Penetration Testing: Re: clue on shell

["rajat swarup" <rajats () gmail com>]

On Mon, Jan 5, 2009 at 1:59 PM, Ricardo Mourato <ricardomcm () gmail com> wrote:
> i pentesting people, i've got a shell in a customers server, using an
> webapp bug (eval() is evil()) :)
> the server seems to run windows 2003 server, it's known that IIS6 "had
> many security improvments", such as disabling the cmd.exe for the IIS
> user, that's why i have used the old fashion "command.com" and voila,
> i've got a shell, but it is very limited, i'm trying to upload some
> programs, in order to get a better shell and get admin rights, btw the
Setup an FTP server and try accessing it from command.com.  It should work.
-- 
Rajat Swarup

http://rajatswarup.blogspot.com/