Question on IIS servers and reverse lookup

From: Maxime Ducharme (mducharme_at_cybergeneration.com)
Date: 03/09/05

  • Next message: Miroslaw Slawek Chorazy: "Re: Question on IIS servers and reverse lookup" 
    To: <focus-ms@securityfocus.com>
Date: Wed, 9 Mar 2005 17:41:46 -0500

    Hi to the list

    We are running a new iptables firewall with
    restrictives policies.

    I just noticed that sometimes (between 1 an 4 packets per
    weeks), our IIS 5.0 server try to send NetBIOS name
    query on foreign IPs.

    Here is a hex dump of that packet :

    11:44:56.495348 x.x.x.x.netbios-ns > 211.40.x.y.netbios-ns: NBT UDP
    PACKET(137): QUERY; REQUEST; UNICAST
    0x0000 4500 004e b2bf 0000 8011 ff8f XXXX XXXX E..N.........hR.
    0x0010 d328 913c 0089 0089 003a 6ff0 c7ee 0000 .(.<.....:o.....
    0x0020 0001 0000 0000 0000 2043 4b41 4141 4141 .........CKAAAAA
    0x0030 4141 4141 4141 4141 4141 4141 4141 4141 AAAAAAAAAAAAAAAA
    0x0040 4141 4141 4141 4141 4100 0021 0001 AAAAAAAAA..!..

    x.x.x.x is our server (i replaced hex dump with XXXX XXXX too)

    Source : our server
    Proto : UDP
    Source port : 137
    Dest : foreign server
    Dest port : 137

    I'd like to identify the source of these packets.

    One thing that comes in mind is :
    Would it be related to the option in IIS "reverse
    lookup host" to log hostnames in the log file ?

    I remember that nslookup() function of NT kernel
    uses netbios if DNS doesnt reply anything
    (correct me if i'm wrong).

    There is not other inbound port than 80 opened.
    Opened outbound ports are packets related to a already
    opened connection on port 80 and DNS queries to our
    servers. The server itself cannot open a connection
    on Internet.

    Since this server is hosting ASP & ASP.NET services,
    I agree it would be possible to get access via
    some crafted URLs or webapp attacks, but we didnt
    see anything else than these packets.

    Someone may enlighten me ?

    Thanks in advance

    Maxime Ducharme
    Programmeur / Spécialiste en sécurité réseau

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Miroslaw Slawek Chorazy: "Re: Question on IIS servers and reverse lookup"

    Relevant Pages

    • Re: unusual packet (tcpdump shows): rad-#0 41 [id 0] Attr[
      ... targetting openssl servers and after the compromise ... receives TCP auth requests over port 1812. ... are you running a radius server / have you ever run a radius server. ... >I'm facing this packets continuously on my server. ...
      (Incidents)
    • RE: Some technical errors
      ... If the SMTP server is not running on port 25 TCP it is not a public ... Manager - Computer Assurance Services BDO Chartered Accountants & ...
      (Security-Basics)
    • Re: SRV RRs support in Internet Explorer?
      ... The port number could be implicit (i.e. ... At any point in time, a server could fail ... can't effectively LB or backup because NSs cache the records for the TTL ... I still don't see how SRV records would help backup or LB. ...
      (microsoft.public.win2000.dns)
    • Re: Still cant connect to RWW or OWA remotely
      ... I get 'cannot find server or dns error' on both ... TCP [port number]> to open the ports. ... As for error messages when I fail to access RWW with the laptop, ... network, no connection seems possible. ...
      (microsoft.public.windows.server.sbs)
    • Re: cannot send mail from Windows mail
      ... When a username/password combination doesn't work in Windows Mail, ... I mean I dont use it but as outgoing address for my ISP account. ... youir username and password are correct for your mail server". ... Ask your home ISP if they support SMTP on a port other than 25. ...
      (microsoft.public.windows.vista.mail)