Re[2]: [Xitami] Security Issue - Disabling Script Processing

[Rob @ BMM]

Paul, Thx for the informative info and advice.

Best Regards,
Rob Allen
President, Blue Marble Meds LLC.  Offering 30-75% off Prescription Meds
See us at http://www.BlueMarbleMeds.com


-----Original Message-----
From: xitami-admin@lists.xitami.org
[mailto:xitami-admin@lists.xitami.org]On Behalf Of Paul Reid
Sent: Wednesday, January 15, 2003 12:08 PM
To: Rob @ BMM
Subject: Re[2]: [Xitami] Security Issue - Disabling Script Processing



> Xitami allows this kind of script processing to occur.

How do you know the scripts are actually running?

The 200 response only means Xitami was happy with what it did. That
does not prove it did what the hacker hoped.

Also, isn't the response length -1 for all of these?

Those requests are illegally encoded. In IIS, they invoke a bug in
IIS's URL decoder. In Xitami they are trimmed-off at the illegal
point and what is left is handled. For most CodeRed hacks, this is
either the root default or a subdirectory you probably don't have.

Take one of those hacks and try it yourself.

http://myserver.edu/scripts/..%%35c../winnt/system32/cmd.exe?/c+dir

Gives me a Not Found.


On the tftp one, edit it to a script of your choice. Like a HIT_ME.BAT file:

 echo "you got me!" >> hit_me.txt

/scripts/..%%35%63../winnt/system32/cmd.exe?/c+hit_me%20-i%20208.179.58.54%2
0G
ET%20cool.dll%20e:\httpodbc.dll HTTP/1.0"

If the cmd.exe?/c+hit_me hack works, it will append to hit_me.txt.
You will find that it does NOT work under Xitami (nor even under a
properly patched IIS).

 -PRR



--
Xitami Users Mailing List -- For Xitami support
To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami