[PEN-TEST] IIS %c1%1c remote command execution

[Critical Watch Bugtraqqer <bugtraq () CRITICALWATCH COM>]

Hello all

Been playing around with this vulnerability.  Obviously anyone who has place
thier inetpub directory on the system drive is in serious trouble.  However,
I haven't been able to find a use for this if the web site is on a separate
drive.  Ok, sure if there is a sample page that allows you to cruise around
folders and look for interesting executables, or maybe perl.exe in the
cgi-bin, you could use this exploit. But what else?  Any thoughts?

Thanks in advance,
Nelson Bunker
Critical Watch