■シグネチャの説明
http://xforce.iss.net/xforce/xfdb/22467
■Proventiaでの検知(IDS)
■MS05-051スキャンツール
http://www.foundstone.com/resources/freetooldownload.htm?file=MS05051Scan.zip
■パケット
No. Time Source Destination Protocol Info
203 2005-12-12 09:18:55.591631 211.91.125.137 192.168.37.180 TCP 6000 > 1025 [SYN] Seq=0 Ack=0 Win=16384 Len=0 MSS=1414
Frame 203 (58 bytes on wire, 58 bytes captured)
Ethernet II, Src: 00:d0:c9:96:61:5d, Dst: 00:0c:29:5f:e0:5b
Internet Protocol, Src Addr: 211.91.125.137 (211.91.125.137), Dst Addr: 192.168.37.180 (192.168.37.180)
Transmission Control Protocol, Src Port: 6000 (6000), Dst Port: 1025 (1025), Seq: 0, Ack: 0, Len: 0
No. Time Source Destination Protocol Info
204 2005-12-12 09:18:55.592299 192.168.37.180 211.91.125.137 TCP 1025 > 6000 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460
Frame 204 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:0c:29:5f:e0:5b, Dst: 00:d0:c9:96:61:5d
Internet Protocol, Src Addr: 192.168.37.180 (192.168.37.180), Dst Addr: 211.91.125.137 (211.91.125.137)
Transmission Control Protocol, Src Port: 1025 (1025), Dst Port: 6000 (6000), Seq: 0, Ack: 1, Len: 0
No. Time Source Destination Protocol Info
205 2005-12-12 09:18:58.822890 192.168.37.180 211.91.125.137 TCP 1025 > 6000 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460
Frame 205 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:0c:29:5f:e0:5b, Dst: 00:d0:c9:96:61:5d
Internet Protocol, Src Addr: 192.168.37.180 (192.168.37.180), Dst Addr: 211.91.125.137 (211.91.125.137)
Transmission Control Protocol, Src Port: 1025 (1025), Dst Port: 6000 (6000), Seq: 0, Ack: 1, Len: 0
No. Time Source Destination Protocol Info
211 2005-12-12 09:19:05.401692 192.168.37.180 211.91.125.137 TCP 1025 > 6000 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460
Frame 211 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:0c:29:5f:e0:5b, Dst: 00:d0:c9:96:61:5d
Internet Protocol, Src Addr: 192.168.37.180 (192.168.37.180), Dst Addr: 211.91.125.137 (211.91.125.137)
Transmission Control Protocol, Src Port: 1025 (1025), Dst Port: 6000 (6000), Seq: 0, Ack: 1, Len: 0
No. Time Source Destination Protocol Info
212 2005-12-12 09:19:34.724297 211.91.125.137 192.168.37.180 TCP 6000 > 1025 [RST] Seq=1 Ack=1077123615 Win=0 Len=0
Frame 212 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:d0:c9:96:61:5d, Dst: 00:0c:29:5f:e0:5b
Internet Protocol, Src Addr: 211.91.125.137 (211.91.125.137), Dst Addr: 192.168.37.180 (192.168.37.180)
Transmission Control Protocol, Src Port: 6000 (6000), Dst Port: 1025 (1025), Seq: 1, Ack: 1077123615, Len: 0
No. Time Source Destination Protocol Info
220 2005-12-12 09:20:37.130134 211.91.125.137 192.168.37.180 TCP 2193 > 1025 [SYN] Seq=0 Ack=0 Win=16384 Len=0 MSS=1414
Frame 220 (62 bytes on wire, 62 bytes captured)
Ethernet II, Src: 00:d0:c9:96:61:5d, Dst: 00:0c:29:5f:e0:5b
Internet Protocol, Src Addr: 211.91.125.137 (211.91.125.137), Dst Addr: 192.168.37.180 (192.168.37.180)
Transmission Control Protocol, Src Port: 2193 (2193), Dst Port: 1025 (1025), Seq: 0, Ack: 0, Len: 0
No. Time Source Destination Protocol Info
221 2005-12-12 09:20:37.130972 192.168.37.180 211.91.125.137 TCP 1025 > 2193 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460
Frame 221 (62 bytes on wire, 62 bytes captured)
Ethernet II, Src: 00:0c:29:5f:e0:5b, Dst: 00:d0:c9:96:61:5d
Internet Protocol, Src Addr: 192.168.37.180 (192.168.37.180), Dst Addr: 211.91.125.137 (211.91.125.137)
Transmission Control Protocol, Src Port: 1025 (1025), Dst Port: 2193 (2193), Seq: 0, Ack: 1, Len: 0
No. Time Source Destination Protocol Info
222 2005-12-12 09:20:37.380023 211.91.125.137 192.168.37.180 TCP 2193 > 1025 [ACK] Seq=1 Ack=1 Win=16968 Len=0
Frame 222 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:d0:c9:96:61:5d, Dst: 00:0c:29:5f:e0:5b
Internet Protocol, Src Addr: 211.91.125.137 (211.91.125.137), Dst Addr: 192.168.37.180 (192.168.37.180)
Transmission Control Protocol, Src Port: 2193 (2193), Dst Port: 1025 (1025), Seq: 1, Ack: 1, Len: 0
No. Time Source Destination Protocol Info
223 2005-12-12 09:20:37.450308 211.91.125.137 192.168.37.180 DCERPC Bind: call_id: 1 UUID: 906b0ce0-c70b-1067-b317-00dd010662da ver 1.0
Frame 223 (126 bytes on wire, 126 bytes captured)
Ethernet II, Src: 00:d0:c9:96:61:5d, Dst: 00:0c:29:5f:e0:5b
Internet Protocol, Src Addr: 211.91.125.137 (211.91.125.137), Dst Addr: 192.168.37.180 (192.168.37.180)
Transmission Control Protocol, Src Port: 2193 (2193), Dst Port: 1025 (1025), Seq: 1, Ack: 1, Len: 72
DCE RPC
No. Time Source Destination Protocol Info
224 2005-12-12 09:20:37.452475 192.168.37.180 211.91.125.137 DCERPC Bind_ack: call_id: 1 accept max_xmit: 5840 max_recv: 5840
Frame 224 (114 bytes on wire, 114 bytes captured)
Ethernet II, Src: 00:0c:29:5f:e0:5b, Dst: 00:d0:c9:96:61:5d
Internet Protocol, Src Addr: 192.168.37.180 (192.168.37.180), Dst Addr: 211.91.125.137 (211.91.125.137)
Transmission Control Protocol, Src Port: 1025 (1025), Dst Port: 2193 (2193), Seq: 1, Ack: 73, Len: 60
DCE RPC
No. Time Source Destination Protocol Info
225 2005-12-12 09:20:37.706247 211.91.125.137 192.168.37.180 DCERPC Request: call_id: 1[Unreassembled Packet]
Frame 225 (1078 bytes on wire, 1078 bytes captured)
Ethernet II, Src: 00:d0:c9:96:61:5d, Dst: 00:0c:29:5f:e0:5b
Internet Protocol, Src Addr: 211.91.125.137 (211.91.125.137), Dst Addr: 192.168.37.180 (192.168.37.180)
Transmission Control Protocol, Src Port: 2193 (2193), Dst Port: 1025 (1025), Seq: 73, Ack: 61, Len: 1024
[Unreassembled Packet: DCERPC]
Data (1024 bytes)
0000 05 00 00 83 10 00 00 00 2c 05 00 00 01 00 00 00 ........,.......
0010 04 05 00 00 00 00 07 00 e0 0c 6b 90 0b c7 67 10 ..........k...g.
0020 b3 17 00 dd 01 06 62 da 00 00 00 00 00 00 00 00 ......b.........
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 00 00 00 00 06 00 00 00 00 00 00 00 06 00 00 00 ................
0050 31 00 31 00 31 00 31 00 31 00 00 00 07 00 00 00 1.1.1.1.1.......
0060 00 00 00 00 07 00 00 00 31 00 31 00 31 00 31 00 ........1.1.1.1.
0070 31 00 31 00 00 00 00 00 58 02 00 00 00 00 00 00 1.1.....X.......
0080 2b 02 00 00 cc cc cc cc cc 00 cc 00 cc 00 cc 00 +...............
0090 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
00a0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
00b0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
00c0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
00d0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
00e0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
00f0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0100 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0110 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0120 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0130 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0140 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0150 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0160 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0170 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0180 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0190 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
01a0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
01b0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
01c0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
01d0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
01e0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
01f0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0200 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0210 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0220 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0230 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0240 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0250 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0260 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0270 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0280 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0290 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
02a0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
02b0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
02c0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
02d0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
02e0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
02f0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0300 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0310 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0320 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0330 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0340 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0350 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0360 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0370 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0380 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
0390 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
03a0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
03b0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
03c0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
03d0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
03e0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................
03f0 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 cc 00 ................