I. 背景
---------------------
"IIS is a web server application and set of
feature extension modules created by Microsoft for use with Microsoft Windows.
IIS is the third most popular server in the world." (Wikipedia)
II. 概述
---------------------
Vulnerability Research Team discovered a vulnerability
in Microsoft IIS.
The vulnerability is caused by a tilde character "~" in a Get request, which could allow remote attackers
to diclose File and Folder names.
III. 影响产品
---------------------------
IIS 1.0, Windows NT 3.51
IIS 2.0, Windows NT 4.0
IIS 3.0, Windows NT 4.0 Service Pack 2
IIS 4.0, Windows NT 4.0 Option Pack
IIS 5.0, Windows 2000
IIS 5.1, Windows XP Professional and Windows XP Media Center Edition
IIS 6.0, Windows Server 2003 and Windows XP Professional x64 Edition
IIS 7.0, Windows Server 2008 and Windows Vista
IIS 7.5, Windows 7 (error remotely enabled or no web.config)
IIS 7.5, Windows 2008 (classic pipeline mode)
Note: Does not work when IIS uses .Net Framework 4.
IV. Binary Analysis & Exploits/PoCs
---------------------------------------
Tilde character "~" can be used to find short names of files and folders when the website is running on IIS.
The attacker can find important file and folders that they are not normaly visible.
In-depth technical *** ysis of the vulnerability and a functional exploit
are available through:
http://soroush.secproject.com/blog/2012/06/microsoft-iis-tilde-character-vulnerabilityfeature-short-filefolder-name-disclosure/
V. 解决方案
----------------
There are still workarounds through Vendor and security vendors.
Using a configured WAF may be usefull (discarding web requests including the tilde "~" character).
本文导读目录: 1、看门狗1和2有联系吗,主角是同一个人吗 2、看门狗2完成黑客挑战任务怎么做 3、看门狗2黑客入侵怎么玩 黑客入侵玩法攻略 4、《看门狗2》黑客入侵怎么玩 5、看门狗...
11月1日0点整,京东 11.11 全民热爱季大狂欢正式开启。乍一开场,京东平台各项数据就都呈现爆发式增长,其中京东拍卖作为“新型”购物捡漏好去处,也收获傲人战绩。 据京东数据显示,截至至11...
怎样窃听老婆的微信(怎么监视老婆的微信聊天记录)相信很多人和小编一样,一打开手机的电池统计情况,排在第一位百思特网的总是微信,这当然不是说微信耗电严重,而是说我们已经越来越依赖这款App,每天花在上面...
23. 是否一定要打印报名信息表? 报考点或招生单位要求打印就必须打印,建议打印或保存。若无打印条件,一定要记住报名号或将该页面信息保存。 24. 考生来源分类如何选择? 可选择科学研究人员,高...
逐日迟早、人体各个部位及男女之间的体温均存在着差别。人体正常体温有一个较不变的范畴,但并不是恒定稳定的。正凡人口腔温度(又称口温)为36.2℃~37.2℃,腋。 你说反了,人体别丹的温度是相对...
最强蜗牛是最近上线的一个很火的游戏,游戏中为大家准备了很多的活动,目前呢是开服活动,开服活动也即将结束,之后会有全新的活动。开服活动结束后就会进入活动周的轮换时间,不少玩家还不了解活动周。那么活动周怎...