Detection of MS05-051 attack with Snort

MS05-051 vulnerabilities and related attack code and worms have appeared for some days, from the IDS point of view, how to detect the attack using MS05-051 vulnerabilities?

Although Snort provides rules to detect attack-related requests, it is far from the attack itself:

Alert udp $ EXTERNAL_NET any-> $ HOME_NET 1024: (msg: "netbios dcerpc DIRECT-UDP IXnRemote BuildContextW little endian attempt"; flowbits: isset, dce. bind. IXnRemote; content: "| 05 |"; byte_test: 1, &, 16, 3, relative; content: "| 00 |"; within: 1; distance: 1; content: "| 07 00 |"; within: 2; distance: 19 ;)
Alert tcp $ EXTERNAL_NET any-> $ HOME_NET 1024: (msg: "netbios dcerpc direct v4 IXnRemote BuildContextW attempt"; flow: established, to_server; content: "| 04 00 | "; byte_test: 1 ,! &, 16,2, relative; content: "| E0 0C | k | 90 0B C7 | g | 10 B3 17 00 DD 01 06 | B | DA |"; within: 16; distance: 22; content: "| 00 07 |"; within: 2; distance: 28; pcre: "/^. {10}/sR ";)
Alert udp $ EXTERNAL_NET any-& gt; $ HOME_NET 1024: (msg: "netbios dcerpc DIRECT-UDP v4 IXnRemote BuildContextW attempt"; content: "| 04 00 |"; byte_test: 1 ,! &, 16,2, relative; content: "| E0 0C | k | 90 0B C7 | g | 10 B3 17 00 DD 01 06 | B | DA |"; within: 16; distance: 22; content: "| 00 07 |"; within: 2; distance: 28; pcre: "/^. {10}/sR ";)
Alert tcp $ EXTERNAL_NET any-> $ HOME_NET 1024: (msg: "netbios dcerpc direct IXnRemote BuildContextW attempt"; flow: established, to_server; flowbits: isset, dce. bind. IXnRemote; content: "| 05 |"; byte_test: 1 ,! &, 16,3, relative; content: "| 00 |"; within: 1; distance: 1; content: "| 00 07 |"; within: 2; distance: 19 ;)
Alert tcp $ EXTERNAL_NET any-> $ HOME_NET 1024: (msg: "netbios dcerpc direct IXnRemote BuildContextW little endian attempt"; flow: established, to_server; flowbits: isset, dce. bind. IXnRemote; content: "| 05 |"; byte_test: 1, &, 16, 3, relative; content: "| 00 |"; within: 1; distance: 1; content: "| 07 00 |"; within: 2; distance: 19 ;)
Alert udp $ EXTERNAL_NET any-> $ HOME_NET 1024: (msg: "netbios dcerpc DIRECT-UDP IXnRemote BuildContextW attempt"; flowbits: isset, dce. bind. IXnRemote; content: "| 05 |"; byte_test: 1 ,! &, 16,3, relative; content: "| 00 |"; within: 1; distance: 1; content: "| 00 07 |"; within: 2; distance: 19 ;)
Alert tcp $ EXTERNAL_NET any-> $ HOME_NET 1024: (msg: "netbios dcerpc direct v4 IXnRemote BuildContextW little endian attempt"; flow: established, to_server; content: "| 04 00 |"; byte_test: 1, &, 16, 2, relative; content: "| E0 0C | k | 90 0B C7 | g | 10 B3 17 00 DD 01 06 | B | DA |"; within: 16; distance: 22; content: "| 07 00 |"; within: 2; distance: 28; pcre: "/^. {10}/sR ";)
Alert udp $ EXTERNAL_NET any-& gt; $ HOME_NET 1024: (msg: "netbios dcerpc DIRECT-UDP v4 IXnRemote BuildContextW little endian attempt"; content: "| 04 00 |"; byte_test: 1, &, 16,2, relative; content: "| E0 0C | k | 90 0B C7 | g | 10 B3 17 00 DD 01 06 | B | DA |"; within: 16; distance: 22; content: "| 07 00 |"; within: 2; distance: 28; pcre: "/^. {10}/sR ";)

These rules may also trigger alarms for normal requests, which is obviously not satisfactory.

Vulnerability Analysis
--------

To detect the attack of course, we need to first make a more in-depth analysis of the cause of the MS05-051 vulnerability, the following analysis is fully organized from the work of the small four (scz at nsfocus dot com.

The vulnerability is caused by the Remote Call of msdtcprx! Memory Corruption occurs during BuildContextW (). msdtcprx. dll! BuildContextW () corresponds to the call of DCE-RPC 7, the corresponding simplest request packet parameters are manually decoded as follows:

--------------------------------------------------------------------------
0x00, 0x00, // + 0x000 param0, 2 bytes long
0x00, 0x00, // fill byte, 4-byte alignment
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // + 0x004 starting from param1, 24 bytes long
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, // + 0x018 param2, maximum length of the parameter, 4 bytes long
0x00, 0x00, 0x00, 0x00, // minimum possible length of the parameter, 4 bytes long
0x01, 0x00, 0x00, 0x00, // the actual length of the parameter, 4 bytes long
0x00, 0x00, // parameter string, Unicode format
0x00, 0x00, // fill byte, 4-byte alignment
0x01, 0x00, 0x00, 0x00, // + 0x028 pwszHostName, starting with param3, maximum possible length of the parameter, 4 bytes long
0x00, 0x00, 0x00, 0x00, // minimum possible length of the parameter, 4 bytes long
0x01, 0x00, 0x00, 0x00, // the actual length of the parameter, 4 bytes long
0x00, 0x00, // parameter string, Unicode format
0x00, 0x00, // fill byte, 4-byte alignment
0x01, 0x00, 0x00, 0x00, // + 0x038 pwszUuidString param4, maximum length of the parameter, 4 bytes long, normally it should be 0x00000025. If it is greater than this value, it is malformed.
0x00, 0x00, 0x00, 0x00, // minimum possible length of the parameter, 4 bytes long
0x01, 0x00, 0x00, 0x00, // the actual length of the parameter, 4 bytes long
0x00, 0x00, // parameter string, Unicode format
0x00, 0x00, // fill byte, 4-byte alignment
0x01, 0x00, 0x00, 0x00, // + 0x048 param5, maximum length of the parameter, 4 bytes long, normally it should be 0x00000025. If it is greater than this value, it is malformed.
0x00, 0x00, 0x00, 0x00, // minimum possible length of the parameter, 4 bytes long
0x01, 0x00, 0x00, 0x00, & nb