LOGS: GIAC CIA Version 3.5 Practical Detect Frank Birkmair

"Frank Birkmair" <[email protected]>
Newsgroups gmane.comp.security.intrusions
Message-ID <[email protected]> 
Hello All,

Attached is my first network detect required for the
SANS GCIA certification assignment.
Any comments would be appreciated.   

Regards,
Frank


Network Detect 1: OVERSIZE REQUEST-URI DIRECTORY
________________________________________________


[**] [119:15:1] (http_inspect) OVERSIZE REQUEST-URI DIRECTORY [**]
08/26-17:57:17.112865 217.184.254.169:4064 -> xxx.xxx.xxx.79:80
TCP TTL:119 TOS:0x0 ID:23827 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xE0D3EACB  Ack: 0x3C599219  Win: 0x2238  TcpLen: 2

or

Time,                Event,                   Intruder IP,     Count,
Protocol ID,
26.08.2004 17:57:20, HTTP_URL_Name_Very_Long, 217.184.254.169, 1,    
TCP,

Destination Port, Source Port
80,               4064

Parameter(s)
URL=/.±..........................................................................................................
.............................................................&URL-length=14593&accessed=no&code=400

2.1 Source of Trace:
____________________

Please see one point below.


2.2 Detect was generated by:
____________________________

>From an ISS Black ICE Server Protection 3.6 cno Firewall/IDS System
which was
running on a Windows 2000 Server.
Under http://blackice.iss.net more Information can be found about this
software.
The Windows Machine belongs to a friend of mine and he allows me to use
his logs
for the SANS Practical.
He was happy because I saved him from having to look at his logs himself
 ;-).
The condition to get access to his logs was to sanitize Information
about the host.

To get a second meaning (not only the BlackICE alert) from this detect I
transferred
the log from the commercial ISS System to tcpdump and loaded the Black
ICE log File in
Ethereal, marked everything and then I saved this File in the libpcap
(tcpdump, Ethereal, etc.) Format.

Now was it possible to run snort against this file with the command: 
c:\snort\bin\snort.exe -c:\snort\etc\snort.conf -b -l .

I got two Files.
a) The alert.ids File
b) The snort.log.xxx File (Log in binary Format)

The result from the alert.ids shows 3 attacks from the attacker IP.

[**] [1:1070:7] WEB-MISC WebDAV search access [**]
[Classification: access to a potentially vulnerable web application]
[Priority: 2] 
08/26-17:57:17.112865 217.184.254.169:4064 -> 217.147.106.19:80
TCP TTL:119 TOS:0x0 ID:23827 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xE0D3EACB  Ack: 0x3C599219  Win: 0x2238  TcpLen: 20
[Xref => http://www.whitehats.com/info/IDS474]

[**] [119:15:1] (http_inspect) OVERSIZE REQUEST-URI DIRECTORY [**]
[Classification: access to a potentially vulnerable web application]
[Priority: 2] 
08/26-17:57:17.112865 217.184.254.169:4064 -> 217.147.106.19:80
TCP TTL:119 TOS:0x0 ID:23827 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xE0D3EACB  Ack: 0x3C599219  Win: 0x2238  TcpLen: 20
[Xref => http://www.whitehats.com/info/IDS474]

[**] [119:4:1] (http_inspect) BARE BYTE UNICODE ENCODING [**]
08/26-17:57:17.112865 217.184.254.169:4064 -> 217.147.106.19:80
TCP TTL:119 TOS:0x0 ID:23828 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xE0D3F07F  Ack: 0x3C599219  Win: 0x2238  TcpLen: 2


The matching pattern for WEB-MISC WebDAV search access came from the
web-misc.rules
The other two are from the file gen-msg.map which is located in the
c:\Snort\etc directory.

During the analysis I used:
Windows XP Professional SP1,
Version 2.2.0-ODBC-MySQL-FlexRESP-WIN32 (Build 30),
the default snort rule set,
Ethereal 10.6,
Winpcap 3.01 alpha,
Windump 3.8 alpha,
p0f version 2.0.4

To get more Info I had to do as follows:
To view the content of the attack packet I loaded the original Black ICE
Log
File logxxx.enc into Ethereal and searched with the Filter:
ip.src == 217.184.254.169 and tcp.port == 4064 for the attack.

After selecting the packet and taking "Follow TCP Stream" I saved this
result
as an ASCII file (I shorten the endless dots).

SEARCH 

/.....................................................................................................................................................

......................................................................................................................................................

......................................................................................................................................................

......................................................................................................................................................

......................................................................................................................................................

......................................................................................................................................................

....................................................................................................................<snip>


2.3 Probability the source address was spoofed:
_______________________________________________

It was an established TCP connection so it is very unlikely that the
source
address is spoofed.
This means it occured a TCP three way handshake.
I checked this with:
windump -n -r transformed_tcpdump.tcpdump host 217.184.254.169 and port
4064
The result was:

Syn
---
17:57:16.628479 IP 217.184.254.169.4064 > xxx.xxx.xxx.79.80: S
3771984586:3771984586(0) win 8760 <mss 1460,nop,nop,sackOK> (DF)

Syn/Ack from the web server
---------------------------
17:57:16.628479 IP xxx.xxx.xxx.79.80 > 217.184.254.169.4064: S
1012503064:1012503064(0) ack 3771984587 win 65535 <mss
1460,nop,nop,sackOK> (DF)

Ack from attackers machine
--------------------------
17:57:17.034739 IP 217.184.254.169.4064 > xxx.xxx.xxx.79.80: . ack 1 win
8760 


2.4 Description of the attack:
______________________________

My first assumption was that this is an old attack against Microsoft web
server 
because of the endless dots. It could remember me that an attack against
IIS 2.0
and 3.0 (NT 4.0) with this pattern exists.
My second assumption was an attack that has to do with WebDAV.
The SEARCH / command leads me to this.

After a resarch with this below listed references my suspicion seems
confirmed.

Resources:
That was included in the snort signature as description
http://www.whitehats.com/info/IDS474

Microsoft IIS WebDAV long request buffer overflow
http://xforce.iss.net/xforce/xfdb/11533

Critical WebDAV Vulnerability: Are Your Exchange Servers Safe? 
http://www.winnetmag.com/Article/ArticleID/38396/38396.html

WebDAV BO Signature
http://archives.neohapsis.com/archives/iss/2003-q1/0442.html

Unchecked Buffer In Windows Component Could Cause Server Compromise
(815021)
http://www.microsoft.com/technet/security/bulletin/MS03-007.mspx

New attack vectors and a vulnerability dissection of MS03-007
http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0144.html

Good Paper
http://www.nextgenss.com/papers/ms03-007-ntdll.pdf

Microsoft Windows ntdll.dll Buffer Overflow Vulnerability 
Many exploits available
http://www.securityfocus.com/bid/7116

Good description
http://www.giac.org/practical/GCIH/Brandon_Young_GCIH.pdf


2.5 Attack mechanism:
_____________________

The attacker sends a special crafted overlong URL to a vulnerable web
server.
This could cause a buffer overflow and trough which the attacker could
gain access
to unpatched or unprotected machines. Several exploits exists in the
world.


2.6 Correlation:
________________

I found no other attacks from this IP in the Databases from:
http://www.mynetwatchman.com/
or
http://www.dshield.org/

So I tried to get a few more informations about the attacker.

First step:
Who is the owner of this address?

whois -h whois.ripe.net 217.184.254.169
% This is the RIPE Who is secondary server.
% The objects are in RPSL format.
% Please visit http://www.ripe.net/rpsl for more information.

inetnum:      217.184.0.0 - 217.185.255.255
netname:      MWAYS-BIGDIAL
descr:        various Online Services
country:      DE
admin-c:      ABU1-RIPE
tech-c:       ABU1-RIPE
status:       ASSIGNED PA
remarks:      send hack and spam complaints to:
remarks:      [email protected]
mnt-by:       MDA-Z
changed:      [email protected] 20020415
source:       RIPE

route:        217.184.0.0/13
descr:        mediaWays GmbH
origin:       AS6805
remarks:      netname: DE-MEDIAWAYS
mnt-by:       MDA-Z
changed:      [email protected] 20010315
source:       RIPE

person:       mediaWays abuse
address:      Telefonica Deutschland GmbH
address:      Huelshorstweg 30
address:      D-33415 Verl
address:      Germany
phone:        +49 05241 80 1701
e-mail:       [email protected]
nic-hdl:      ABU1-RIPE
remarks:      +------------------------------------+
remarks:      | Send hack and spam complaints to:  |
remarks:      |       [email protected]          |
remarks:      +------------------------------------+
changed:      [email protected] 20030324
source:       RIPE


It is a very big ISP. If I look at the side www.telefonica.de,
probably one of the largest in germany (europe).


The second step was to get more info about the attacker’s machine:

I did it with the Tool p0f
I took the tcpdump format of the Black ICE log and run the following
command
against it:
p0f -s transformed_tcpdump.tcpdump -o attacker_os.txt

The result was:
....
<Thu Aug 26 17:57:16 2004> 217.184.254.169:4064 - Windows XP, 2000 SP2+ 
  -> xxx.xxx.xxx.79:80 (distance 9, link: ethernet/modem)


2.7 Evidence of active targeting:
_________________________________

I am not sure if the attacker tries to search for random targets or if
it
was an attack. The source does not appear in dshield as a "big" well
known attacker
so it is very difficult to give an answer about it.


2.8 Severity:
_____________

Severity = (Criticality + Lethality) - (System Countermeasures + Network
Countermeasures)
   3     = (     3      +     5    ) - (            4                   
      1           )

Criticality = 3
---------------
The machine is not really critical. So I would rate it with 3

Lethality = 5
-------------
If the attack is successful I would rate it with 5.
It could mean that the machine can be totally compromised if no other
defensive
lines are in place. Like Buffer Overflow Protection trough the NAI 8
Virus Scanner.

System countermeasures = 4
--------------------------
All is patched on the last possible level, a Firewall and an IPS are
running
there but nothing is really save so I suggest a System countermeasure of
4.

Network countermeasures = 1
---------------------------
To check URLs for evil content is very difficult because the
requirements for
everybody are so different and nearly impossible for this big ISP.


2.9 Defensive recommendation:
_____________________________

Be sure that you have always the latest possible Patch Level and have
disabled
all services which do you not need (E.g. WebDAV if it is not used).
If you really need WebDAV check if it is possible to limit the IP
adresses which have
access to this service. If this is not possible think about an Intrusion
Prevention box
in front of this service.
Additionally should URLScan be used, which is a part of the Microsoft
IIS Lockdown Tool.
It blocks this attack in its default configuration.
http://www.microsoft.com/technet/security/tools/urlscan.mspx


2.10 Multiple choice test question:
___________________________________

What means DF in the triggered Snort rule?
TCP TTL:119 TOS:0x0 ID:23827 IpLen:20 DgmLen:1500 DF

A) Do not fragment
b) Data Field
C) Data Format
D) Devensive Format


Correct answer: A)
-- 
  Frank Birkmair
  [email protected]

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.