topic Re: Trouble with Custom MSRPC Based AppID in Automation/API Discussions

Trouble with Custom MSRPC Based AppID

mfs — Fri, 31 Oct 2014 21:20:44 GMT

I am trying to create a number of custom MSRPC based App's using the msrpc-req-bind-data contact. I have set msrpc as the parent app, dynamic TCP and UDP for the ports, and the signatures are set to the session scope. I pulled the hex for the BIND request interfaces directly from Wireshark running on the AD server.

See below screenshot for the signature (this is the interface for DFS):

Re: Trouble with Custom MSRPC Based AppID

mmmccorkle — Sat, 01 Nov 2014 02:33:44 GMT

Can you please verify the issue?

Thanks

Re: Trouble with Custom MSRPC Based AppID

mfs — Mon, 03 Nov 2014 13:30:30 GMT

The issue is that the custom signature(s) do not fire when I send specific MSRPC bind requests through the firewall. I only see msrpc identified by the firewall, but clearly see the specific BIND request in a PCAP on the server. In the case of the signature in the OP, I am looking for the DFS BIND request.

Thanks!