RE: Attack(s) caught by Okena

From: Marcus Gavel (mgavel_at_okena.com)
Date: 06/11/03

  • Next message: operator: "bad IP traffic" 
    To: 'Dimitri Limanovski' <dlimanov@sct.com>
Date: Wed, 11 Jun 2003 10:07:57 -0400

    The third event is not an attack.

    You will find that the mailslot message occurs when the IIS server is
    restarted.
    The default IIS policy is restrictive and denies access to resource we did
    not
    deem essential to running a basic IIS server. If you attempt to use
    FrontPage
    functions with the default policy, you'll likely run into the same
    restrictions
    as FrontPage was not deems essential.

    After discussions in the engineering group, we cannot recall any reason to
    specifically deny this resource. It was caught under the best practice of
    deny
    all and open only what is needed. Feel free to contact support, they can
    walk
    you through the policy change that has been proposed for the 4.0 release.

    Marcus Gavel
    Cisco Systems - Cisco Security Agent
      fka Okena - StormWatch

    -----Original Message-----
    From: Dimitri Limanovski [mailto:dlimanov@sct.com]
    Sent: Tuesday, June 10, 2003 10:53 AM
    To: incidents@securityfocus.com
    Cc: Joe Mitchell
    Subject: Attack(s) caught by Okena

    Hello everyone..
    In my evaluation of Okena (now Cisco) HIPS, I built a test system with
    "virgin" Win2K Server install that included full install of IIS.
    Machine was not patched (not even an SP1) and placed out in the wild
    without any kind of protection other than Okena's default Server,
    Firewall and IIS policy modules.
    As of two month of repetitive attacks, it has yet to be compromised.
    99% of the attacks are standard port scans and NetBIOS enumeration
    attempts along with numerous attempts to overflow buffer with various
    IIS vulnerabilities.
    Lately, I have seen the following entries in the Event Viewer that I
    can not interpret. Based on the time stamp, this looks like one attack
    but I can't figure out exactly which one. First two events look like
    standard buffer overflow against inetinfo.exe. It's interesting to
    note that while all of the usual dafault.ida?XXXXX and WebDAV attempts
    are recorded in Web logs, this one isn't showing up anywhere aside
    from Event Viewer. The third event looked to me like some kind of
    variant of SMBNuke/SMBDie attack, based on
    '\\TEST**\MAILSLOT\NET\NETLOGON' signature, but it's being called by
    inetinfo.exe which I haven't seen before.
    Has anyone seen anything like this before? Any input is much
    appreciated!

    Dimitri

    <start event 1>
    Event Type: Warning
    Event Source: StormWatchAgent
    Event Category: Kernel Rule
    Event ID: 256
    Date: 6/10/2003
    Time: 1:53:30 AM
    User: N/A
    Computer: IISTEST
    Description:
    The application 'C:\WINNT\system32\inetsrv\inetinfo.exe' (as user
    IISTEST\IUSR_IISTEST) tried to call the function LoadLibraryA from a
    buffer (the return address was 0x45b7b1). The code at this address is
    '00005753 325f3332 2e444c4c 00ff55f4 8945bce8 07000000 736f636b
    657400ff' This either happens when a program uses self-modifying code
    or when a program has been subverted by a buffer overflow attack. The
    user chose 'Terminate (no user interaction allowed)'.
    </end event 1>

    <start event 2>
    Event Type: Error
    Event Source: StormWatchAgent
    Event Category: Kernel Rule
    Event ID: 256
    Date: 6/10/2003
    Time: 1:53:30 AM
    User: N/A
    Computer: IISTEST
    Description:
    The application 'C:\WINNT\system32\inetsrv\inetinfo.exe' (as user
    IISTEST\IUSR_IISTEST) tried to call the function LoadLibraryA from a
    buffer (the return address was 0x45b7b1). The code at this address is
    '00005753 325f3332 2e444c4c 00ff55f4 8945bce8 07000000 736f636b
    657400ff' This either happens when a program uses self-modifying code
    or when a program has been subverted by a buffer overflow attack. The
    program was terminated.
    </end event 2>

    <start event 3>
    Event Type: Error
    Event Source: StormWatchAgent
    Event Category: Kernel Rule
    Event ID: 256
    Date: 6/10/2003
    Time: 1:53:32 AM
    User: N/A
    Computer: IISTEST
    Description:
    The process 'C:\WINNT\system32\inetsrv\inetinfo.exe' (as user NT
    AUTHORITY\SYSTEM) tried to open/write the file
    '\\TEST**\MAILSLOT\NET\NETLOGON' and was denied.
    </end event 3>

    ----------------------------------------------------------------------------
    ----------------------------------------------------------------------------

    ----------------------------------------------------------------------------
    ----------------------------------------------------------------------------

  • Next message: operator: "bad IP traffic"

    Relevant Pages

    • Re: I was hacked
      ... Only me noticing that the requests seemed to come from a LAN? ... To secure IIS somewhat, remove all the virtual directories even if they are ... > Do you have some kind of application level firewall on this machine? ... a series of attempts to attack IIS that the IIS log claimed were coming ...
      (microsoft.public.inetserver.iis.security)
    • Re: I was hacked
      ... I suspect the firewall looks like a typical address that a NAT ... use Apache to proxypass all requests to IIS and that way I can have some ... script to check if the url is valid and if so execute the script... ... :>: a series of attempts to attack IIS that the IIS log claimed were ...
      (microsoft.public.inetserver.iis.security)
    • RE: new IIS worm? (rcp lsass.exe)
      ... Subject: new IIS worm? ... > We have seen this attack from 4 different sources since Sept. 16, ... > This list is provided by the SecurityFocus ARIS analyzer service. ... > and tracking system please see: http://aris.securityfocus.com ...
      (Incidents)
    • Re: [Full-Disclosure] Microsoft and Security
      ... anybody got a packet dump of the attack yet so we can regex out this ... vuln against IIS? ... It is quite terrible that this IE vuln has gone on now for two weeks - ... > A vulnerability: ...
      (Full-Disclosure)
    • New Nimda scanning pattern ?
      ... Last night we saw an single machine ... attack every IIS server on campus visible from the Internet. ...
      (Incidents)
    • Quantcast