Penetration Testing: Re: clue on shell

["Anthony Cicalla" <anthony.cicalla () gmail com>]

1) setup ftp with vncsetup.exe for download.
2) start vnc on your computer with ports open for ftp and vnc over port 80
3) ftp connect to your server and get the vncserversetup.exe
4) use net use and create a user
5) add user to administrators group
6) use runas and run that vncserversetup.exe as the user you created
7) start vnc via commandline to connect out to your vnc listener
8) now you have remote visual control of that box


On Mon, Jan 5, 2009 at 10:59 AM, Ricardo Mourato <ricardomcm () gmail com> wrote:
> i pentesting people, i've got a shell in a customers server, using an
> webapp bug (eval() is evil()) :)
> the server seems to run windows 2003 server, it's known that IIS6 "had
> many security improvments", such as disabling the cmd.exe for the IIS
> user, that's why i have used the old fashion "command.com" and voila,
> i've got a shell, but it is very limited, i'm trying to upload some
> programs, in order to get a better shell and get admin rights, btw the
> server is also  running plesk control panel , should i try this in a
> possible way to get admin?
>
> i know that sqlninja can upload files in debug script, i also thinked about that
> i could  echo "hex stuff" into  %TEMP%/nc.scr for example
>
> does anybondy knows how convert a binary in debug script?
>
> tnks.


-- 
Anthony,