Rapid7 Vulnerability & Exploit Database

MS02-018 Microsoft IIS 4.0 .HTR Path Overflow

Back to Search

MS02-018 Microsoft IIS 4.0 .HTR Path Overflow



This exploits a buffer overflow in the ISAPI ISM.DLL used to process HTR scripting in IIS 4.0. This module works against Windows NT 4 Service Packs 3, 4, and 5. The server will continue to process requests until the payload being executed has exited. If you've set EXITFUNC to 'seh', the server will continue processing requests, but you will have trouble terminating a bind shell. If you set EXITFUNC to thread, the server will crash upon exit of the bind shell. The payload is alpha-numerically encoded without a NOP sled because otherwise the data gets mangled by the filters.


  • stinko <vinnie@metasploit.com>




Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/windows/iis/ms02_018_htr
msf exploit(ms02_018_htr) > show targets
msf exploit(ms02_018_htr) > set TARGET < target-id >
msf exploit(ms02_018_htr) > show options
    ...show and set options...
msf exploit(ms02_018_htr) > exploit

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security