What will the following URL produce in an unpatched IIS Web Server? co%af../..%co%af../windows/system32/cmd.exe?/c+dir+c:\

Question

Options

• ADirectory listing of C: drive on the web server
• BExecute a buffer flow in the C: drive of the web server
• CDirectory listing of the C:\windows\system32 folder on the web server
• DInsert a Trojan horse into the C: drive of the web server

• A
  90% (27)
• C
  7% (2)
• D
  3% (1)

Explanation

This is the famous IIS Unicode Directory Traversal vulnerability (CVE-2000-0884). The string %c0%af is an overlong UTF-8 encoding that decodes to a forward slash (/). Unpatched versions of IIS failed to normalize this encoding before processing the path, allowing attackers to use ../ sequences disguised as ..%c0%af to traverse outside the web root. The payload navigates up the directory tree to reach cmd.exe and executes 'dir c:', which lists the contents of the C: drive. This is not a buffer overflow, does not target system32 specifically, and does not insert a Trojan - it performs remote command execution via directory traversal.

No community discussion yet for this question.