Re: Pen on IIS with webroot not on C

From: Nicolas Gregoire (ngregoire@exaprobe.com)
Date: Wed Mar 12 2003 - 17:47:15 EST

Next message: Chris McNab: "Re: Pen on IIS with webroot not on C"
Previous message: Gary Nugent: "HW/SW Rogue AP Wireless Detection"
In reply to: A. Caruso: "Pen on IIS with webroot not on C"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

On Wed, 2003-03-12 at 10:54, A. Caruso wrote:

> Most of the tools depend on the default install of IIS with webroot on
> c:. I've moved webroot to d: on my toybox and haven't been able to
> jump back to c: to get a shell (cmd). Does anyone know of a mechanism
> to "jump" file systems.

>From unicoder.pl :

my @cdirs = qw (/scripts/ /msadc/ /iisadmpwd/ /_vti_bin/ /exchange/
/cgi-bin/ /pbserver/ /);

So, we're here looking for some common directories, often located on the
C: and whith the "exec" flag. And you need to find a directory located
on a filesystem with interesting binaires, like cmd.exe

You can't swap from disk to disk, because you're exploiting a "directory
transversal sploit", and there's no root directory (aka /) in the
Windows world.

Regards,

-- 
Nicolas Gregoire ----- Consultant en Sécurité des Systèmes d'Information
ngregoire@exaprobe.com ------[ ExaProbe ]------ http://www.exaprobe.com/
PGP KeyID:CA61B44F  FingerPrint:1CC647FF1A55664BA2D2AFDACA6A21DACA61B44F

application/pgp-signature attachment: This is a digitally signed message part

Next message: Chris McNab: "Re: Pen on IIS with webroot not on C"
Previous message: Gary Nugent: "HW/SW Rogue AP Wireless Detection"
In reply to: A. Caruso: "Pen on IIS with webroot not on C"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:30 EDT