Description
This module will execute an arbitrary payload on a Microsoft IIS installation that is vulnerable to the CGI double-decode vulnerability of 2001.
This module has been tested successfully on:
Windows 2000 Professional (SP0) (EN); Windows 2000 Professional (SP1) (AR); Windows 2000 Professional (SP1) (CZ); Windows 2000 Server (SP0) (FR); Windows 2000 Server (SP1) (EN); and Windows 2000 Server (SP1) (SE).
Note: This module will leave a Metasploit payload exe in the IIS scripts directory.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/windows/iis/ms01/026_dbldecodemsf undefined(026_dbldecode) > show actions ...actions...msf undefined(026_dbldecode) > set ACTION < action-name >msf undefined(026_dbldecode) > show options ...show and set options...msf undefined(026_dbldecode) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub