RE: strange exploit in Win2K server
From: Dan Norton (dan@ware.net)Date: 12/06/01
- Previous message: Evans, TJ: "RE: strange exploit in Win2K server"
- Maybe in reply to: Dan Norton: "strange exploit in Win2K server"
- Next in thread: Ryan Permeh: "Re: strange exploit in Win2K server"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 6 Dec 2001 08:12:43 -0800 From: "Dan Norton" <dan@ware.net> To: "Tim Weickert" <tim.weickert@energis-ision.com>, <focus-ms@securityfocus.com>
I found the hack...
Basically by creating the "com1" folder it allows you to create nested
folders and the only way to remove it is by using rm.exe. I even found
instructions on how to set this hack up on other servers with anonymous
write permissions enabled (on a hacker's website). Luckily, this server
was not doing anything in particular and had all the patches installed
(sp2 and all hotfixes currently available) but in my haste had forgotten
to turn off the FTP services on IIS5 as I usually do.
I hope microsoft fixes this "com1" bug at some point. I was able to
replicate what the hacker did on a test platform I set up internally and
it's pretty scary how easy it is to lock a folder in such a way.
Dan Norton
Network Administrator
WareNet
dan@ware.net
(949) 417 - 2300 x 2360
(888) 927 - 3329 (Fax)
WebSite Development, Web Hosting, Connectivity, Colocation
-----Original Message-----
From: Tim Weickert [mailto:tim.weickert@energis-ision.com]
Sent: Thursday, December 06, 2001 8:11 AM
To: Dan Norton; focus-ms@securityfocus.com
Subject: Re: strange exploit in Win2K server
hi dan,
you should check the properties of your ftp-server
is the anonymous account write "disabled"?
tim
Dan Norton wrote:
>
> OK, I had just installed Win2K server with SP2 and all the hotfixes on
a
> server and given it a public IP. Terminal services was also installed.
>
> Within a few days I noticed that outbound traffic from the server was
> quite high so I fired up etherpeek and found that FTP was being used
to
> transfer MP3 files from the machine to an address on telia.com.
>
> After pulling the network plug I checked out the hard drive. The
> "groups" directory was 4 GB! In the folder for one of the websites,
> there was a directory called "com1" which I was unable to open. When I
> double clicked on the folder in explorer, the window froze. When I
used
> dos and tried to cd to the directory it returned an error of "the
> parameter is incorrect."
>
> I also noticed that my internet services control panel is now
completely
> missing.
>
> What happened? Rather, how was this machine exploited so quickly and
> with all the latest fixes?
>
> It was running IIS5.
>
> Dan Norton
> Network Administrator
>
> deveyn@aol.com
- Previous message: Evans, TJ: "RE: strange exploit in Win2K server"
- Maybe in reply to: Dan Norton: "strange exploit in Win2K server"
- Next in thread: Ryan Permeh: "Re: strange exploit in Win2K server"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
