Hi, I spotted the same behaviour on my win2k + IIS 5.0 installation. When I installed the unicode patch this problem disappeared. Hence why I did not publish this. Maybe other people can reproduce this as well? another one that works is %252f. %255c and %252f (slash and backslash) worked before I applied the patch and ceased working afterwards. %255c and %252f are NOT unicode codes but hex codes. I find it strange that the unicode patch fixed this. IIS4.0 installations without the unicode patch were not vulnerable when I tried. greetz, nemesystm > >/* > * > * execiis.c - (c)copyright Filip Maertens > * BUGTRAQ ID: 2708 - Microsoft IIS CGI Filename Decode Error > * > * DISCLAIMER: This is proof of concept code. This means, this >code > * may only be used on approved systems in order to test the >availability > * and integrity of machines during a legal penetration test. In no >way > * is the author of this exploit responsible for the use and result >of > * this code. > * > */ > >#include <stdio.h> >#include <stdlib.h> >#include <sys/socket.h> >#include <sys/types.h> >#include <netinet/in.h> >#include <unistd.h> >#include <string.h> > > >/* Modify this value to whichever sequence you want. > * > * %255c = %%35c = %%35%63 = %25%35%63 = / > * > */ Free, encrypted, secure Web-based email at www.hushmail.com
This archive was generated by hypermail 2b30 : Wed May 16 2001 - 06:58:15 PDT