Less than 24 hours after the publication of a severe, system-level security
flaw
in Microsoft’s IIS 5.0, source code to a program that exploits the hole and
gives a remote user full control of a vulnerable server has been posted online.
Jill.c, a 167-line program written in the C language, was authored by a
grey-hat hacker in New Zealand who uses the nickname Dark Spyrit. Using the
compiled code against a default installation of Microsoft’s popular web
server, an attacker merely needs to type in the name of a remote system and
a port number, and in a matter of seconds can gain complete control of the
machine.
The code, which was distributed on a Windows 2000 security mailing list
Wednesday afternoon, exploits a vulnerability discovered by security
software firm eEye Digital Security and published Tuesday.
Jill.c causes a buffer overflow in a component called msw3prt.dll, also
known as the .printer ISAPI filter, which gives the operating system
support for the Internet Printing Protocol. Jill.c then overwrites the
instruction pointer with a location in memory that jumps to the program’s
exploit code, which provides the user a command prompt on the remote web
server.
The exploit is not yet in widespread circulation, but security experts say
it will quickly become a popular attack tool for web site defacers and more
malicious computer criminals.
“Once it’s up on one of the lists, it gets into the underground archives. I
think it will be a long-standing member of the arsenal used against IIS 5
boxes. Right now it’s certainly the tool of choice because of its ability
to give you a command prompt,” said Russ Cooper, surgeon general of TruSecure Corp.
In an email interview with InternetNews.com Wednesday, Dark Spyrit said he
released Jill.c to encourage system administrators to apply the patch
released by Microsoft on Tuesday.
But the hacker, who has done consulting work for eEye and COVERT Labs in
recent years, said there were other motivations besides “full disclosure”
for publishing the exploit: “To be honest – I wanted to get my name back
out, show off a few techniques – and well.. hmm.. chicks dig it?”
Cooper, however, believes that even the innocuous sample exploit released
by eEye with its advisory may do more harm than good.
“This was not necessary to put fire under the butts of anybody. Every
alerting mechanism on the planet has been invoked. So I think there’s a
naivete when people think they need to do a proof of concept to convince
others that this is serious,” said Cooper.
Despite the advisories from Microsoft,
CERT, and NIPC,
and others, Cooper nonetheless predicted that system administrators will be
slow to apply the patch.
