Re: Unusual request

["yossarian" <yossarian () planet nl>]

RE: [Full-Disclosure] Unusual requestI am well aware that giving this info is considered illegal by some people, 
anyway, it is for a good cause - good luck with the roadshow.

http://www.astalavista.com/library/os/iis/unicode1.htm

This is a basic unicode exploit, of the type MS warned developers for in 1997 (MSDN), which adds a nice touch to your 
case,

yossarian
  ----- Original Message ----- 
  From: Sung J. Choe 
  To: 'Paul Schmehl' 
  Cc: 'full-disclosure () lists netsys com' 
  Sent: Thursday, February 13, 2003 12:41 AM
  Subject: RE: [Full-disclosure] Unusual request


  I am looking for an exploit that will give you "root" on 
  > an unpatched IIS box by simply typing a string in the address line in 
  > your browser. 

  I don't know about "root"ing an IIS system but the NIMDA method of exploiting IIS via: 
http://victim.com/scripts/..%5c%5c../winnt/system32/cmd.exe seems to be a close match to what you are describing.



  .--------------------------------------------------. 
  | Sung J. Choe <schoe[at]oicinc.com>, TICSA        | 
  | Systems Administrator, Facility Security Officer | 
  .--------------------------------------------------.----. 
                      | Oceanic Imaging Consultants, Inc. | 
                      | Phone #: (808) 539-3634 x3634     | 
                      .-----------------------------------. 

  568D CAD6 53A0 92E6 4A2A  4E87 3BA0 5F90 37BB 8EE7 

  > -----Original Message----- 
  > From: Paul Schmehl [mailto:pauls () utdallas edu] 
  > Sent: Wednesday, February 12, 2003 1:26 PM 
  > To: Full-Disclosure 
  > Subject: [Full-disclosure] Unusual request 
  > 
  > 
  > The net is filled with so much junk now, it's getting harder to find 
  > what you need.  I am looking for an exploit that will give 
  > you "root" on 
  > an unpatched IIS box by simply typing a string in the address line in 
  > your browser.  I know I've seen it before, but I can't seem to find it 
  > amongst all the vulns for IIS and all the web logs that show 
  > up when you 
  > google. 
  > 
  > I need this for a "security roadshow" that we're putting 
  > together, so I 
  > can demonstrate how easy it is to break in to an unpatched box.  Can 
  > anybody point me in the right direction? 
  > 
  > I don't want exploit code.  This is just a simple string that 
  > you enter 
  > into the URL box in a browser.  It's at least two or three 
  > years old, I 
  > know. 
  > 
  > -- 
  > Paul Schmehl (pauls () utdallas edu) 
  > Adjunct Information Security Officer 
  > The University of Texas at Dallas 
  > http://www.utdallas.edu/~pauls/ 
  > AVIEN Founding Member 
  > 
  > _______________________________________________ 
  > Full-Disclosure - We believe in it. 
  > Charter: http://lists.netsys.com/full-disclosure-charter.html 
  >