The goal of Shutter is to manage windows network stack communication via Windows Filtering Platform. Management can include blocking or permiting traffic based on IP or an executable that initiates or receives the traffic.
This is useful to blackhole event logging, defensive agent communication, or explicitly permit specific executables to communicate if they have been previously restricted by policy.
Shutter installs rules in a memory running session without touching the windows firewall itself or invocation of netsh command, thereby minimizing detection during long haul RT operations.
As a generic mechanism for managing network traffic it can help RTOs in:
- punching through firewalls without shutting them down
- not creating persistent rules
- evading reporting on
netshinvocation - blackholing EDRs and activity supervising agents.
- studying existing security providers, active filters and network endpoints involved in network communication
For now, IPv4 support is implemented, with or without applciation paths (see examples)
![Architecture](Docs/images/ShutterArch.png ="500x400")
- It needs to run elevated (due to WFP).
- Opsec - TBD
C:\Temp\Shutter> C:\Temp\Shutter\x64\Debug\Appblock.exe --list --help
Block by condition
Usage:
AppBlock [OPTION...] [--list | --add | --remove]
general options:
-h, --help Print usage
-v, --verbose Verbose output
-d, --debug Enable debugging
action options:
--list list
--add add
--remove remove
qualifier options:
--filter [=arg(=)] list:filter GUID | add:filter file path
--layer [=arg(=)] layer
--sublayer [=arg(=)] sublayer
--session [=arg(=)] session
--provider [=arg(=)] provider
--context [=arg(=)] context
--event event
result options:
--output [=arg(=out.json)]
output
- Hunt artifacts
- Assess defenses
- Identified blocking policies
Extensive docs - TBD
C:\Appblock.exe --add --filter=add-filters-defender-crowdstrike.json
Installing Filter: Defense Sec Updates Filter
Key: A2F1A73B-D762-4A3E-B1EE-60BE052E754C
In Layer: C38D57D1-05A7-4C33-904F-7FBCEEE60E82(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Windows Defender\NisSrv.exe
C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe
C:\Program Files\Windows Defender\MpCmdRun.exe
Installing Filter: WinDefender Filter
Key: A1F1A73B-E762-4A3E-B1EE-60BE052E754C
In Layer: C38D57D1-05A7-4C33-904F-7FBCEEE60E82(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe
C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe
C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe
C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe
C:\Program Files\Windows Defender Advanced Threat Protection\SenseSC.exe
Installing Filter: WinDefender AMSI Filter
Key: B1F1A73B-E762-4A3E-B1EE-60BE052E754D
In Layer: C38D57D1-05A7-4C33-904F-7FBCEEE60E82(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
C:\Program Files\CrowdStrike\CSCOMUtils.exe
C:\Program Files\CrowdStrike\CSDeviceControlSupportTool.exe
C:\Program Files\CrowdStrike\CSFalconContainer.exe
C:\Program Files\CrowdStrike\CSFalconController.exe
C:\Program Files\CrowdStrike\CSFalconService.exe
{
"Meta": {
"SubLayerName": "Shutter SL",
"SubLayerWeight": 65535
},
"Filters": [
{
"FilterAction": "FWP_ACTION_BLOCK",
"FilterType": "APP",
"FilterConditions": [
// Defender definitions updates
{ "DataValue": "23.53.112.109", "MatchType": "EQUAL", "DataType": "IPADDR" },
// Rapid7 updates
{ "DataValue": "52.203.25.223", "MatchType": "EQUAL", "DataType": "IPADDR" },
{ "DataValue": "54.144.111.231", "MatchType": "EQUAL", "DataType": "IPADDR" },
{ "DataValue": "34.226.68.35", "MatchType": "EQUAL", "DataType": "IPADDR" },
// Defender SmartScreen submission wdcp.microsoft.com and wdcpalt.microsoft.com
{ "DataValue": "40.76.203.101", "MatchType": "EQUAL", "DataType": "IPADDR" },
{ "DataValue": "40.78.1.30", "MatchType": "EQUAL", "DataType": "IPADDR" },
{ "DataValue": "13.82.144.201", "MatchType": "EQUAL", "DataType": "IPADDR" },
{ "DataValue": "23.101.202.202", "MatchType": "EQUAL", "DataType": "IPADDR" },
// smartscreen.microsoft.com martscreen-prod.microsoft.com and checkappexec.microsoft.com
{ "DataValue": "157.55.163.108", "MatchType": "EQUAL", "DataType": "IPADDR" },
{ "DataValue": "13.68.247.210", "MatchType": "EQUAL", "DataType": "IPADDR" },
{ "DataValue": "104.214.58.194", "MatchType": "EQUAL", "DataType": "IPADDR" },
{ "DataValue": "104.42.196.205", "MatchType": "EQUAL", "DataType": "IPADDR" },
{ "DataValue": "104.42.54.233", "MatchType": "EQUAL", "DataType": "IPADDR" },
{ "DataValue": "70.37.97.229", "MatchType": "EQUAL", "DataType": "IPADDR" },
// MSFT NCSI
{ "DataValue": "13.107.4.52", "MatchType": "EQUAL", "DataType": "IPADDR" }
],
"FilterKey": "A2F1A73B-D762-4A3E-B1EE-60BE052E754C",
"FilterName": "Defense Sec Updates Filter",
"FilterDesc": "Defense Sec Updates - block outgoing",
"FilterLayerName": "FWPM_LAYER_ALE_AUTH_CONNECT_V4",
"FilterLayerWeight": 15
},
{
"FilterAction": "FWP_ACTION_BLOCK",
"FilterType": "APP",
"FilterConditions": [
{
"DataValue": "C:\\Program Files\\Windows Defender\\MsMpEng.exe",
"MatchType": "EQUAL",
"DataType": "PATH"
},
{
"DataValue": "C:\\Program Files\\Windows Defender\\NisSrv.exe",
"MatchType": "EQUAL",
"DataType": "PATH"
},
{
"DataValue": "C:\\Program Files\\Windows Defender\\ConfigSecurityPolicy.exe",
"MatchType": "EQUAL",
"DataType": "PATH"
},
{
"DataValue": "C:\\Program Files\\Windows Defender\\MpCmdRun.exe",
"MatchType": "EQUAL",
"DataType": "PATH"
}
],
"FilterKey": "A1F1A73B-E762-4A3E-B1EE-60BE052E754C",
"FilterName": "WinDefender Filter",
"FilterDesc": "WinDefender Filter - block outgoing ipv4",
"FilterLayerName": "FWPM_LAYER_ALE_AUTH_CONNECT_V4",
"FilterLayerWeight": 15
}
]
}
tools\js\index.html
git clone
cd Shutter
msbuild libwfp\libwfp\libwfp.sln
msbuild Shutter.sln
mkdir libwfp
git submodule add https://github.com/mullvad/libwfp libwfp/libwfp
git submodule add https://github.com/mullvad/windows-libraries libwfp/windows-libraries
git submodule add https://github.com/nlohmann/json
git submodule add https://github.com/jarro2783/cxxopts
- Shuout out to @jamal0x42 for the cool name and the idea ;)