full-disclosure - Unusual request

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1045092385.15233.510.camel@utd49554.utdallas.edu>
From: pauls at utdallas.edu (Paul Schmehl)
Subject: Unusual request

The net is filled with so much junk now, it's getting harder to find
what you need.  I am looking for an exploit that will give you "root" on
an unpatched IIS box by simply typing a string in the address line in
your browser.  I know I've seen it before, but I can't seem to find it
amongst all the vulns for IIS and all the web logs that show up when you
google.

I need this for a "security roadshow" that we're putting together, so I
can demonstrate how easy it is to break in to an unpatched box.  Can
anybody point me in the right direction?

I don't want exploit code.  This is just a simple string that you enter
into the URL box in a browser.  It's at least two or three years old, I
know.

-- 
Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/~pauls/
AVIEN Founding Member