【Proventia】MSRPC_PlugAndPlay_DeviceSlashBo

■シグネチャの説明

http://www.iss.net/security_center/static/22481.php

■References
Microsoft Security Bulletin MS05-047
Vulnerability in Plug and Play Could Allow Remote Code Execution and Local Elevation of Privilege (905749)
http://www.microsoft.com/technet/security/bulletin/ms05-047.mspx

CVE
CVE-2005-2120
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2120

■IDS検知

パケット

No. Time Source Destination Protocol Info
5236 2005-12-24 06:58:04.253249 192.168.221.110 192.168.221.180 DCERPC Request: call_id: 1[Short Frame]

Frame 5236 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: 00:10:5a:64:fa:71, Dst: 00:d0:c9:96:61:5c
Internet Protocol, Src Addr: 192.168.221.110 (192.168.221.110), Dst Addr: 192.168.221.180 (192.168.221.180)
Transmission Control Protocol, Src Port: 1031 (1031), Dst Port: microsoft-ds (445), Seq: 586, Ack: 448, Len: 1448
NetBIOS Session Service
SMB (Server Message Block Protocol)
SMB Pipe Protocol
[Short Frame: DCERPC]

0000 00 d0 c9 96 61 5c 00 10 5a 64 fa 71 08 00 45 00 ....a\..Zd.q..E.
0010 05 dc 05 ff 40 00 40 06 f2 a8 c0 a8 dd 6e c0 a8 ....@.@......n ..
0020 dd b4 04 07 01 bd 65 40 19 9d f7 51 e3 3e 80 18 ......e@...Q .>..
0030 7d 78 a9 9c 00 00 01 01 08 0a 00 2c c0 53 00 00 }x.........,.S..
0040 1b b2 00 00 08 84 ff 53 4d 42 25 00 00 00 00 18 .......SMB%.....
0050 07 c8 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ................
0060 ff fe 00 08 80 01 10 00 00 30 08 00 00 00 10 00 .........0......
0070 00 00 00 00 00 00 00 00 00 00 00 54 00 30 08 54 ...........T.0.T
0080 00 02 00 26 00 00 40 41 08 a2 5c 00 50 00 49 00 ...&..@A..\.P.I .
0090 50 00 45 00 5c 00 00 00 00 00 05 00 00 03 10 00 P.E.\...........
00a0 00 00 30 08 00 00 01 00 00 00 18 08 00 00 00 00 ..0.............
00b0 0a 00 44 f7 12 00 00 04 00 00 00 00 00 00 00 04 ..D.............
00c0 00 00 48 00 54 00 52 00 45 00 45 00 5c 00 52 00 ..H.T.R.E.E.\.R.
00d0 4f 00 4f 00 54 00 5c 00 5c 00 5c 00 5c 00 5c 00 O.O.T.\.\.\.\.\.
00e0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
00f0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0100 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0110 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0120 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0130 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0140 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0150 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0160 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0170 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0180 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0190 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
01a0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
01b0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
01c0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
01d0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
01e0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
01f0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0200 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0210 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0220 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0230 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0240 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0250 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0260 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0270 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0280 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0290 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
02a0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
02b0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
02c0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
02d0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
02e0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
02f0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0300 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0310 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0320 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0330 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0340 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0350 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0360 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0370 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0380 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0390 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
03a0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
03b0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
03c0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
03d0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
03e0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
03f0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0400 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0410 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0420 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0430 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0440 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0450 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0460 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0470 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0480 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0490 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
04a0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
04b0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
04c0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
04d0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
04e0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
04f0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0500 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0510 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0520 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0530 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0540 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0550 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0560 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0570 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0580 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0590 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
05a0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
05b0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
05c0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
05d0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
05e0 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.

ハニーネットプロジェクト, 園田 道夫, ドキュメントシステム

ハニーネットプロジェクト―汝の敵を知れ:セキュリティ脅威者の分析