Rapid7 Vulnerability & Exploit Database

MS02-018 Microsoft IIS 4.0 .HTR Path Overflow

Back to Search

MS02-018 Microsoft IIS 4.0 .HTR Path Overflow

Disclosed
04/10/2002
Created
05/30/2018

Description

This exploits a buffer overflow in the ISAPI ISM.DLL used to process HTR scripting in IIS 4.0. This module works against Windows NT 4 Service Packs 3, 4, and 5. The server will continue to process requests until the payload being executed has exited. If you've set EXITFUNC to 'seh', the server will continue processing requests, but you will have trouble terminating a bind shell. If you set EXITFUNC to thread, the server will crash upon exit of the bind shell. The payload is alpha-numerically encoded without a NOP sled because otherwise the data gets mangled by the filters.

Author(s)

  • stinko <vinnie@metasploit.com>

Platform

Windows

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/windows/iis/ms02_018_htr
msf exploit(ms02_018_htr) > show targets
    ...targets...
msf exploit(ms02_018_htr) > set TARGET < target-id >
msf exploit(ms02_018_htr) > show options
    ...show and set options...
msf exploit(ms02_018_htr) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;