Re[2]: [Xitami] Security Issue - Disabling Script Processing

[Paul Reid]

> Xitami allows this kind of script processing to occur.

How do you know the scripts are actually running?

The 200 response only means Xitami was happy with what it did. That
does not prove it did what the hacker hoped.

Also, isn't the response length -1 for all of these?

Those requests are illegally encoded. In IIS, they invoke a bug in
IIS's URL decoder. In Xitami they are trimmed-off at the illegal
point and what is left is handled. For most CodeRed hacks, this is
either the root default or a subdirectory you probably don't have.

Take one of those hacks and try it yourself.

http://myserver.edu/scripts/..%%35c../winnt/system32/cmd.exe?/c+dir

Gives me a Not Found.


On the tftp one, edit it to a script of your choice. Like a HIT_ME.BAT file:

 echo "you got me!" >> hit_me.txt

/scripts/..%%35%63../winnt/system32/cmd.exe?/c+hit_me%20-i%20208.179.58.54%20G
ET%20cool.dll%20e:\httpodbc.dll HTTP/1.0"

If the cmd.exe?/c+hit_me hack works, it will append to hit_me.txt.
You will find that it does NOT work under Xitami (nor even under a
properly patched IIS).

 -PRR