1

Sourcefire detected a SERVER-IIS multiple extension code execution attempt event and captured a packet. It originated from a Chinese IP, AbuseIPDB has several records about its malicious activity. Some of the logs included a user-agent string mentioning Googlebot2.0, but doing a reverse IP lookup, the IP doesn't resolve to anything, so I'm guessing it is spoofed.

Now the question is, is this exploit visible in the packet (.asp +.jpg), or Sourcefire captured just one of the execution attempts? Can someone explain the anatomy of this attack?

Packet:

.PV..4.
I.....`#..E..s.f@....2.!%.
 .....P.**..l..P..<._..HEAD /Ac2.asp;.jpg HTTP/1.1
User-Agent: IE 10.0
Host: www.*****.com
1

What you see is an attempt to exploit a Microsoft IIS vulnerability (a pretty old one, in fact). I found this blog entry with documentation and more details about it:

https://soroush.secproject.com/blog/2009/12/microsoft-iis-semi-colon-vulnerability/

The code name for this vulnerability is CVE-2009-4444.

This event doesn't identify whether the attacker succeeded or not, it just shows that they attempted to exploit it.

  • so the two extensions tried (.asp and .jpg) are enough to trigger this event ? Could you please comment briefly on how this exploit works on a server level? – Gabrielius Sep 27 '17 at 12:51
  • It is enough because of the way the SNORT rule used by Sourcefire is written. I think you can see the actual rule too, somewhere in Sourcefire if you click on the rule's name. The blog entry I linked to describes the operation on this exploit: "The vulnerability is caused due to the web server incorrectly executing e.g. ASP code included in a file having multiple extensions separated by “;”, only one internal extension being equal to “.asp” (e.g. “file.asp;.jpg”)." – skooog Sep 27 '17 at 13:01
  • Ahh, so it's basically executable code hidden in a .jpg file. I get it now, thanks ! – Gabrielius Sep 27 '17 at 14:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.