Re: New Secuity Vulnerabilities

From: xenophi1e (oliver.laveryat_private)
Date: Wed Jun 04 2003 - 16:35:50 PDT

  • Next message: Peteris Krumins: "Decision"

    
     ('binary' encoding is not supported, stored as-is)
    In-Reply-To: <265000-22003623223417466at_private>
    
    
    Had a friend with a few 2K3 servers try this. Apparently it wasn't 
    present on two virgin installs w/o ISS, nor on a testing machine with IIS 
    (and probably the world) installed.
    
    ~x
    
    >1=2E Windows 2003 Server has a built in Command Line Interreptor (I don't
    >know if this service is enabled by defult but i've tested this on 9
    >systems,=20
    >in 7 of them it worked), which means that you can send commands to it 
    usin=
    >g
    >the HTTP (TCP)=20
    >   method (the web browser) by trying to access the server on port 19338
    >like this:
    >
    >http://admin@>:19338/cmd=2Ecgi?cmd=3D<EnterCommandHere>
    >
    



    This archive was generated by hypermail 2b30 : Thu Jun 05 2003 - 11:26:30 PDT