CVE-2009-1535

This Perl script exploits CVE-2009-1535, a WebDAV authentication bypass vulnerability in Microsoft IIS 6.0. It uses a Unicode encoding trick (%c0%af) to bypass authentication and allows file retrieval, directory listing, and file upload via crafted HTTP requests.

This is a detailed technical writeup describing a Unicode-based authentication bypass vulnerability in Microsoft IIS 6.0 WebDAV. The vulnerability allows attackers to bypass password protection by injecting Unicode characters into the URI, enabling unauthorized file access and directory listing.

This Metasploit module scans for directories on IIS6 servers with WebDAV enabled, attempting to bypass authentication using a Unicode vulnerability (CVE-2009-1122). It sends PROPFIND requests with malformed Unicode paths to detect vulnerable endpoints.

This Metasploit module exploits a Unicode authentication bypass vulnerability in IIS6 WebDAV (CVE-2009-1535). It sends a crafted PROPFIND request with an overlong Unicode-encoded path to bypass authentication on protected folders.