API tools faq
paste
Dr_FarFar

[+] IIS4 & IIS5 CGI 0day Vulnerabilities 2014

Dr_FarFar
Apr 9th, 2014
287
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.84 KB | None | 0 0
raw download clone embed print report
  1. /***
  2. ▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄
  3. ▐░░░░░░░░░░▌ ▐░░░░░░░░░░░▌ ▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌
  4. ▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀▀▀▀█░▌ ▐░█▀▀▀▀▀▀▀▀▀ ▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀▀▀▀▀▀ ▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀▀▀▀█░▌
  5. ▐░▌ ▐░▌▐░▌ ▐░▌ ▐░▌ ▐░▌ ▐░▌▐░▌ ▐░▌▐░▌ ▐░▌ ▐░▌▐░▌ ▐░▌
  6. ▐░▌ ▐░▌▐░█▄▄▄▄▄▄▄█░▌ ▐░█▄▄▄▄▄▄▄▄▄ ▐░█▄▄▄▄▄▄▄█░▌▐░█▄▄▄▄▄▄▄█░▌▐░█▄▄▄▄▄▄▄▄▄ ▐░█▄▄▄▄▄▄▄█░▌▐░█▄▄▄▄▄▄▄█░▌
  7. ▐░▌ ▐░▌▐░░░░░░░░░░░▌ ▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌
  8. ▐░▌ ▐░▌▐░█▀▀▀▀█░█▀▀ ▐░█▀▀▀▀▀▀▀▀▀ ▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀█░█▀▀ ▐░█▀▀▀▀▀▀▀▀▀ ▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀█░█▀▀
  9. ▐░▌ ▐░▌▐░▌ ▐░▌ ▐░▌ ▐░▌ ▐░▌▐░▌ ▐░▌ ▐░▌ ▐░▌ ▐░▌▐░▌ ▐░▌
  10. ▐░█▄▄▄▄▄▄▄█░▌▐░▌ ▐░▌ ▄ ▐░▌ ▐░▌ ▐░▌▐░▌ ▐░▌ ▐░▌ ▐░▌ ▐░▌▐░▌ ▐░▌
  11. ▐░░░░░░░░░░▌ ▐░▌ ▐░▌▐░▌▐░▌ ▐░▌ ▐░▌▐░▌ ▐░▌▐░▌ ▐░▌ ▐░▌▐░▌ ▐░▌
  12. ▀▀▀▀▀▀▀▀▀▀ ▀ ▀ ▀ ▀ ▀ ▀ ▀ ▀ ▀ ▀ ▀ ▀ ▀
  13.  
  14.  
  15.  
  16. ~~~ :xD: Have Fun. Don't Forget To Bookmark This Website :xD:
  17. ~~~ https://www.FaceBook.com/Dr.FarFar
  18. ~~~ http://Dr-FarFar.BlogSpot.com/
  19.  
  20. */
  21.  
  22. ###################################################################################################
  23.  
  24. IIS4 \ IIS5 CGI Environment Block Forged 0day
  25.  
  26. About 14 years ago, until now found a 0day
  27.  
  28. Is IIS4 \ IIS5 vulnerabilities and corresponding operating system is winnt win2000 system,
  29. Microsoft no longer supports the software, they want to eliminate these systems strategy,
  30. after 11 years of reporting Microsoft decided not to repair. Regarded as a very serious flaw,
  31. but the impact of software usage is now relatively low, but the total lot.
  32.  
  33. Specific vulnerability details are as follows:
  34. IIS CGI environment block forgery vulnerability loaded
  35. Hazard Class: high-risk
  36. Hazard Type: Buffer overflow remote code execution, information disclosure
  37. Impact platform: Winnt \ win2000
  38. Affected Software: IIS4, IIS5
  39.  
  40. The basic situation:
  41. IIS4, IIS5 loaded CGI, block processing environment when the error "\ n" characters with "\ x00" replaced,
  42. resulting in an arbitrary environment block can be forged. When IIS CGI-loaded,
  43. plus his own request "HTTP_" prefix added environment variables and local environment variables to distinguish,
  44. through the use of "\ n" replaced by "\ 0" loophole you can put these prefixes removed,
  45. thus any fake environment block variables.
  46. An attacker can submit http header "a = b \ nPATH_TRANSLATED: var" makes IIS CGI environment
  47. when loaded block variables become "HTTP_a = b" and "PATH_TRANSLATED = var",
  48. successfully forged environment block "PATH_TRANSLATED = var", let php.exe execute the script file "var",
  49. so as to execute arbitrary commands.
  50.  
  51. CGI is loaded, there are two ways, one is itself compiled. Exe executable programs, some of these common counter,
  52. some sites to develop their own applications, there are some broad application of WEB applications, etc.
  53. There is also a generic script mapped to. EXE interpreted (mapped to. Dll is isapi, unaffected),
  54. these are common PHP \ PERL scripts.
  55.  
  56. Partial results of specific harm to see the specific procedures for handling CGI environment block may result in:
  57. 1- CGI environment variables when dealing with a local buffer overflow some time to deal with local CGI environment variables,
  58. because these variables are generally not set or could have been credible,
  59. without considering the buffer size checks.
  60.  
  61. 2- some environment variables affect the processing logic block some of CGI, trust relationships.
  62.  
  63. 3- because the fake path environment variable to load the attacker's program or when loading dll loading process.
  64.  
  65.  
  66. Verification steps:
  67.  
  68. 1- win2000 + iis5 configuration. Php mapped to php.exe (ie cgi way if alluding to. Dll is isapi way, there is no vulnerability)
  69.  
  70. 2- the request is sent:
  71. "GET / a.php HTTP/1.1 \ r \ na = b \ nPATH_TRANSLATED: c: \ windows \ win.ini \ r \ nHOST: 192.168.0.1 \ r \ n \ r \ n"
  72.  
  73. 3- iis will return win.ini content.
  74.  
  75. 4- you can also use php iis log file write command
  76. to exploit this vulnerability allows execution php.exe call iis log file system commands.
  77.  
  78. Exploit :
  79.  
  80. http://pastebin.com/3GhrRwhA
  81.  
  82. 1 April Fool's Day edition:
  83.  
  84. http://seclists.org/fulldisclosure/2012/Apr/13
  85.  
  86.  
  87. Usage:
  88. . iisexp411 127.0.0.1 / AprilFools'Day php PATH_TRANSLATED c: \ windows \ win.ini
  89.  
  90. ########################################################################################################################
  91.  
  92. https://www.facebook.com/Dr.FarFar
  93. http://Dr-FarFar.BlogSpot.com/
  94.  
  95. ________ __________ __________
  96. ___ __ \___________ ____/______ ____________ ____/______ _________
  97. __ / / /__ ___/__ /_ _ __ `/__ ___/__ /_ _ __ `/__ ___/
  98. _ /_/ / _ /___ _ __/ / /_/ / _ / _ __/ / /_/ / _ /
  99. /_____/ /_/ _(_)/_/ \__,_/ /_/ /_/ \__,_/ /_/
  100.  
  101. ~\ Dr.FarFar /~
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!