 | | |
Retina vs. IIS4, Round 2 - The Exploit
We contemplated releasing this exploit and decided to do it after Microsoft neglected to give it the attention it deserves. After the fifth day of reporting the bug to Microsoft, they stopped responding to our eMails. On the 8th day we felt that it was our duty to make our voice heard.
Here Is Why.
We are a full disclosure security team, and we were not working under any non disclosure agreements with anyone. Our responsibility to our clients and the whole network community is to disclose as many details as possible, this is how other developers can pick up where we stopped and explore the exploit in different directions, this is the way we can contribute to the security community and keep software vendors working hard at producing more robust products. This exploit demonstrates the
seriousness of the hole, YES this is a very serious hole and needs to be given the attention it deserves. If our team starts hiding the facts, we'll be no better than a software vendor that rushes insecure products to market. So here it goes... | | | The Target:
Lets say for this example we are targeting some random fortune 500 company. Take your pick. We want to pretend this company has some "state of the art" security. They are locked down behind a Cisco Pix, and are being watched with the best of Intrusion Detection software. The server only allows inbound connections to port 80.
Let's Dance.
We've crafted our exploit to overflow the remote machine and download and execute a
trojan from our web server. The trojan we are using for this example is, ncx.exe. Ncx.exe is a hacked up version of netcat.exe. The hacked up part of this netcat is that it always passes -l -p 80 -t -e cmd.exe as its argument. That basically means netcat is always going to bind cmd.exe to port 80. The exe has also been packed slightly to make it smaller. Instead of a 50k footprint its 31k. So we run our exploit:
|
| |
|
|
