Windows and IIS

[Maceo <maceo () DOGMILE COM>]

In response to the numerous emails I have received in regards to the
proof of concept code I published for BugtraqID: 1535  (Windows 2000
Services Named Pipe Vulnerability)  I have published two variants
of the original code:

  The PipeUpSAM variation dumps the local SAM database to stdout in the
  standard PwdDump.exe format.  The generated file may then be used with
  any NT MD4 password cracker, such as L0phtCrack.

  The PipeUpAdmin variation adds the current user account to the local
  Administrators group.

The binaries are available at:

  http://www.dogmile.com/files/


Also, in response the numerous emails I have received in regards to
the CmdAsp.asp code that I posted to bugtraq, I have better documented
this escalation of privileges vulnerability.  The details follow, and
can also be found at:

  http://www.dogmile.com/files/#CmdAsp


  -Maceo


-----


CmdAsp

  Author:       Maceo <maceo @ dogmile.com>
  Release:      2000-12-01
  Type:         Local/remote exploit (*See Requirements*)
  Requirements: Ability to create an ASP file in a web directory
  ToolType:     Interactive cmd tool
  OS:           Windows NT/2000 (IIS 4.0 and IIS 5.0)

  Source:  <++ CmdAsp.asp ++>

  DISCUSSION:

  During normal webserver operations IIS, by default, impersonates the
  account IUSR_COMPUTER.  This account has minimal access rights.  However,
  because of the way IIS impersonates accounts, spawned processes inherit
  the original security context.  This can result in escalation of user
  privileges.

  Depending on the setup of an IIS server this escalation will result in
  access to the account IWAM_COMPUTER or SYSTEM.  With IIS 4.0 the account
  depends upon whether or not the web administrator has selected the "run
  in separate memory space" option.  This option is unselected by default
  and allows SYSTEM account escalation.  In IIS 5.0 the setting is called
  Application Protection.  Application Protection "Low" will result in
  SYSTEM access and Medium or High with result in IWAM_COMPUTER access.
  The default setup for IIS 5.0, "Medium", will result in IWAM_COMPUTER
  access.  Further, an IIS 4.0 webserver that was upgraded to IIS 5.0
  with the default settings will allow SYSTEM account escalation.

  It should be noted that since the IWAM_COMPUTER account can change the
  settings of the webserver, escalation to SYSTEM account access is still
  possible.

  DESCRIPTION:

  An interactive command prompt from an ASP file.  This script uses the
  Microsoft scripting object WSCRIPT.SHELL to spawn a cmd.exe process
  which will run with escalated privileges.

  BUGFIX:

  Microsoft has not released an official fix at this time.  To block
  this particular exploit, unregister the windows scripting object:
  C:\> regsvr32.exe /u C:\winnt\system32\wshom.ocx