""ET EXPLOIT Metasploit mstime_malloc no-spray""

SID: 2016824

Revision: 2

Class Type: attempted-user

Metadata: affected_product Any, attack_target Client_and_Server, created_at 2013_05_07, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2013_05_07

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,from_server

Contents:

  • Value: "mstime_malloc"

Within:

PCRE: "/^[\r\n\s]?\x28[^\x29]?shellcode/Ri"

Special Options:

  • file_data

  • nocase

source