[PEN-TEST] admin rights on an IIS 5.0 with unicode bug?

[Renato Ettisberger <renato.ettisberger () CH PWCGLOBAL COM>]

Hi,

I'm doing a pen test and I found a IIS 5.0 (Win2k) with the Unicode bug.

As you know, there is a way to span a shell with admin rights on a IIS 4.0
with the Unicode bug.
I ask me, if there is a way to gain admin rights on an IIS 5.0, Win2k with
the Unicode bug too?

If I'm able to dump the password hash in crude form, how can I crack the
password?

F:0x020020000000000000000000....
V:0x00000000a800000......

If you have any suggestions or ideas, please let me know.

regards

Renato Ettisberger

----------------------------------------------------------------
The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential and/or privileged
material.  Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited.   If you received
this in error, please contact the sender and delete the material from any
computer.