Signature Detail

SHELLCODE: Shikata Ga Nai Encoder Routine Over HTTP (1)

This signature detects payloads being transferred over HTTP protocol that have been encoded using Shikata Ga Nai encoder routine. This may be an indication of someone trying to evade anti-virus/IPS solutions and possibly drop malicious code.

Extended Description

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

Affected Products

• Debian debian_linux 8.0
• Rubyonrails rails 4.0.0
• Rubyonrails rails 4.0.1
• Rubyonrails rails 4.0.10
• Rubyonrails rails 4.0.2
• Rubyonrails rails 4.0.3
• Rubyonrails rails 4.0.4
• Rubyonrails rails 4.0.5
• Rubyonrails rails 4.0.6
• Rubyonrails rails 4.0.7
• Rubyonrails rails 4.0.8
• Rubyonrails rails 4.0.9
• Rubyonrails rails 4.1.0
• Rubyonrails rails 4.1.1
• Rubyonrails rails 4.1.10
• Rubyonrails rails 4.1.12
• Rubyonrails rails 4.1.13
• Rubyonrails rails 4.1.14
• Rubyonrails rails 4.1.2
• Rubyonrails rails 4.1.3
• Rubyonrails rails 4.1.4
• Rubyonrails rails 4.1.5
• Rubyonrails rails 4.1.6
• Rubyonrails rails 4.1.7
• Rubyonrails rails 4.1.7.1
• Rubyonrails rails 4.1.8
• Rubyonrails rails 4.1.9
• Rubyonrails rails 4.2.0
• Rubyonrails rails 4.2.1
• Rubyonrails rails 4.2.2
• Rubyonrails rails 4.2.3
• Rubyonrails rails 4.2.4
• Rubyonrails rails 4.2.5
• Rubyonrails rails 4.2.5.1
• Rubyonrails ruby_on_rails 3.2.22.1
• Rubyonrails ruby_on_rails 4.1.14.1

References

• BugTraq: 36954
• BugTraq: 57760
• CVE: CVE-2016-0709
• CVE: CVE-2016-0710
• CVE: CVE-2016-2098
• CVE: CVE-2014-4511
• URL: http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-and
• URL: https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0709
• URL: https://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0710
• URL: http://werkzeug.pocoo.org/docs/0.10/debug/#enabling-the-debugger
• URL: http://pastie.org/pastes/10527766/text?key=wq1hgkcj4afb9ipqzllsq
• URL: http://blog.checkpoint.com/2015/11/05/check-point-discovers-critical-vbulletin-0-day/
• URL: https://www.mantisbt.org/bugs/view.php?id=17725
• URL: https://www.mantisbt.org/bugs/view.php?id=17780
• URL: https://nodesecurity.io/advisories/bassmaster_js_injection
• URL: http://openwall.com/lists/oss-security/2015/06/16/18
• URL: https://groups.google.com/forum/message/raw?msg=rubyonrails-security/lzmz9_ijUFw/HBMPi4zp5NAJ
• URL: https://hackerone.com/reports/44513
• URL: http://blog.curesec.com/article/blog/Bolt-224-Code-Execution-44.html
• URL: https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html
• URL: https://phabricator.wikimedia.org/T158689
• URL: https://securify.nl/advisory/SFY20170201/syntaxhighlight_mediawiki_extension_allows_injection_of_arbitrary_pygments_options.html
• URL: https://github.com/opsxcq/exploit-CVE-2016-10033
• URL: https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html
• URL: http://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/
• URL: http://tomcat.apache.org/tomcat-5.5-doc/manager-howto.html
• URL: http://blog.pages.kr/1307
• URL: https://community.rapid7.com/community/metasploit/blog/2016/09/15/important-security-fixes-in-metasploit-4120-2016091401
• URL: https://github.com/justinsteven/advisories/blob/master/2016_metasploit_rce_static_key_deserialization.md
• URL: http://blog.curesec.com/article/blog/NibbleBlog-403-Code-Execution-47.html
• URL: http://karmainsecurity.com/KIS-2013-07
• URL: http://karmainsecurity.com/KIS-2013-08
• URL: http://itsecuritysolutions.org/2012-08-13-TestLink-1.9.3-multiple-vulnerabilities/
• URL: http://www.s3cur1ty.de/m1adv2013-004
• URL: http://hatriot.github.io/blog/2014/06/29/gitlist-rce/
• URL: http://www.s3cur1ty.de/m1adv2013-012
• URL: https://docs.docker.com/engine/security/security/#docker-daemon-attack-surface
• URL: https://docs.docker.com/engine/reference/commandline/dockerd/#bind-docker-to-another-hostport-or-a-unix-socket
• URL: http://www.harmj0y.net/blog/empire/empire-fails/
• URL: http://seclists.org/fulldisclosure/2014/Oct/78
• URL: http://www.s3cur1ty.de/m1adv2013-001
• URL: https://pentest.blog/advisory-denyall-web-application-firewall-unauthenticated-remote-code-execution/
• URL: http://www.seagate.com/au/en/support/external-hard-drives/network-storage/business-storage-2-bay-nas/
• URL: https://beyondbinary.io/advisory/seagate-nas-rce/
• URL: https://raw.githubusercontent.com/pedrib/PoC/master/advisories/nuuo-nvr-vulns.txt
• URL: http://seclists.org/bugtraq/2016/Aug/45
• URL: https://pentest.blog/unexpected-journey-3-visiting-another-siem-and-uncovering-pre-auth-privileged-remote-code-execution/
• URL: https://github.com/rapid7/metasploit-framework/pull/8245
• URL: http://www.s3cur1ty.de/m1adv2013-008
• URL: https://warroom.securestate.com/dcos-marathon-compromise/
• URL: https://tiki.org/article414-Important-Security-Fix-for-all-versions-of-Tiki
• URL: http://www.s3cur1ty.de/m1adv2013-015
• URL: http://www.devttys0.com/2014/05/hacking-the-dspw215-again/
• URL: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=305
• URL: https://www.kb.cert.org/vuls/id/582384
• URL: http://kb.netgear.com/000036386/CVE-2016-582384
• URL: https://community.rapid7.com/community/metasploit/blog/2015/10/09/r7-2015-17-hp-sitescope-dns-tool-command-injection
• URL: http://www8.hp.com/us/en/software-solutions/sitescope-application-monitoring/index.html
• URL: http://downloads.solarwinds.com/solarwinds/Release/HotFix/FSM-v6.6.5-HotFix1.zip
• URL: http://www.pwnag3.com/2012/01/sysax-multi-server-550-exploit.html
• URL: http://www.mattandreko.com/2012/07/sysax-564-http-remote-buffer-overflow.html
• URL: http://www.nessus.org/plugins/index.php?view=single&id=11771
• URL: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03969437
• URL: http://www.websecuritywatch.com/xxe-arbitrary-code-execution-in-ektron-cms/
• URL: http://seclists.org/fulldisclosure/2014/Oct/34
• URL: http://www.novell.com/support/kb/doc.php?id=7011895
• URL: http://www.corelan.be:8800/advisories.php?id=CORELAN-10-061
• URL: http://seclists.org/fulldisclosure/2015/Sep/66
• URL: https://support.zoho.com/portal/manageengine/helpcenter/articles/pgsql-submitquery-do-vulnerability
• URL: http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
• URL: http://security-assessment.com/files/documents/advisory/Kaseya%20File%20Upload.pdf
• URL: https://github.com/edwardz246003/IIS_exploit
• URL: https://0patch.blogspot.com/2017/03/0patching-immortal-cve-2017-7269.html
• URL: http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140512_00
• URL: https://bugzilla.mozilla.org/show_bug.cgi?id=630919
• URL: http://www.mozilla.org/security/announce/2011/mfsa2011-13.html
• URL: http://dev.tiki.org/item4109
• URL: http://www.vicidial.org/VICIDIALmantis/view.php?id=1016
• URL: http://blog.sucuri.net/2014/12/security-advisory-high-severity-wordpress-download-manager.html
• URL: http://www.opensyscom.fr/Actualites/wordpress-plugins-asset-manager-shell-upload-vulnerability.html
• URL: http://archives.neohapsis.com/archives/bugtraq/2009-11/0166.html
• URL: http://www.openx.org/docs/2.8/release-notes/openx-2.8.2
• URL: http://php.net/manual/en/function.getimagesize.php
• URL: http://gynvael.coldwind.pl/?id=223
• URL: http://gynvael.coldwind.pl/?id=224
• URL: http://gynvael.coldwind.pl/?id=235
• URL: http://programming.arantius.com/the+smallest+possible+gif
• URL: http://stackoverflow.com/questions/2253404/what-is-the-smallest-valid-jpeg-file-size-in-bytes
• URL: http://www.phpmyadmin.net/home_page/security/PMASA-2009-3.php
• URL: http://labs.neohapsis.com/2009/04/06/about-cve-2009-1151/
• URL: http://wordpress.org/support/topic/pwn3d
• URL: http://www.acunetix.com/blog/web-security-zone/wp-plugins-remote-code-execution/
• URL: https://www.mogwaisecurity.de/advisories/MSA-2015-01.txt
• URL: https://raw.githubusercontent.com/pedrib/PoC/master/advisories/novell-service-desk-7.1.0.txt
• URL: http://www.osirt.com/2013/11/wordpress-optimizepress-hack-file-upload-vulnerability/
• URL: http://seclists.org/bugtraq/2016/Apr/64
• URL: http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html
• URL: https://bugzilla.wikimedia.org/show_bug.cgi?id=60339
• URL: http://www.splunk.com/view/SP-CAAAGMM
• URL: http://www.sec-1.com/blog/?p=233