rapid7/metasploit-framework — pull request #4124 by wchen-r7 (2014-11-03 20:20:32+00:00)
Title: Fix #4115 - iis_webdav_upload_asp.rb should support http auth

HTTP auth is already implemented in Rex so there is really no point to say it can't do it. I also changed the error/warning messages to be more informative about why the module fails.

## Setup for verification

- [ ] Windows XP SP3
- [ ] IIS 5.1. If you don't have this, you can install it from the Windows Components Wizard.
- [ ] For testing purposes, make sure no firewall
- [ ] After the IIS installation, create a folder in C:\Inetpub\wwwroot\upload
- [ ] Make sure you know the password for the default Windows user (which I think is Administrator). Set one if it's blank: ```net user Administrator [password]``` in command prompt.

## Verification 1: Test without auth

- [ ] Start msfconsole
- [ ] ```use exploits/windows/iis/iis_webdav_upload_asp```
- [ ] ```set rhost [IP]```
- [ ] ```set path /upload/test.asp```
- [ ] ```run```
- [ ] You should get a session

- [ ] When you're done with this test, make sure to remove C:\Inetpub\wwwroot\upload\test.asp for the next test.

## Verification 2: Test with authentication

In order to test authentication, you need to Administrative Tools -> Internet Information Services and configure a few things:

- [ ] Right click on the 'upload' folder, go to Properties
- [ ] Click on the 'Directory Security' tab
- [ ] Click on 'Edit' under 'Anonymous access and authentication control'
- [ ] Uncheck 'Anonymous access'
- [ ] Check 'Integrated Windows authentication'

Under the same Properties dialog, you should also see the "Directory" tab. Also make sure to enable:

- [ ] Script source access
- [ ] Read
- [ ] Write

Ok, then you're ready to test:

- [ ] Start msfconsole
- [ ] ```use exploits/windows/iis/iis_webdav_upload_asp```
- [ ] ```set rhost [IP]```
- [ ] ```set path /upload/test.asp```
- [ ] ```set username [valid username]```
- [ ] ```set password [valid password]```
- [ ] ```run```
- [ ] You should get a session

If you want, you can also test with a bad username/password too. In that case, you should see "401 Access Denied" when the module tries to upload the ASP file.

- [ ] When you're done with this test, make sure to remove C:\Inetpub\wwwroot\upload\test.asp for the next test.

## Verification 3: Script source access permission

Before you test this, make sure that:

- [ ] You are still using the same auth instructed from Verification 2
- [ ] Back to your IIS manager, right click on the 'upload' folder -> Properties
- [ ] Make sure the "Script source access" is unchecked.
- [ ] This time, your exploit will fail, and you should see this message: "The MOVE verb failed to rename the file. Possibly IIS doesn't allow 'Script Resource Access'."

## Verification 3: Read permission

- [ ] Still the same auth from Verification 2
- [ ] This time, make sure 'Read' is unchecked. (but the other two such as "Script source access" and "write" should be checked)
- [ ] Run the exploit, and you should see: "IIS possibly does not allow 'Read' permission"

## Verification 4: Write permission

- [ ] Still the same auth from Verification 2
- [ ] This time, make sure 'Write' is unchecked. (but the other two such as "Script source access" and "read" should be checked)
- [ ] Run the exploit, and you should see: "It's possible either you set the PATH option wrong, or IIS doesn't allow Write permission"