full-disclosure - Unusual request

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <00aa01c2d2f3$08f62470$0100000a@yrpxb5>
From: yossarian at planet.nl (yossarian)
Subject: Unusual request

RE: [Full-Disclosure] Unusual requestI am well aware that giving this info is considered illegal by some people, anyway, it is for a good cause - good luck with the roadshow.

http://www.astalavista.com/library/os/iis/unicode1.htm

This is a basic unicode exploit, of the type MS warned developers for in 1997 (MSDN), which adds a nice touch to your case,

yossarian
  ----- Original Message ----- 
  From: Sung J. Choe 
  To: 'Paul Schmehl' 
  Cc: 'full-disclosure@...ts.netsys.com' 
  Sent: Thursday, February 13, 2003 12:41 AM
  Subject: RE: [Full-Disclosure] Unusual request


  I am looking for an exploit that will give you "root" on 
  > an unpatched IIS box by simply typing a string in the address line in 
  > your browser. 

  I don't know about "root"ing an IIS system but the NIMDA method of exploiting IIS via: http://victim.com/scripts/..%5c%5c../winnt/system32/cmd.exe seems to be a close match to what you are describing.



  .--------------------------------------------------. 
  | Sung J. Choe <schoe[at]oicinc.com>, TICSA        | 
  | Systems Administrator, Facility Security Officer | 
  .--------------------------------------------------.----. 
                      | Oceanic Imaging Consultants, Inc. | 
                      | Phone #: (808) 539-3634 x3634     | 
                      .-----------------------------------. 

  568D CAD6 53A0 92E6 4A2A  4E87 3BA0 5F90 37BB 8EE7 

  > -----Original Message----- 
  > From: Paul Schmehl [mailto:pauls@...allas.edu] 
  > Sent: Wednesday, February 12, 2003 1:26 PM 
  > To: Full-Disclosure 
  > Subject: [Full-Disclosure] Unusual request 
  > 
  > 
  > The net is filled with so much junk now, it's getting harder to find 
  > what you need.  I am looking for an exploit that will give 
  > you "root" on 
  > an unpatched IIS box by simply typing a string in the address line in 
  > your browser.  I know I've seen it before, but I can't seem to find it 
  > amongst all the vulns for IIS and all the web logs that show 
  > up when you 
  > google. 
  > 
  > I need this for a "security roadshow" that we're putting 
  > together, so I 
  > can demonstrate how easy it is to break in to an unpatched box.  Can 
  > anybody point me in the right direction? 
  > 
  > I don't want exploit code.  This is just a simple string that 
  > you enter 
  > into the URL box in a browser.  It's at least two or three 
  > years old, I 
  > know. 
  > 
  > -- 
  > Paul Schmehl (pauls@...allas.edu) 
  > Adjunct Information Security Officer 
  > The University of Texas at Dallas 
  > http://www.utdallas.edu/~pauls/ 
  > AVIEN Founding Member 
  > 
  > _______________________________________________ 
  > Full-Disclosure - We believe in it. 
  > Charter: http://lists.netsys.com/full-disclosure-charter.html 
  > 

   
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030213/17d5516e/attachment.html