Pen on IIS with webroot not on C

["A. Caruso" <acaruso () houston rr com>]

Hi all:

I have been muking around with different file system traversal exploits for IIS and playing with some of the tools.  
Most of the tools depend on the default install of IIS with webroot on c:.  I've moved webroot to d: on my toybox and 
haven't been able to jump back to c: to get a shell (cmd).  Does anyone know of a mechanism to "jump" file systems.  I 
haven't been able to find anything after RFP said (in his unicode paper) the syntax doesn't exist to do this.  (I think 
that's where I saw it).
eg
GET /scripts/../../../%systemroot%/cmd.exe (insert appropriate unicode)

Short of jumping file systems, what about uploading a shell to webroot through the .ida vuln?  (I left those patches 
off for play).

Thanks.

-Tony




----------------------------------------------------------------------------

Are your vulnerability scans producing just another report?
Manage the entire remediation process with StillSecure VAM's
Vulnerability Repair Workflow.
Download a free 15-day trial:
http://www2.stillsecure.com/download/sf_vuln_list.html