interesting analysis

[reaper]

http://vrt-sourcefire.blogspot.com/2008/12/ms08-067-in-wild.html

[peewee_RotA]

That article reads like the repair manual for a turbo encabulator.

[reaper]

They actually step through the code which is cool.

Basically a intrustion detection system caught a packet that matched a signature.  When this packet matched the signature it stored the packet.   The security researcher recognized a pattern in the hex representation of the data that was a very simple decoding/enoding scheme using xor.  - they knew it was an exploit against ms-0867.  This is a exploit against the windows server service, attacking a poorly written function in the SMB protocol.

The shellcode is weakly encrypted to not be pattern matched by various types security systems.  But the intrustion detection system was matching on analysis of all attacks against the vulnerability.  They realize that to really run the shellcode  through the loop to decode it, they must populate a register with what is normally there from the Windows server service.  They do that and now they have attack payload assembly which they disassemble and analyze. 

The code is putting data in the stack that shouldn't be there by overflowing a buffer in the problem function netpathcanonicalize. It rewrites the function return address and the machine runs the new code.