Security Incidents mailing list archives
Re: IIS Unicode Question
From: H D Moore <hdm () SECUREAUSTIN COM>
Date: Mon, 30 Oct 2000 11:53:32 -0600
You can still gain access to the system drive by requesting files from a virtual directory that is mapped there: /msadc /iisadmpwd /iisadmin /scripts /cgi-bin /iisamples etc... Critical Watch Bugtraqqer wrote:
Leon-- Started looking at some of the .gov sites that he has recently broken into. Did a request for nonexistantfile.idq ... many of them have their websites on separate drives from the system drive. Did they move the websites after the fact/hack? Hard to tell. Gut check? Probably not. Therefore, the Unicode hole would not be effective and his claim still stands that he has a gnu hole.
Current thread:
- Re: IIS Unicode Question H D Moore (Nov 01)