RE: Unusual request

["Rapaille Max" <Max.Rapaille () nbb be>]

Hi,

I did this kind of demo 2-3 times already, with a Win2k SP2 and IIS.
To add a layer, we just added a firewall between the ISS and the attacker PC ..  with just Port 80 incoming and, as 
(too)usual, All port open for outgoing...  Just using a unicode exploit, and then loading some tools, defacing web 
page, taking remote control, etc...  A lot of fun for Us, and great astonishment for the public..  Certainly with the 
firewall..  A lot of them where just saying, before the demo : We are secure, our integrator installed a firewall...  
BTW, we also used some tools ike unicoder.pl and Upload.asp, to demonstrate, in a second time, how easy it is, even if 
you don't know what you do...

Good effect of awareness for those managers, Engineer, etc...


Good luck.

Max

-----Original Message-----
From: Schmehl, Paul L [mailto:pauls () utdallas edu] 
Sent: 13 February 2003 14:37
To: Full-Disclosure
Subject: RE: [Full-disclosure] Unusual request


Thanks to all who offered suggestions.  I don't know why I couldn't remember "unicode" when I was googling, but then 
I've read thousands of man pages and docs since then, and my mind can only hold so much information. :-)

What I plan to do is load a box with a default install of IIS and use a web browser based attack to demonstrate how 
easily a box can be compromised when it's unpatched.  (I'll probably just deface a web
page.)  Since the audience will be "normal" users, I expect most of them to be astounded and incredulous, which is why 
I wanted to use something very simple to understand.  If I ran a program through a netcat session, I suspect many of 
them wouldn't get it, but if I type a URL into a browser, I *hope* they will all see that *anyone* could do that, even 
with very little knowledge of exploits or security practices.

And before you ask, no the box will not be connected to our LAN. Otherwise it would get Code Red and Nimda before I 
could even complete my demonstration.  :-)

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas http://www.utdallas.edu/~pauls/ AVIEN Founding Member 
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html