> -----Original Message-----
> From: Alun Jones [mailto:[EMAIL PROTECTED]]
> >Exploit:
> >2.) Connect to the server with anonymous and type cd con/con
> (yes, this is
> >well know and works with MANY other too, but we think it should be
> >filtered).
> While filtering such a command line may be a worthy
> suggestion, and is
> certainly implemented in our own software, it is far from a
> perfect (or
> even appropriate) solution.
>
> CON/CON is easy to avoid - you just filter on CON/CON.
> There is no system call (that I could find after several days
> of searching) that will enumerate the available DDNs
I'm not entirely sure how you'd do this on Win9x, but if you're dealing with
a NT or Win2k system, the following will help:
DOS Devices Control Entries
The DosDevices subkey lists the built-in symbolic links to create at
startup. The values are stored under this subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\DOS
Devices
Entries in this subkey have the data type of REG_SZ. The following list
shows the default entries under this subkey.
AUX=\DosDevices\COM1
MAILSLOT=\Device\MailSlot
NUL=\Device\Null
PIPE=\Device\NamedPipe
PRN=\DosDevices\LPT1
TELNET=\Device\Telnet
UNC=\Device\Mup
I would imagine that a similar key exists on a Win9x system.
Oh - while browsing the SDK looking for a work-around, here's the API you're
looking for:
"To retrieve the current mapping for a particular MS-DOS device name or to
obtain a list of all MS-DOS devices known to the system, use the
QueryDosDevice function."
You should also be able to call CreateFile() on a directory with a flag of
OPEN_EXISTING set, and check to see if it exists before handing it off to
SetCurrentDirectory(). I don't know if that works around the problem, but it
very well might. Something else to try would be to make a call to
GetFileAttributes and see if the FILE_ATTRIBUTE_DIRECTORY bit is set. Or
combine the two with CreateFile and GetFileInformationByHandle.
Being an NT bigot, I have successfully avoided ever having to write an app
that I had to support on Win9x, so I'm not sure which of these suggestions
will help you avoid problems on that platform, but I did just check and
QueryDosDevice is supported on Win98.
Hope this helps.
