full-disclosure - Unusual request

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <A7043C74B6DA4842BD57E4449F43BB1B028F9C@shiro.oicinc.com>
From: schoe at oicinc.com (Sung J. Choe)
Subject: Unusual request

I am looking for an exploit that will give you "root" on
> an unpatched IIS box by simply typing a string in the address line in
> your browser.

I don't know about "root"ing an IIS system but the NIMDA method of
exploiting IIS via:
http://victim.com/scripts/..%5c%5c../winnt/system32/cmd.exe seems to be a
close match to what you are describing.


.--------------------------------------------------.
| Sung J. Choe <schoe[at]oicinc.com>, TICSA        |
| Systems Administrator, Facility Security Officer |
.--------------------------------------------------.----.
                    | Oceanic Imaging Consultants, Inc. |
                    | Phone #: (808) 539-3634 x3634     |
                    .-----------------------------------.

568D CAD6 53A0 92E6 4A2A  4E87 3BA0 5F90 37BB 8EE7

> -----Original Message-----
> From: Paul Schmehl [mailto:pauls@...allas.edu]
> Sent: Wednesday, February 12, 2003 1:26 PM
> To: Full-Disclosure
> Subject: [Full-Disclosure] Unusual request
> 
> 
> The net is filled with so much junk now, it's getting harder to find
> what you need.  I am looking for an exploit that will give 
> you "root" on
> an unpatched IIS box by simply typing a string in the address line in
> your browser.  I know I've seen it before, but I can't seem to find it
> amongst all the vulns for IIS and all the web logs that show 
> up when you
> google.
> 
> I need this for a "security roadshow" that we're putting 
> together, so I
> can demonstrate how easy it is to break in to an unpatched box.  Can
> anybody point me in the right direction?
> 
> I don't want exploit code.  This is just a simple string that 
> you enter
> into the URL box in a browser.  It's at least two or three 
> years old, I
> know.
> 
> -- 
> Paul Schmehl (pauls@...allas.edu)
> Adjunct Information Security Officer
> The University of Texas at Dallas
> http://www.utdallas.edu/~pauls/
> AVIEN Founding Member
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030212/4eeb05f1/attachment.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: schoe.vcf
Type: application/octet-stream
Size: 284 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030212/4eeb05f1/schoe.obj