The third event is not an attack. You will find that the mailslot message occurs when the IIS server is restarted. The default IIS policy is restrictive and denies access to resource we did not deem essential to running a basic IIS server. If you attempt to use FrontPage functions with the default policy, you'll likely run into the same restrictions as FrontPage was not deems essential. After discussions in the engineering group, we cannot recall any reason to specifically deny this resource. It was caught under the best practice of deny all and open only what is needed. Feel free to contact support, they can walk you through the policy change that has been proposed for the 4.0 release. Marcus Gavel Cisco Systems - Cisco Security Agent fka Okena - StormWatch -----Original Message----- From: Dimitri Limanovski [mailto:dlimanovat_private] Sent: Tuesday, June 10, 2003 10:53 AM To: incidentsat_private Cc: Joe Mitchell Subject: Attack(s) caught by Okena Hello everyone.. In my evaluation of Okena (now Cisco) HIPS, I built a test system with "virgin" Win2K Server install that included full install of IIS. Machine was not patched (not even an SP1) and placed out in the wild without any kind of protection other than Okena's default Server, Firewall and IIS policy modules. As of two month of repetitive attacks, it has yet to be compromised. 99% of the attacks are standard port scans and NetBIOS enumeration attempts along with numerous attempts to overflow buffer with various IIS vulnerabilities. Lately, I have seen the following entries in the Event Viewer that I can not interpret. Based on the time stamp, this looks like one attack but I can't figure out exactly which one. First two events look like standard buffer overflow against inetinfo.exe. It's interesting to note that while all of the usual dafault.ida?XXXXX and WebDAV attempts are recorded in Web logs, this one isn't showing up anywhere aside from Event Viewer. The third event looked to me like some kind of variant of SMBNuke/SMBDie attack, based on '\\TEST**\MAILSLOT\NET\NETLOGON' signature, but it's being called by inetinfo.exe which I haven't seen before. Has anyone seen anything like this before? Any input is much appreciated! Dimitri <start event 1> Event Type: Warning Event Source: StormWatchAgent Event Category: Kernel Rule Event ID: 256 Date: 6/10/2003 Time: 1:53:30 AM User: N/A Computer: IISTEST Description: The application 'C:\WINNT\system32\inetsrv\inetinfo.exe' (as user IISTEST\IUSR_IISTEST) tried to call the function LoadLibraryA from a buffer (the return address was 0x45b7b1). The code at this address is '00005753 325f3332 2e444c4c 00ff55f4 8945bce8 07000000 736f636b 657400ff' This either happens when a program uses self-modifying code or when a program has been subverted by a buffer overflow attack. The user chose 'Terminate (no user interaction allowed)'. </end event 1> <start event 2> Event Type: Error Event Source: StormWatchAgent Event Category: Kernel Rule Event ID: 256 Date: 6/10/2003 Time: 1:53:30 AM User: N/A Computer: IISTEST Description: The application 'C:\WINNT\system32\inetsrv\inetinfo.exe' (as user IISTEST\IUSR_IISTEST) tried to call the function LoadLibraryA from a buffer (the return address was 0x45b7b1). The code at this address is '00005753 325f3332 2e444c4c 00ff55f4 8945bce8 07000000 736f636b 657400ff' This either happens when a program uses self-modifying code or when a program has been subverted by a buffer overflow attack. The program was terminated. </end event 2> <start event 3> Event Type: Error Event Source: StormWatchAgent Event Category: Kernel Rule Event ID: 256 Date: 6/10/2003 Time: 1:53:32 AM User: N/A Computer: IISTEST Description: The process 'C:\WINNT\system32\inetsrv\inetinfo.exe' (as user NT AUTHORITY\SYSTEM) tried to open/write the file '\\TEST**\MAILSLOT\NET\NETLOGON' and was denied. </end event 3> ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- ----------------------------------------------------------------------------
This archive was generated by hypermail 2b30 : Wed Jun 11 2003 - 12:43:21 PDT