Penetration Testing mailing list archives
Re: privelege escalation with .bat files
From: "Christian Bauer" <Pixxxel () web de>
Date: Tue, 25 Apr 2006 08:34:46 +0200
If the .bat file could be executed, services like telnet etc can be startet, or users maybe added. On desktop systems (or stuff like that) were the user isnt allowed to use the Dos-shell but writing .bat files it is easy to execute system cmds. Christian Bauer -----Ursprüngliche Nachricht----- Von: pen-test-return-1078480472-Pixxxel=web.de () securityfocus com [mailto:pen-test-return-1078480472-Pixxxel=web.de () securityfocus com] Im Auftrag von Ben Greenberg Gesendet: Montag, 24. April 2006 18:26 An: pen-test () securityfocus com Betreff: privelege escalation with .bat files Hi. I'm pen-testing an IIS 5.0 server that is insecurely set up to allow write-access to it as a web folder. However, its also set up to deny copying (or renaming to) of the following file extensions .asp, .com, .cmd, .exe, and .dll. Interestingly, it does allow .bat files to be written onto the server. Is there a way to escalate privelleges (and possibly get a command prompt) through a .bat file? Thank you, --ben ---------------------------------------------------------------------------- -- This List Sponsored by: Cenzic Concerned about Web Application Security? Why not go with the #1 solution - Cenzic, the only one to win the Analyst's Choice Award from eWeek. As attacks through web applications continue to rise, you need to proactively protect your applications from hackers. Cenzic has the most comprehensive solutions to meet your application security penetration testing and vulnerability management needs. You have an option to go with a managed service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). Download FREE whitepaper on how a managed service can help you: http://www.cenzic.com/news_events/wpappsec.php And, now for a limited time we can do a FREE audit for you to confirm your results from other product. Contact us at request () cenzic com for details. ---------------------------------------------------------------------------- -- ------------------------------------------------------------------------------ This List Sponsored by: Cenzic Concerned about Web Application Security? Why not go with the #1 solution - Cenzic, the only one to win the Analyst's Choice Award from eWeek. As attacks through web applications continue to rise, you need to proactively protect your applications from hackers. Cenzic has the most comprehensive solutions to meet your application security penetration testing and vulnerability management needs. You have an option to go with a managed service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). Download FREE whitepaper on how a managed service can help you: http://www.cenzic.com/news_events/wpappsec.php And, now for a limited time we can do a FREE audit for you to confirm your results from other product. Contact us at request () cenzic com for details. ------------------------------------------------------------------------------
Current thread:
- privelege escalation with .bat files Ben Greenberg (Apr 24)
- Re: privelege escalation with .bat files bookworm (Apr 25)
- Re: privelege escalation with .bat files Ben Greenberg (Apr 25)
- Re: privelege escalation with .bat files Christian Bauer (Apr 25)
- <Possible follow-ups>
- Re: privelege escalation with .bat files joshuaperrymon (Apr 25)
- Re: privelege escalation with .bat files Michael Hendrickx (Apr 26)
- RE: privelege escalation with .bat files Maudite (Apr 26)
- RE: privelege escalation with .bat files Rich (Apr 27)
- Re: privelege escalation with .bat files Maudite MLRL (Apr 27)
- RE: privelege escalation with .bat files Ben Greenberg (Apr 27)
- Re: privelege escalation with .bat files Maudite MLRL (Apr 28)
- RE: privelege escalation with .bat files Maudite (Apr 26)
- Re: privelege escalation with .bat files bookworm (Apr 25)
- Re: privelege escalation with .bat files Nicolas RUFF (Apr 28)