Re: PHP Exploitation

Hi all, as i told you, i am not able to run system, exec, passthru,
etc, i mean, all related to cmd.exe execution because of IIS
IUSR_MACHINE User privileges.

I have finished the assessment and i would like to share what i did at
the final:

As i told you, i was able to upload files directly to the windows
filesystem due to another vulnerability, but i cant execute any
command related to cmd.exe: dir, ipconfig, type, net, etc, etc, but i
do can execute php files, then i upload a list.php script in order to
walkthrough the filesystem, then, i was able to download all the app
php site and after looking inside the source code, i found some MSSQL
users and passwords with low privileges, and in other filesystem
directories i found log files, conf files, backups, etc, i mean very
interesting information to deal with.

Maybe, i could start trying to elevate privileges on MSSQL in order
to execute xp_cmdshell or something like that, but i think i have what
really matters to attackers...and what should matter to Companies...
"INFORMATION".

Thanks all for your help.

On Nov 27, 2007 7:07 AM, Robin Wood <dninja@xxxxxxxxx> wrote:
On 23/11/2007, Danux <danuxx@xxxxxxxxx> wrote:
Hi experts, i need your ideas,

By now, i am able to upload php files to a Windows 2003 Server, so i
can execute php code like phpinfo, but i cant execute passthru command
because of lack of IUSR_MACHINE privileges.
I have run some local php bof's without success.

Have you tried other ways to execute commands such as system or exec?
If you can get one of those working you can redirect output to a file
in the document root then view it by browsing to it.

Robin




--
Danux, CISSP
Chief Information Security Officer
Macula Security Consulting Group
www.macula-group.com

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • Re: IIS 6.0 on Windows Server 2003
    ... If PHP insists on using CMD.EXE to execute the shellcommand on the ... server, then no, you have no choice -- you must give read permissions to the ... this would be a security vulnerability caused by PHP. ...
    (microsoft.public.inetserver.misc)
  • Re: Function execution before page reload
    ... browser. ... Interaction between PHP and the browser is one-way - the PHP ... > In the short example above does the script execute the function BEFORE ... The server receives information from the browser and sends html back to the ...
    (comp.lang.php)
  • Re: Function execution before page reload
    ... if ){printf("Can't connect to MySQL Server. ... browser. ... Interaction between PHP and the browser is one-way - the PHP ... > In the short example above does the script execute the function BEFORE ...
    (comp.lang.php)
  • Re: [PHP] Safe includes?
    ... Using include for this is potentially dangerous since it will execute any PHP code contained within the file. ... I had a similar problem with a shareware Macintosh application I wrote where I wanted the resources to remain "intact" -- I didn't want someone changing the resource so that information about payments would be sent to them instead of me. ... the script is running as has write permission to the directory then it's going to be able to write whatever it wants. ...
    (php.general)
  • Re: refresh problem
    ... Erwin Moller wrote: ... It loos like you are mixing PHP and JS in a bad way. ... PHP delivers HTML to an internetbrowser. ... This will execute your drawNode function, every time the script is executed. ...
    (comp.lang.php)