Waraxe IT Security Portal

Vixje · Active user

Hi there,

I am testing a vulnerability on a horde webmail page:

Here's the perl script:

http://www.milw0rm.com/exploits/1650

When I execute this script, i seem to arrive within a shell and its looking like this:

waraxe · Site admin

So you have possibilities to run shell comands against windows server.
First, try "ver" to find out exact windows version.

Vixje · Active user

horddy> ver

Microsoft Windows [Version 5.2.3790]
horddy>

ok, so that seems to work.

mkdir test, doesnt work, and also i cannot go outside of the folder i'm in.

waraxe · Site admin

Vixje · Active user

horddy> ftp --help
horddy>

nope didnt work im affraid, strange i would expect also less priveleged accounts would have ftp --help access. Is there a sort of, who am i, in windows?

Hmm, SET command gives following output. It's like if i'm a unexisting user within a roaming profile or something hehe.

waraxe · Site admin

As much as i know, win 2003/2000/xp does not have "whoami" and "who" utilities, as in unix.
Now, ftp.exe and tftp.exe are residing in "windows/system32" directory and if user has low privileges, then those executables cannot be used.
Can you traversal directories with "cd .." ?
And try to use "echo foobar >> test.txt" type commands to write arbitrary text files (if you have write permissions in specific dir).
Next use "cat test.txt" to read text files.

Vixje · Active user

waraxe · Site admin

Interesting situation ...

Try "perl --help", maybe you have access to perl CLI Smile

Vixje · Active user

Woah, bingo Wink

Damn you are good hehe.

Usage: C:\Program Files\SWsoft\Plesk\Additional\Perl\bin\perl.exe [switches] [--] [programfile] [arguments]
-0[octal] specify record separator (\0, if no argument)
-a autosplit mode with -n or -p (splits $_ into @F)
-C[number/list] enables the listed Unicode features
-c check syntax only (runs BEGIN and CHECK blocks)
-d[:debugger] run program under debugger
-D[number/list] set debugging flags (argument is a bit mask or alphabets)
-e program one line of program (several -e's allowed, omit programfile)
-F/pattern/ split() pattern for -a switch (//'s are optional)
-i[extension] edit <> files in place (makes backup if extension supplied)
-Idirectory specify @INC/#include directory (several -I's allowed)
-l[octal] enable line ending processing, specifies line terminator
-[mM][-]module execute `use/no module...' before executing program
-n assume 'while (<>) { ... }' loop around program
-p assume loop like -n but print line also, like sed
-P run program through C preprocessor before compilation
-s enable rudimentary parsing for switches after programfile
-S look for programfile using PATH environment variable
-t enable tainting warnings
-T enable tainting checks
-u dump core after parsing program
-U allow unsafe operations
-v print version, subversion (includes VERY IMPORTANT perl info)
-V[:variable] print configuration summary (or a single Config.pm variable)
-w enable many useful warnings (RECOMMENDED)
-W enable all warnings
-x[directory] strip off text before #!perl line and perhaps cd to directory
-X disable all warnings

horddy>

--edit--

The path shown in the set output must shouldnt have been missed hehe. What I'm guessing that could be a next step now is, using perl cli commands to try and ftp a file to the folder. Allthough, we still have this permission problem on the folder. Using perl to get to other folders probably doesnt help much either, so this is still a very interesting situation on a w2k3 box hehe.

waraxe · Site admin

Hmm, there must be directories, available to specific account.

Try for example:

Vixje · Active user

I've been testing a bit more, here's my results:

When i locally execute:
perl -e system(ftp)

The cli replies with a ftp>, allowing to to ftp.

When i use this at the remote host,
horddy> perl -e system(ping)
horddy>

It just hits back to the cli so i think perl doesnt work afterall.

Somehow I cant change to other folders either. All folders you have suggested dont work.

horddy> dir
Volume in drive C has no label.
Volume Serial Number is 60FD-0AF1

Directory of C:\Inetpub\vhosts\webmail\horde\services\help

04/12/2006 01:02 AM <DIR> .
04/12/2006 01:02 AM <DIR> ..
10/27/2004 11:55 AM 3,449 index.php
1 File(s) 3,449 bytes
2 Dir(s) 54,795,264,000 bytes free
horddy> dir
Volume in drive C has no label.

I wouldnt find this so suprising if this was a unix/linux box but its windows haha

waraxe · Site admin

If you are issuing shell commands like

Vixje · Active user

No, here's what happens:

horddy> cd
C:\Inetpub\vhosts\webmail\horde\services\help

So if " is a problem, maybe i can use the windows shortcuts, like progra~1 for program files f.e.

cd c:\docume~1\defaul~1 doesnt seem to work either. It just goes to the next line, but a dir shows me i'm still in dir same folder.

waraxe · Site admin

Seems like complicated situation Smile

I will must go away now...
But this is interesting issue, so feel free to post here your next moves.

Best! Wink

Vixje · Active user

Thanks a lot for helping me think this one out hehe, and thanks for having me as a visitor on your forum. This board is one of the few where I can find some more serious people around without speaking like ZoOmG Iam TH4 L34T h4x0rZZ etc..

Also new people who show serious interest are accepted and helped, which is rare on these kind of boards. Keep up the good work.

If anything come to mind about my issue let me know, i will update too if i find something else out too Wink