Oct 30, 2020
my fave color is a reddish pastel pink ^_^
Loading...
seen from Canada
seen from Canada
seen from United States
seen from Pakistan
seen from Paraguay
seen from Italy
seen from Yemen
seen from Canada
seen from Singapore
seen from United States
seen from United States
seen from United States
seen from Russia
seen from Colombia
seen from Greece
seen from Netherlands
seen from Uruguay
seen from United States
seen from Canada
seen from Chile
my fave color is a reddish pastel pink ^_^
Anya is live and ready to show you everything. Watch her strip, dance, and perform exclusive shows just for you. Interact in real-time and make your fantasies come true.
Free to watch • No registration required • HD streaming
Detecting W32/SQLSlammer with python
I'm throwing this bit of code out there, just to show how easy it can be to write nifty little scripts in python. Use this script for detecting the SQL slammer worm(or rather the exploit it uses). The SQLSlammer worm is a really neat little creature (if rather archaic). By neat and little, I mean all contained in a single UDP packet and able to make a MSsql server cry.
I had a look at the payload contained in the UDP packet and illustrate how to detect if the buffer overflow exploit for a vulnerable MSsql server is present.
And now I present to you the crude but effective python script I wrote to inspect traffic on a interface and alert you once a MSsql server buffer overflow exploit (the one used by Slammer) has been detected.
from pcapy import open_live from impacket import ImpactDecoder class Slammer: def __init__(self): max_bytes = 1024 read_timeout = 100 # in milliseconds # Open live capture on eth0 reader = open_live('eth0', max_bytes, True, read_timeout) reader.setfilter('udp') # Run the packet capture loop reader.loop(0, self.callback) def callback(self, hdr, data): # Parse the Ethernet packet decoder = ImpactDecoder.EthDecoder() ether = decoder.decode(data) # Parse the IP packet inside the Ethernet packet iphdr = ether.child() # we only ude the udphdr but set the rest if # you might want to use them later tcphdr = icmphdr = udphdr = iphdr.child() #if iphdr.get_ip_p() == ImpactPacket.UDP.protocol: self.handle_udp(iphdr, udphdr) def handle_udp(self, iphdr, udphdr): try: print "[Inspecting UDP]" # We dont use most of these, but left them for refrence srcp = udphdr.get_uh_sport() dstp = udphdr.get_uh_dport() ip = iphdr.get_ip_src() len = udphdr.get_uh_ulen() chksum = udphdr.get_uh_sum() data = udphdr.get_data_as_string() # MS sql server port if dstp == 1434: print "srcport: %s | destport: %s | len: %s |"%(srcp, dstp, len) self.ident_slammer(data, ip) except: failed = "I dont care" def ident_slammer(self, payload, ip): # set if 0x04 is found, which means its performing # a query to find a database on the given host query = 0 # length of the db name the query is asking for # if this is larger than 16 bytes, # it triggers the exploit. The name string should be terminated # before the 16th byte with a 0x00 length = 0 index = 0 for b in payload: h = ord(b) # read these three IF statements from the bottem up to get the logic if length > 16 and query == 1: print "DB namestring longer than 16 bytes" print "[SQL buffer overflow exploit] FOUND, incomming from: %s"%ip break; if query == 1: if h == 0: break; else: length += 1 if h == 4 and index == 0: query = 1 print "Sql database search query..." index += 1 def main(): print "--[Listening on eth0]--" slammer = Slammer() if __name__ == "__main__": main()