Re: escalating IUSR to admin rights via unicode and iis4

From: Bill Pennington (billp@boarder.org)
Date: 07/11/02 

Date: Thu, 11 Jul 2002 10:18:31 -0700
To: ewvtwvi@hushmail.com
From: Bill Pennington <billp@boarder.org>

What I have done in the past is get a copy of hk.exe. It is a local
privilege escalation exploit that runs processes as SYSTEM.

Then just run netcat via hk.exe, connect to the listener, and bingo you
are SYSTEM.

It has been a while since I have done this so I don't recall the exact
syntax but that should get you pointed in the right direction.

On Tuesday, July 9, 2002, at 10:18 AM, ewvtwvi@hushmail.com wrote:

>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hello,
>
> I understand that this topic has been discussed in great deal, however
> i searched the archives and was unable to find anything.
>
> In doing a security assessment - I came across a web server running
> iis4 that is vulnerable to the unicode exploit. I was able to get it to
> tftp back to my tftp server and pull down nc and a few other
> things...then got nc listening with a shell and was able to connect to
> that shell...I didnt go any further and reported it as it was. I was
> then questioned on the possibility of it being used to escalate rights
> to administrator..and asked for a demo... i repeated the above steps,
> but was unable to stop services and such. I couldnt even delete a file
> I had uploaded using unicode with tftp.
> Could someone please point me to info that would explain what i have
> to do to
> accomplish this. I have been searching...but apparently not well enough.
>
> Again, I hope this gets through..As it has prolly been discussed very
> much. I apologize in advance for this question.. but im stuck :(
>
> Thanks much!
> t
> -----BEGIN PGP SIGNATURE-----
> Version: Hush 2.1
> Note: This signature can be verified at https://www.hushtools.com
>
> wlwEARECABwFAj0rGdkVHGV3dnR3dmlAaHVzaG1haWwuY29tAAoJEONDjIN5eMWV4yoA
> n1TdHlIf1vT//ZWzA/D9CaPaVC7bAKCyKMk5UUB8wzny2LtRDKWQNepzFw==
> =yH9p
> -----END PGP SIGNATURE-----
>
>
> Communicate in total privacy.
> Get your free encrypted email at https://www.hushmail.com/?l=2
>
> Looking for a good deal on a domain name?
> http://www.hush.com/partners/offers.cgi?id=domainpeople
>
>
> ----------------------------------------------------------------------------
> This list is provided by the SecurityFocus Security Intelligence Alert
> (SIA)
> Service. For more information on SecurityFocus' SIA service which
> automatically alerts you to the latest security vulnerabilities please
> see:
> https://alerts.securityfocus.com/
>

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/

Relevant Pages

  • RE: SQL
    ... Subject: SQL ... >> This list is provided by the SecurityFocus Security ... For more information on SecurityFocus' SIA service which ... >This list is provided by the SecurityFocus Security Intelligence Alert ...
    (Pen-Test)
  • RE: Insurance
    ... property--data beign deemed "intangible" for the purposes of insurance. ... for physical security testing there are often 3rd parties ... For more information on SecurityFocus' SIA service which ... This list is provided by the SecurityFocus Security Intelligence Alert ...
    (Pen-Test)
  • RE: Pen-Testing Lotus Notes/Domino
    ... Subject: Pen-Testing Lotus Notes/Domino ... of document security. ... This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)
  • R: Pen-Testing help (Compaq Insight & htsearch)
    ... This web server happens to be in front of their ... This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)
  • Re: Application & Iplanet/Apache web server vulnerability and penetration testing
    ... I don't know what to do on the web servers other than delete example ... Any suggestions on iPlanet and Apache security? ... > This list is provided by the SecurityFocus Security Intelligence Alert ... For more information on SecurityFocus' SIA service which ...
    (Pen-Test)