Penetration Testing mailing list archives
IIS : access to cmd.exe and multiple commands on one line
From: Daniel Polombo <polombo () cartel-info fr>
Date: Tue, 23 Oct 2001 10:59:12 +0200
Hello,as you all know, it's possible to exploit a number of IIS bugs to gain access to \winnt\system32\cmd.exe and execute arbitrary commands on the server. I've been trying to convince it to execute several commands on one line (as one would separate commands with a ';' under any decent shell), with limited success : on a number of NT/2k boxes, the syntax :
command1 & command2 (eg, cd .. & dir)works fine. On some other boxes, though, it only returns 'The parameter is incorrect'.
It is unclear to me whether this problem happens only because of the way the request is made (http://path/to/cmd.exe?/c+command1&command2), or if there are really different versions of cmd.exe.
I would assume the former, but I fail to see why it would work on some boxes and not others, given the same commands and commands separator.
I've tried unicode-encoding the '&', with simple and double encoding (%26 and %2526, respectively), but on the boxes which refuse plain '&', it doesn't work either.
I'd like to get this to work in order to execute several commands on a remote box in the same context (as opposed to several different connections), w/o uploading anything to the box (yet :).
Any ideas would be welcome. Regards, Daniel ---------------------------------------------------------------------------- This list is provided by the SecurityFocus Security Intelligence Alert (SIA) Service. For more information on SecurityFocus' SIA service which automatically alerts you to the latest security vulnerabilities please see: https://alerts.securityfocus.com/
Current thread:
- IIS : access to cmd.exe and multiple commands on one line Daniel Polombo (Oct 23)
- Re: IIS : access to cmd.exe and multiple commands on one line hellNbak (Oct 23)
- Re: IIS : access to cmd.exe and multiple commands on one line Rebecca Kastl (Oct 23)
- Re: IIS : access to cmd.exe and multiple commands on one line Alex Butcher (pentest) (Oct 23)
- Re: IIS : access to cmd.exe and multiple commands on one line Emre Yildirim (Oct 23)
- Re: IIS : access to cmd.exe and multiple commands on one line Rainer Duffner (Oct 24)
- Re: IIS : access to cmd.exe and multiple commands on one line Daniel Polombo (Oct 24)
- <Possible follow-ups>
- Re: IIS : access to cmd.exe and multiple commands on one line Garreth Jeremiah/Markham/IBM (Oct 24)
- RE: IIS : access to cmd.exe and multiple commands on one line Sam Steinmeyer (Oct 24)