""ET EXPLOIT SMB Null Pointer Dereference PoC Inbound (CVE-2018-0833)""

SID: 2025983

Revision: 2

Class Type: attempted-admin

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_08_08, cve CVE_2018_0833, deployment Internal, signature_severity Minor, updated_at 2018_08_08

Reference:

• cve

• 2018-0833

Protocol: tcp

Source Network: any

Source Port: 445

Destination Network: $HOME_NET

Destination Port: any

Flow: from_server,established

Contents:

• Value: "|FD 53 4D 42 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41|"

Offset: 4

Within:

PCRE:

Special Options:

source