1

Sourcefire detected a SERVER-IIS multiple extension code execution attempt event and captured a packet. It originated from a Chinese IP, AbuseIPDB has several records about its malicious activity. Some of the logs included a user-agent string mentioning Googlebot2.0, but doing a reverse IP lookup, the IP doesn't resolve to anything, so I'm guessing it is spoofed.

Now the question is, is this exploit visible in the packet (.asp +.jpg), or Sourcefire captured just one of the execution attempts? Can someone explain the anatomy of this attack?

Packet:

.PV..4.
I.....`#[email protected].!%.
 .....P.**..l..P..<._..HEAD /Ac2.asp;.jpg HTTP/1.1
User-Agent: IE 10.0
Host: www.*****.com

1 Answer 1

1

What you see is an attempt to exploit a Microsoft IIS vulnerability (a pretty old one, in fact). I found this blog entry with documentation and more details about it:

https://soroush.secproject.com/blog/2009/12/microsoft-iis-semi-colon-vulnerability/

The code name for this vulnerability is CVE-2009-4444.

This event doesn't identify whether the attacker succeeded or not, it just shows that they attempted to exploit it.

3
  • so the two extensions tried (.asp and .jpg) are enough to trigger this event ? Could you please comment briefly on how this exploit works on a server level?
    – Gabrielius
    Sep 27, 2017 at 12:51
  • It is enough because of the way the SNORT rule used by Sourcefire is written. I think you can see the actual rule too, somewhere in Sourcefire if you click on the rule's name. The blog entry I linked to describes the operation on this exploit: "The vulnerability is caused due to the web server incorrectly executing e.g. ASP code included in a file having multiple extensions separated by “;”, only one internal extension being equal to “.asp” (e.g. “file.asp;.jpg”)."
    – skooog
    Sep 27, 2017 at 13:01
  • Ahh, so it's basically executable code hidden in a .jpg file. I get it now, thanks !
    – Gabrielius
    Sep 27, 2017 at 14:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .