Re: Pen on IIS with webroot not on C

On Wed, 2003-03-12 at 10:54, A. Caruso wrote:

> Most of the tools depend on the default install of IIS with webroot on
> c:. I've moved webroot to d: on my toybox and haven't been able to
> jump back to c: to get a shell (cmd). Does anyone know of a mechanism
> to "jump" file systems.

>From unicoder.pl :
 

my @cdirs = qw (/scripts/ /msadc/ /iisadmpwd/ /_vti_bin/ /exchange/ /cgi-bin/ /pbserver/ /);

So, we're here looking for some common directories, often located on the C: and whith the "exec" flag. And you need to find a directory located on a filesystem with interesting binaires, like cmd.exe

You can't swap from disk to disk, because you're exploiting a "directory transversal sploit", and there's no root directory (aka /) in the Windows world.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Regards,

-- 
Nicolas Gregoire ----- Consultant en Sécurité des Systèmes d'Information
ngregoire(at)exaprobe.com ------[ ExaProbe ]------ 
http://www.exaprobe.com/
PGP KeyID:CA61B44F  FingerPrint:1CC647FF1A55664BA2D2AFDACA6A21DACA61B44F