[ASP] Found Exploit - need suggestions

[whitemist]

So Ill keep this simple. There is a online game I play that is going out of business. We have some of the old server files on ragezone. On their site there is a image script that allows you to pull any files on that servers hard drive. The script goes a little something like this:

http:/xxxxxxsitesite.com/xx/img_download.asp?savepath=C:\Windows\&filename=iis6.log

that will download the iis6 log file which supplied me with the name of the machine and the admin account name.

Also it looks like you can access networked computers like such:

http://xxxxxsiteish.com/xx/img_download.asp?savepath=\\192.168.1.82\dir\dir\dir\dir\&filename=picture.jpg

Which I found if you remove the 192.168.1.82 and change it to below it works the same way:

http://xxxxxxsitesite.com/dir/dir/dir/dir/&filename=picture.jpg"

It will load the file with no issues.

Basically I want to grab some of the .asp files from the website so I can get ahold of the mssql user names and passwords. At this point all the script does is pull files, I am not aware if it does anything else but I'm up for suggestions. I was able to pull the iss6.log to find some basic information but I just don't know windows deep enough to pull anything that would really help.

I'm not going to give the name of this website out - they don't deserve to be slammed by people trying to take down their website. This is purely for keeping their game alive through a private server or open source means. This thread wasn't made for defacing or taking down their website just getting ahold of some files and since it involves a little coding I figured this would be the best place.

If not maybe extra server help...
Anyways: I tried C:\inetpub\wwwroot with index.asp and default and main but it found nothing.

Any suggestions?

 

[TimeBomb]

So we're supposed to help you with exploiting in to a website to grab files illegally?

Awesome!

Use/create a dictionary brute-forcer. Spend 30-60 minutes filling its dictionary up, line by line, with anything and everything you think would ever even possibly be used in this situation. Let it run and have it return valid URLs to you.

Since the brute forcer would only be simply accessing a website, it shouldn't be too hard to create. Finding a non-virused one that will work exactly as you want it would be extremely difficult and time consumping, thus why I suggest creating one.

How do you create one? Hehe, you're not getting that information from me .

 

[whitemist]

haha its a shot in the dark - for the most part I'm having it create a tree of whats in each directory but if it gets taken down and I get a warning - then I get a warning - might as well ask. Most of the files on this site were stolen so anyways I was hoping that someone might know if windows stores logs that would have iis path information.

edit - beyond a brute forces which your right would be hard to make just code a list of possible file paths and names and have it constantly check until the list runs out outputting the ones that come back with actual files. Makes sense...rather not code it though

 

[Hexadecimal]

C:\inetpub\vhosts\websiteName.com\httpdocs\index.asp

C:\wampp\www\index.asp

C:\xampp\htdocs\index.asp

There can be a lot more.

 

[whitemist]

thanks I'll check those

 

[s-p-n]

No insecure directories?

http:/xxxxxxsitesite.com/xx/img_download.asp?savepath=C:\

 

[whitemist]

some are - like say you want to grab the sam files that hold all the hashes for windows accounts - firefox can read and can pull the size of the file but it won't transfer it.

Edit - the file will download as 0k - though most files you can download.

s-p-n ill give you the actually link if you want

 

[jM2.me]

So Ill keep this simple. There is a online game I play that is going out of business. We have some of the old server files on ragezone. On their site there is a image script that allows you to pull any files on that servers hard drive. The script goes a little something like this:

http:/xxxxxxsitesite.com/xx/img_download.asp?savepath=C:\Windows\&filename=iis6.log

that will download the iis6 log file which supplied me with the name of the machine and the admin account name.

Also it looks like you can access networked computers like such:

http://xxxxxsiteish.com/xx/img_download.asp?savepath=\\192.168.1.82\dir\dir\dir\dir\&filename=picture.jpg

Which I found if you remove the 192.168.1.82 and change it to below it works the same way:

http://xxxxxxsitesite.com/dir/dir/dir/dir/&filename=picture.jpg"

It will load the file with no issues.

Basically I want to grab some of the .asp files from the website so I can get ahold of the mssql user names and passwords. At this point all the script does is pull files, I am not aware if it does anything else but I'm up for suggestions. I was able to pull the iss6.log to find some basic information but I just don't know windows deep enough to pull anything that would really help.

I'm not going to give the name of this website out - they don't deserve to be slammed by people trying to take down their website. This is purely for keeping their game alive through a private server or open source means. This thread wasn't made for defacing or taking down their website just getting ahold of some files and since it involves a little coding I figured this would be the best place.

If not maybe extra server help...
Anyways: I tried C:\inetpub\wwwroot with index.asp and default and main but it found nothing.

Any suggestions?

Tell Riot I said hi

If they ever opened the folder with images (screenshots/wallpapers) then there should be thumbs.db file I believe, but not sure if it contains any paths at all.

P.S. It's funny how no-one but me knows about what url you are talking about :

 

[whitemist]

will do buddy Hope you are doing well man