IIS执行任意命令漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1105248 漏洞类型 未知
发布时间 1996-03-01 更新时间 2006-11-16
CVE编号 CVE-1999-0233 CNNVD-ID CNNVD-199602-004
漏洞平台 Windows CVSS评分 10.0
|漏洞来源
https://www.exploit-db.com/exploits/20445
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-199602-004
|漏洞详情
IIS1.0版本存在漏洞。用户使用.bat或.cmd文件执行任意命令。
|漏洞EXP
IIS 1.0,Netscape Commerce Server 1.0/Communications Server 1.12,OReilly Software WebSite Professional 1.1 b BAT/.CMD Remote Command Execution

source: http://www.securityfocus.com/bid/2023/info

Some web servers that allow batch files to be executed via CGI are vulnerable to an attack whereby an intruder can execute commands on the target machine. This can be accomplished by submitting the command to be executed as a variable preceded by the ampersand (&) symbol, eg. http://targethost/cgi-bin/batfile.bat?&hostile_command. This apparently causes the server to call the function: system("batfile.bat &hostile_command") which the command interpreter interprets as separate commands. Microsoft IIS 1.0 is vulnerable to this attack whether or not the .BAT file requested even exists. Successfully exploiting this vulnerability allows an attacker to execute commands on the target machine with the privileges of the web server. This vulnerability may also be exploited via . CMD files. 

A request similar to the following is used to exploit this:

http://targethost/cgi-bin/test.bat?&dir

Variations may be possible or necessary, depending on the specific web server and configuration.
|参考资料

来源:MSKB
名称:Q155056
链接:http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;Q155056
来源:MSKB
名称:Q148188
链接:http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;Q148188