untitled

Size: px

Start display at page:

Download "untitled"

れれよせ
5 years ago
Views:

1 Windows

2 Internet Information Server SQL Server 2

3 Explorer 3

4 MMC MMC mmc /a SQL Enterprise Manager IIS 4

5 MMC 5

6 MMC 6

7 Internet Information Server

8 IIS %SystemRoot% system32 Logfiles IIS Web 8

9 IIS 9

10 ODBC Windows 2003 Server IIS 6.0 IP IIS ClientHost, Username, LogTime, Service, Machine, ServerIP, ProcessingTime, BytesRecvd, BytesSent, ServiceStatus, Win32Status, Operation, Target, Parameters 10

11 IIS IP IP IP IP URI Stem HTML CGI URI HTTP Win32 Windows Cookie Cookie 11 HTTP

12 IIS URI #Fields: time c-ip cs-method cs-uri-stem sc-status 00:57:12 xx.xx.xx.xx POST /iishelp/iis/misc/query.asp 200 URI #Fields: time c-ip cs-method cs-uri-stem cs-uri-query sc-status 00:58:45 xx.xx.xx.xx POST /iishelp/iis/misc/query.asp SearchType= :14:55 xx.xx.xx.xx POST /iishelp/iis/misc/query.asp SearchType=3 200 Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+.NET+CLR ) 12

13 IIS URI URI 13

14 GET URI POST Cookie #Fields: time c-ip cs-method cs-uri-stem cs-uri-query sc-status cs(cookie) cs(referer) 02:35:53 xx.xx.xx.xx GET /iishelp/iis/misc/search.asp Searchset=3&SearchString= 200 ASPSESSIONIDGGQGGVFC=IFFFPKHBBLNMNEIFJJBPHOMB 02:35:55 xx.xx.xx.xx POST /iishelp/iis/misc/query.asp SearchType=3 200 ASPSESSIONIDGGQGGVFC=IFFFPKHBBLNMNEIFJJBPHOMB 14

15 Web GET URI POST XSS 15

16 IDS 16

17 /cgi-bin :44: GET /cgi-bin/main.cgi board=free_board&command=down_load&filename=../../../../ :44: GET /cgi-bin/main.cgi board=free_board&command=down_load&filename=../../../../../../../../../../etc/passwd :44: GET /cgi-bin/main_menu.pl :44: GET /cgi-bin/majordomo.pl :44: GET /cgibin/makechanges/easysteps/easysteps.pl :44: GET /cgi-bin/man.sh

18 InteInfo :12: GET /..%2f..%2f..%2f..%2fwinnt/system32/cmd.exe /c+dir+c: :12: GET /..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe /c+dir+c: :12: GET /..%5c..%5c..%5c..%5cwin2000/system32/cmd.exe /c+dir :12: GET /..%5c..%5c..%5c..%5cwindows/system32/cmd.exe /c+dir :12: GET /..%5c..%5c..%5c..%5cwinnt/system32/cmd.exe /c+dir :12: GET /..%5c..%5cwinnt/system32/cmd.exe /c+dir+c:

19 Nimda Nimda URI GET /scripts/root.exe?/c+dir GET /MSADC/root.exe?/c+dir GET /c/winnt/system32/cmd.exe?/c+dir GET /d/winnt/system32/cmd.exe?/c+dir GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir GET /msadc/..%5c../..%5c../..%5c/.. xc1 x1c../.. xc1 x1c../.. xc1 x1c../winnt/system32/cmd.exe?/c+dir GET /scripts/.. xc1 x1c../winnt/system32/cmd.exe?/c+dir GET /scripts/.. xc0/../winnt/system32/cmd.exe?/c+dir GET /scripts/.. xc0 xaf../winnt/system32/cmd.exe?/c+dir GET /scripts/.. xc1 x9c../winnt/system32/cmd.exe?/c+dir GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir GET /scripts/..%2f../winnt/system32/cmd.exe?/c+dir 19

20 IDS IDS Nimda URI IDS :44: GET /.%2e/.%2e/.%2e/winnt/boot.ini :44: GET /.%2e/.%2e/.%2e/winnt/repair/sam._ :44: GET /..%2f..%2f..%2f..%2f..%2f../windows/repair/sam :44: GET /..%2f..%2f..%2f..%2f..%2f../winnt/repair/sam :44: GET /..%2f..%2f..%2f..%2f..%2f../winnt/repair/sam._

21 IIS idq.dll ISAPI extension buffer overflow :24: GET /null.ida xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx =x :24: GET /null.ida xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx x=x :24: GET /null.ida xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=x

22 IPS idq.dll 22

23 23

24 IIS <script> </script> POST #Software: Microsoft Internet Information Services 6.0 #Version: 1.0 #Date: :20:43 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(cookie) sc-status sc-substatus sc-win32-status sc-bytes cs-bytes :20: GET /wk02/default.aspx CookieLoginAttempts= :21: POST /wk02/default.aspx CookieLoginAttempts= Web W3C GMT Microsoft GMT 24

25 IPS POST IIS 25

26 IPS Date/Time : :21:09 JST Tag Name : HTTP_POST_Script Alert Name : HTTP_POST_Script Severity : Medium Tag Brief Description : Observance Type : Intrusion Detection Combined Event Count : 1 Cleared Flag : No Target DNS Name : Target IP Address : Target Object Name : 80 Target Object Type : Target Port Target Service : http Source DNS Name : Source IP Address : SourcePort Name : 2961 Sensor DNS Name : Sensor IP Address : Sensor Name : server_sensor_1 Attribute Value Pairs for Event Number : 1 Attribute Name : algorithm-id Attribute Value : Attribute Name : AttackSuccessful Attribute Value : 2 Attribute Name : DestinationEthernetAddress Attribute Value : 00:50:56:C0:00:08 Attribute Name : field Attribute Value : TextBox1 Attribute Name : IANAProtocolId Attribute Value : 6 Attribute Name : protocol Attribute Value : http Attribute Name : server Attribute Value : tokwks031 Attribute Name : SystemAgent Attribute Value : TOKWKS031 Attribute Name : URL Attribute Value : /wk02/default.aspx Attribute Name : value Attribute Value : <script>..alert+('..</script> 26

27 SQL Web SQL SQL SELECT UserID FROM UserTbl WHERE UserName = txtusername AND Passwrd = txtpassword OR 1=1 SELECT UserID FROM UserTbl WHERE UserName = txtusername AND Passwrd = txtpassword OR 1=1 27

28 SQL SQL #Software: Microsoft Internet Information Services 6.0 #Version: 1.0 #Date: :00:37 #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(cookie) sc-status sc-substatus sc-win32-status sc-bytes cs-bytes :01: POST /hacmebank/login.aspx CookieLoginAttempts=5;+ASP.NET_SessionId=4nhskaykui2jor45oqjzpm :01: GET /hacmebank/welcome.aspx CookieLoginAttempts=4;+ASP.NET_SessionId=4nhskaykui2jor45oqjzpm

29 IPS POST 29

30 IIS WebDAV Nimda CodeRed Web SQL 30

31 SQL Server

32 SQL Server SQL Server SQL Server SQL Server SQLServer : 1433 SQL Server Agent SQL Server Agent SQL Server SQL 32

33 SQL Server 33

34 SQL Server 34

35 SQL Server Agent 35

36 SQL 36

37 SQL 37

38 SQL SQL Server Transact-SQL 1 SQL SQL Server SQL Server 38 SQL

39 SQL SQL Web SQL Server SQL SQL SQL Server SQL 39

40 40

41 SQL OR 1=1 41

42 SQL HAVING 1=1-- FSB_USERS.user_id GROUP BY FSB_USERS.user_name GROUP BY FSB_USERS.login_id GROUP BY FSB_USERS.password GROUP BY FSB_USERS.creation_date GROUP BY FSB_USERS user_id, user_name, login_id, password, creation_date 42

43 SQL 43

44 SQL 44

45 SQL master..xp_cmdshell ; exec master..xp_cmdshell dir-- 1 SQL xp_cmdshell dir 45

46 SQL dir 46

47 xp_cmdshell master..xp_cmdshell 47

48 SQL xp_cmdshell 48

49 SQL SQL SQL Server SQL SQL Server SQL Server SQL SQL SQL Server 49

50 Web Foundstone Hacme Bank TM SQL IIS SQL Server Microsoft.NET Framework 1.1 IIS MSDE 2000 SQL Server 2000 Microsoft ASP.NET Web Matrix 50

51 51

NetIQ White Paper

NetIQ White Paper Contents 1... 1 2... 2 3... 6 AppManager 3.4J 4.0J 4... 9 5 Web... 11 6... 12 7... 13 Appendix SQL Server 21 1.1 March 25, 2002 1 NetIQ AppManager 3.4J AppManager 4.0J AppManager 1.1 AppManager3.4J 4.0J