File http-iis-webdav-vuln
Download: http://nmap.org/svn/scripts/http-iis-webdav-vuln.nse
User Summary
Checks for a vulnerability in IIS 5.1/6.0 that allows arbitrary users to access secured WebDAV folders by searching for a password-protected folder and attempting to access it. This vulnerability was patched in Microsoft Security Bulletin MS09-020 http://www.microsoft.com/technet/security/bulletin/ms09-020.mspx.
A list of well known folders (almost 900) is used by default. Each one is checked, and if returns an authentication request (401), another attempt is tried with the malicious encoding. If that attempt returns a successful result (207), then the folder is marked as vulnerable.
This script is based on the Metasploit modules/auxiliary/scanner/http/wmap_dir_webdav_unicode_bypass.rb auxiliary module.
For more information on this vulnerability and script, see:
- http://blog.zoller.lu/2009/05/iis-6-webdac-auth-bypass-and-data.html
- http://seclists.org/fulldisclosure/2009/May/att-134/IIS_Advisory_pdf.bin
- http://www.skullsecurity.org/blog/?p=271
- http://www.kb.cert.org/vuls/id/787932
- http://www.microsoft.com/technet/security/advisory/971492.mspx
Script Arguments
basefolder
The folder to start in; eg, "/web" will try "/web/xxx"
folderdb
The filename of an alternate list of folders.
webdavfolder
Selects a single folder to use, instead of using a built-in list
http-max-cache-size, http.useragent, pipeline
See the documentation for the http library.Example Usage
nmap --script http-iis-webdav-vuln -p80,8080 <host>
Script Output
80/tcp open http syn-ack |_ http-iis-webdav-vuln: WebDAV is ENABLED. Vulnerable folders discovered: /secret, /webdav
Requires
author Ron Bowes and Andrew Orr
copyright © Same as Nmap--See http://nmap.org/book/man-legal.html
Functions
| get_response (host, port, folder) | Sends a PROPFIND request to the given host, and for the given folder. Returns a table reprenting a response. |
| go (host, port) | Checks a list of possible folders for the vulnerability. Returns a list of vulnerable folders. |
| go_single (host, port, folder) | Check a single folder on a single host for the vulnerability. Returns one of the enum_results codes. |
Functions
- get_response (host, port, folder)
-
Sends a PROPFIND request to the given host, and for the given folder. Returns a table reprenting a response.
Parameters
- host:
- port:
- folder:
- go (host, port)
-
Checks a list of possible folders for the vulnerability. Returns a list of vulnerable folders.
Parameters
- host:
- port:
- go_single (host, port, folder)
-
Check a single folder on a single host for the vulnerability. Returns one of the enum_results codes.
Parameters
- host:
- port:
- folder: