Re: Directory Transversal

Thank You Lee,

The application I'm testing, doesn't appear to be a "full blown" web server, but a service that allows a web browser to connect, and dynamicly creates a webpage for the browser to show the state of a process, so it does responds to GET commands.

It does have a root directory but not like a normal web server.

It also seams to have problems with spaces I tried %20 but that didn't seam to work so I ended up using PROGRA~1 for Program Files and DOCUME~1 for Documents and Settings and so on.

Take Care and Have Fun --John

-------------- Original message ----------------------
From: "Lee Lawson" <leejlawson@xxxxxxxxx>
you will only be able to get the PUT command to work on directories
that the web server service has write permissions on.

What you might be able to try is the following on something like the
IE6 browser.

http://mycomputer:port#/..//..//..//..//..//..//..//windows/system32/cmd.exe?ipc
onfig+/all+>+/windows/inetpub/wwwroot/ipconfig.txt

This will attempt to pass a command to the cmd.exe program and execute
ipconfig /all, the result of which will be placed into a text file in
the windows/inetpub/wwwroot/ directory so you can web browse to it.
You can then try other things with cmd.exe, be imaginative.

This is a very old vulnerability and may not work properly, but if you
can see the contents of win.ini, then there is a good chance. I'm
actually a little surprised that the double forward slash is working
and that you have not had to replace it with unicode etc.

al the best,

lee lawson

On 10/17/07, jfvanmeter@xxxxxxxxxxx <jfvanmeter@xxxxxxxxxxx> wrote:

Hello everyone, I'm in the middle of a test on a app that the following
command works on
http://mycomputer:port#/..//..//..//..//..//..//..//windows/win.ini
and it will prompt me to save the file, if i check my packet capture I see the
contents of the file.

So far I've been unable to get a put or post command to work and was hoping to
get some ideas from you all on things to try.

I've been trying to get nc/telnet and some other tools to help me with the put
comand

Thanks in advance --John

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------




--
Lee J Lawson
leejlawson@xxxxxxxxx

"Give a man a fire, and he'll be warm for a day; set a man on fire,
and he'll be warm for the rest of his life."

"Quidquid latine dictum sit, altum sonatur."


------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • Server Error in / Application. Cant find default
    ... am trying to test the following simple program on my Web Server and I get ... Parser Error Message: ... Source Error: ... The file"default.aspx" is in my root directory on the server. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Relative and Absolute Address
    ... I recently began maintenance work on a production web server that is ... in the root directory of a web server. ... of the asp pages are in sub folders and all include the same include file. ...
    (microsoft.public.inetserver.asp.general)
  • Re: include not working on Linux/Apache server
    ... You're telling PHP to access /skin/Test.php from the root directory of your system, not your web server. ...
    (comp.lang.php)
  • Re: Hide Web Folder/ Web Files in ASP System
    ... i am uploading my "First" web server files today. ... i usually send to my clients a link for them to download a certain file ... that i upload to the root directory of my web server space. ...
    (microsoft.public.dotnet.framework.aspnet)