Penetration Testing mailing list archives
Re: Directory Transversal
From: "Lee Lawson" <leejlawson () gmail com>
Date: Thu, 18 Oct 2007 11:32:02 +0100
you will only be able to get the PUT command to work on directories that the web server service has write permissions on. What you might be able to try is the following on something like the IE6 browser. http://mycomputer:port#/..//..//..//..//..//..//..//windows/system32/cmd.exe?ipconfig+/all+>+/windows/inetpub/wwwroot/ipconfig.txt This will attempt to pass a command to the cmd.exe program and execute ipconfig /all, the result of which will be placed into a text file in the windows/inetpub/wwwroot/ directory so you can web browse to it. You can then try other things with cmd.exe, be imaginative. This is a very old vulnerability and may not work properly, but if you can see the contents of win.ini, then there is a good chance. I'm actually a little surprised that the double forward slash is working and that you have not had to replace it with unicode etc. al the best, lee lawson On 10/17/07, jfvanmeter () comcast net <jfvanmeter () comcast net> wrote:
Hello everyone, I'm in the middle of a test on a app that the following command works on http://mycomputer:port#/..//..//..//..//..//..//..//windows/win.ini and it will prompt me to save the file, if i check my packet capture I see the contents of the file. So far I've been unable to get a put or post command to work and was hoping to get some ideas from you all on things to try. I've been trying to get nc/telnet and some other tools to help me with the put comand Thanks in advance --John ------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------
-- Lee J Lawson leejlawson () gmail com "Give a man a fire, and he'll be warm for a day; set a man on fire, and he'll be warm for the rest of his life." "Quidquid latine dictum sit, altum sonatur." ------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------
Current thread:
- Directory Transversal jfvanmeter (Oct 18)
- Re: Directory Transversal Lee Lawson (Oct 19)
- Re: Directory Transversal Zed Qyves (Oct 19)
- Re: Directory Transversal pand0ra (Oct 19)
- <Possible follow-ups>
- Re: Directory Transversal jfvanmeter (Oct 19)
- RE: Directory Transversal jfvanmeter (Oct 19)
- re: Directory Transversal Sat Jagat Singh (Oct 19)
- Re: Directory Transversal jfvanmeter (Oct 19)
- RE: Directory Transversal Walsh, Leo (Oct 19)
- Re: Directory Transversal jfvanmeter (Oct 23)
- Re: Directory Transversal Zed Qyves (Oct 24)