

@_bromiley @snort @mpgn_x64 @TrustedSec @4real_br4nd4n @BakedSec @sans_isc @FireEye @Mandiant Blog contains a sampling of CVE-2019-19781 post-compromise activity: fireeye.com/blog/products-…

Quick & dirty #DFIR searches (use zgrep) in /var/log/
httpaccess.* : 'GET.*\.xml HTTP/1\.1\" 200' [use -B 1]
httpaccess.* : '/vpn/\.\./'
bash.* : 'nobody'

@_bromiley @snort @mpgn_x64 @TrustedSec @4real_br4nd4n @BakedSec @sans_isc @FireEye @Mandiant Gr33tz to all the cool people who have published helpful research that we linked to in the blog: @craigtweets & @TripwireInc, @HackingDave & @TrustedSec, @sans_isc, @x1sec, and sorta @mpgn_x64 😅

As well as teammates @a_tweeter_user, @BakedSec, @4real_br4nd4n, and @nluedtke1 🙇🏽‍♂️

@_bromiley @snort @mpgn_x64 @TrustedSec @4real_br4nd4n @BakedSec @sans_isc @FireEye @Mandiant @craigtweets @TripwireInc @HackingDave @x1sec @a_tweeter_user @nluedtke1 Making pull requests on #UNC1194 tools feels spicier than it really is: github.com/trustedsec/cve… 🌶️
The proposed for any scanner (cc @x1sec) is a purposeful evasion - taking observed attacker tricks a bit further to think ahead. Also for a scanner you can see if IPS is dropping it

@_bromiley @snort @mpgn_x64 @TrustedSec @4real_br4nd4n @BakedSec @sans_isc @FireEye @Mandiant @craigtweets @TripwireInc @HackingDave @x1sec @a_tweeter_user @nluedtke1 Here are the CVE-2019-19781 #PCAP files: github.com/itsreallynick/… 🔌🦈
• GET request for checking .conf file for a 200 OK response
• POST request exploiting the vulnerability using a publicly-available tool

We'll get the blog links updated!
Would love to see some creative rules

Quick note: perfected scan logic now in our open source tool https://t.co/BFeQ8xqHiy