https://www.exploit-db.com/exploits/19908
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200005-043

IIS是一款WindowsNT/2000系统自带的的Web服务器软件，由Microsoft公司开发维护。IIS支持对一些特定文件名后缀(如.ASP、.IDC、.HTR)的文件请求执行进一步的处理，当服务器接到此类文件的请求时，每种后缀的文件由一个特定的DLL文件处理。ISM.DLL用于处理.HTR、.STM、.IDC为后缀的文件请求。Cerberus安全小组发现微软的IIS4/5存在一个缺陷，允许攻击者访问那些本来无权访问的文件。比如/scripts目录下的文本文件(.txt、.log、.ini)通常是不可访问的，因为这个虚拟目录只有执行权限。利用这个缺陷，就有可能访问得到这些文本文件的内容。通过给IIS提供一个特殊格式的请求，有可能获得这些文件的内容。提供一个请求，文件名后跟随大约230个空格(+或者%20)，以.htr做后缀，于是IIS认为客户端正在请求一个.htr文件。.htr扩展文件被映射成ISM.DLLISAPI应用程序，IIS会重定向所有针对.htr资源的请求到ISM.DLL，ISM.DLL打开这个文件并执行之。但是在这样做之前，ISM.DLL会截断送给自己的缓冲区内容，去掉.htr后缀以及结尾的空格，于是我们想访问的文件内容被返回。这种攻击只能进行一次，直到WWW服务重启，将无法进行第二次攻击。此外，如果已经提交过一个.htr请求给目标主机，攻击也会失败。这个缺陷仅仅在ISM.DLL被调入内存后的第一时刻有效。

source: http://www.securityfocus.com/bid/1193/info

Requesting a known filename with the extension replaced with .htr preceeded by approximately 230 "%20" (which is an escaped character that represents a space) from Microsoft IIS 4.0/5.0 will cause the server to retrieve the file and its contents. This is due to the .htr file extension being mapped to ISM.DLL ISAPI application which redirects .htr file requests to ISM.DLL. ISM.DLL removes the extraneous "%20" and replaces .htr with the proper filename extension and reveals the source of the file. This vulnerability is similar to a more recently discovered variant, BugTraq ID 1488. 

This action can only be performed if a .htr request has not been previously made or if ISM.DLL is loaded into memory for the first time. If an .htr request has already been made, a restart of the web server is necessary in order to perform another.

http://target/filename%20(repeated approx 230 times).htr

来源:XF
名称:iis-ism-file-access(4448)
链接:http://xforce.iss.net/static/4448.php
来源:BID
名称:1193
链接:http://www.securityfocus.com/bid/1193
来源:MS
名称:MS00-031
链接:http://www.microsoft.com/technet/security/bulletin/ms00-031.mspx
来源:BUGTRAQ
名称:20000511Alert:IISism.dllexposesfilecontents
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=95810120719608&w;=2
来源：NSFOCUS
名称：519
链接：http://www.nsfocus.net/vulndb/519