Re: Directory Transversal

you will only be able to get the PUT command to work on directories
that the web server service has write permissions on.

What you might be able to try is the following on something like the
IE6 browser.

http://mycomputer:port#/..//..//..//..//..//..//..//windows/system32/cmd.exe?ipconfig+/all+>+/windows/inetpub/wwwroot/ipconfig.txt

This will attempt to pass a command to the cmd.exe program and execute
ipconfig /all, the result of which will be placed into a text file in
the windows/inetpub/wwwroot/ directory so you can web browse to it.
You can then try other things with cmd.exe, be imaginative.

This is a very old vulnerability and may not work properly, but if you
can see the contents of win.ini, then there is a good chance. I'm
actually a little surprised that the double forward slash is working
and that you have not had to replace it with unicode etc.

al the best,

lee lawson

On 10/17/07, jfvanmeter@xxxxxxxxxxx <jfvanmeter@xxxxxxxxxxx> wrote:

Hello everyone, I'm in the middle of a test on a app that the following command works on
http://mycomputer:port#/..//..//..//..//..//..//..//windows/win.ini
and it will prompt me to save the file, if i check my packet capture I see the contents of the file.

So far I've been unable to get a put or post command to work and was hoping to get some ideas from you all on things to try.

I've been trying to get nc/telnet and some other tools to help me with the put comand

Thanks in advance --John

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------




--
Lee J Lawson
leejlawson@xxxxxxxxx

"Give a man a fire, and he'll be warm for a day; set a man on fire,
and he'll be warm for the rest of his life."

"Quidquid latine dictum sit, altum sonatur."

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • Re: How Necessary is an Agent?
    ... writing or to writing in general. ... She threw it on the fire, and, even ... Duinn I command The Morrigan. ... woman's voice, but deep and guttural. ...
    (rec.arts.sf.composition)
  • Re: Need help updating access db
    ... use parameters instead...this is a big potential risk ... will ever fire... ... command, added to fire the insert command and deleted to fire the delete ... > Sub Page_Load ...
    (microsoft.public.dotnet.general)
  • Re: Question rephrazed - is there a to dynamically alter a Forms Post?
    ... A Command Button will always post back when you click it. ... fire on the server depends on what you clicked and how your event delegates ... >Sorry for the confusion, I'm learning the intracacies of .NET as I go. ... >fire a single event handler and differentiate based on the Command ...
    (microsoft.public.dotnet.framework.aspnet.webcontrols)
  • QueryStatus not firing
    ... I'm having a problem with in that QueryStatus does not seem to fire ... I have a command in the item and code window context menu that is ... When I set a breakpoint in the first line of code inside QueryStatus, ... vsCommandStatusTextWanted neededText, ref vsCommandStatus status, ref ...
    (microsoft.public.vsnet.ide)
  • Re: call a proc from c
    ... is it possible to launch a tcl procedure (fire) containing tk command from c. ...
    (comp.lang.tcl)