Quantcast
Channel: Security
Viewing all articles
Browse latest Browse all 1881

Use a COM-compatible .NET Assembly - Security problems...?

$
0
0

hi

i have that code:

using System;
using System.Collections.Generic;
using System.Net.Sockets;

namespace jan.utils
{
    public class HttpClient
    {
        private int mPort = 0;
        private String mServer = null;

        public HttpClient()
        {
            
        }

        public void init(String aServer, int aPort)
        {
            mPort = aPort;
            mServer = aServer;
        }

        public String doGETRequest(String aRemoteScript, NameValuePair[] aNameValuePairArr)
        {
            TcpClient mTcpClient = new TcpClient();
            mTcpClient.Connect(mServer, mPort);

            String ret = "";

            using (NetworkStream ns = mTcpClient.GetStream())
            {
                System.IO.StreamWriter sw = new System.IO.StreamWriter(ns);
                System.IO.StreamReader sr = new System.IO.StreamReader(ns);

                String req = "";
                req += "GET /" + aRemoteScript + createParamString(aNameValuePairArr) + " HTTP/1.0\r\n";
                req += "Host: " + mServer + "\r\n";
                req += "\r\n";

                sw.Write(req);
                sw.Flush();

                var bufout = new byte[1024];
                int readlen = 0;
                
                do
                {
                    readlen = ns.Read(bufout, 0, bufout.Length);
                    ret = ret + System.Text.Encoding.UTF8.GetString(bufout, 0, readlen) + "\r\n";
                }

                while (readlen != 0);
            }

            mTcpClient.Close();

            return ret;
        }

        private static String createParamString(NameValuePair[] nvpArr)
        {
            String lStr = "?";

            for (int i = 0; i < nvpArr.Length; i++)
            {
                NameValuePair element = nvpArr[i];
                lStr = lStr + element.getName() + "=" + element.getValue();

                if (i < nvpArr.Length - 1)
                {
                    lStr = lStr + "&";
                }
                else
                {
                    break;
                }
            }

            return lStr;
        }
    }
}

an i compiled a assembly with. (release compile, "Register for COM interop" enabled, [assembly: ComVisible(true)])

then i copied both .dll and .tlb file in a directory with FULL PERMISSION. (All for "Everyone")

then i try to use that code in an asp site:

Sub test2()
            Dim test1: Set test1 = CreateObject("jan.utils.HttpClient")
      End Sub
      
      test2()

does not work - get this message:

Microsoft VBScript runtimeerror '800a0046'

Permission denied: 'CreateObject'

/Solution1/WebApplication1/Test.asp, line 20

i tried many things:

http://www.google.ch/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CCsQFjAA&url=http%3A%2F%2Fstackoverflow.com%2Fquestions%2F13822353%2Fserver-createobject-failure-with-32-bit-windows-and-iis-7&ei=rf7LUpK9OoidtAaI14HIDg&usg=AFQjCNEo57UpeEHt9B6NGQAO_RTrhm5xjw&bvm=bv.58187178,d.Yms&cad=rja

http://www.google.ch/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&ved=0CDQQFjAB&url=http%3A%2F%2Fstackoverflow.com%2Fquestions%2F4505634%2Fiis7-permission-denied-asp-file-write&ei=rf7LUpK9OoidtAaI14HIDg&usg=AFQjCNFVZiymoFFSmlMdh4FCDWogixBePQ&bvm=bv.58187178,d.Yms&cad=rja

http://www.google.ch/url?sa=t&rct=j&q=&esrc=s&source=web&cd=3&cad=rja&ved=0CD0QFjAC&url=http%3A%2F%2Fforums.iis.net%2Ft%2F1200929.aspx%3F%2B2008%2BR2%2BPermission%2Bdenied&ei=rf7LUpK9OoidtAaI14HIDg&usg=AFQjCNF2y4WHMWW6bdPqz6MU4fsaBpCK4A&bvm=bv.58187178,d.Yms

http://www.google.ch/url?sa=t&rct=j&q=&esrc=s&source=web&cd=4&ved=0CEUQFjAD&url=http%3A%2F%2Fsocial.technet.microsoft.com%2FForums%2Fwindows%2Fen-US%2Fa10efc91-643b-4dd5-9773-4e242e497bcf%2Fserver-object-error-asp-0178-80070005-servercreateobject-access-error-opening-excel-from%3Fforum%3Dw7itproappcompat&ei=rf7LUpK9OoidtAaI14HIDg&usg=AFQjCNFoU78wTp4Ur8xkElZyFh4id6d96w&bvm=bv.58187178,d.Yms&cad=rja

http://www.google.ch/url?sa=t&rct=j&q=&esrc=s&source=web&cd=5&ved=0CE0QFjAE&url=http%3A%2F%2Fvbcity.com%2Fforums%2Ft%2F161919.aspx&ei=rf7LUpK9OoidtAaI14HIDg&usg=AFQjCNE_lISf0Pn7NJBOJrKhLCzdHs75Bw&bvm=bv.58187178,d.Yms&cad=rja

http://www.google.ch/url?sa=t&rct=j&q=&esrc=s&source=web&cd=6&ved=0CFoQFjAF&url=http%3A%2F%2Fforum.parallels.com%2Fshowthread.php%3F81016-Microsoft-VBScript-runtime-error-800a0046-Permission-denied-CreateObject&ei=rf7LUpK9OoidtAaI14HIDg&usg=AFQjCNHbfi9Mr27MD2u8kxxRVvMGq8pKJw&bvm=bv.58187178,d.Yms&cad=rja

http://www.google.ch/url?sa=t&rct=j&q=&esrc=s&source=web&cd=8&ved=0CHEQFjAH&url=http%3A%2F%2Fwww.justskins.com%2Fforums%2Fserver-createobject-access-error-17276.html&ei=rf7LUpK9OoidtAaI14HIDg&usg=AFQjCNFSjfUe0ACvoTWaIg7EWDzHRIeNUg&bvm=bv.58187178,d.Yms&cad=rja

http://www.google.ch/url?sa=t&rct=j&q=&esrc=s&source=web&cd=10&ved=0CIMBEBYwCQ&url=http%3A%2F%2Fwww.chilkatsoft.com%2Fp%2Fp_33.asp&ei=rf7LUpK9OoidtAaI14HIDg&usg=AFQjCNGm36yn9b6C4dD90CqFjEloFdRv6A&bvm=bv.58187178,d.Yms&cad=rja

nothing does work, that's a big crap...

regards, jan


Viewing all articles
Browse latest Browse all 1881

Latest Images

Trending Articles



Latest Images

<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>