Exploitation of the SSL PCT Overflow

This document establishes a detailed scenario in which a given exploit is used to gain complete control of a targeted system. The attack will be demonstrated in phases which will include intelligence gathering, network information disclosures, and a vulnerability assessment. The stages of the attack will be described in-depth with heavy focus on avoiding intrusion detection sensors (IDS) and firewalls. All stages of this attack have been performed in a simulated test lab environment. The test lab was configured to closely represent a live network environment. The vulnerability in discussion is the Microsoft IIS SSL PCT Overflow. Microsoft released the security bulletin MS04-011 for 14 various vulnerabilities on April 13, 20041. The IIS SSL PCT Overflow was included in this bulletin. A week later an exploit for this vulnerability was released in the wild. Successful exploitation of this vulnerability allows for Administrator-level privilege shell access on a targeted system.