Re: IIS web server hacked..any tips?

From: Sam Evans (wintrmte_at_gmail.com)
Date: 12/15/04

  • Next message: Christopher Day: "RE: IIS web server hacked..any tips?"
    Date: Wed, 15 Dec 2004 12:34:09 -0700
    To: Francesco <francesco@blackcoil.com>
    
    

    Could the individual have used a privileged account which would have
    allowed them to drop the files in the location you found them in?
    Brute forcing accounts through FTP is fairly non evasive (if you have
    security event logging disabled / nothing moitoring it and no lockout
    restrictions).

    Out of curiosity, what is/was the owner set to on the files you found?
     That should be a good clue as to how they got there.

    -Sam

    On Wed, 15 Dec 2004 08:23:40 -0800, Francesco <francesco@blackcoil.com> wrote:
    > I have a Windows 2003 Server running IIS 6, SQL Server 2000, MailEnable,
    > and ASP.NET 1.1. WWW and FTP are enabled, but restricted by IP. FTP is
    > additionally protected by authentication.
    >
    > Yesterday someone managed to access the server and dump 8GB of DVD files
    > into a deeply nested folder in a backup directory, for sharing I
    > presume. The payload folder was NOT within the available folders given
    > access to FTP users. Someone was able to "see" the entire D drive and
    > figure out a hidden enough location at their whimsy.
    >
    > I thought the server was fairly well locked down, but apparently not.
    > What is the usual method of intrusion for "warez" attacks like these?
    >
    > Francesco
    >


  • Next message: Christopher Day: "RE: IIS web server hacked..any tips?"

    Relevant Pages

    • Re: my iis has been hacked :-(
      ... One step is removing the folder. ... FTP services enabled and the anonymous user ... hidden FTP server like Serv-U FTP. ... In one of the subdirectories i found 2 subdirectories, ...
      (microsoft.public.inetserver.iis.security)
    • Re: Connecting to ftp with File Browser
      ... I selected "ftp with login" as type of connection. ... I'm being hosted on a Windows server, ... In my ftp client the folder structure is as follows. ... In file browser all that loads is the root folder shown above and the ...
      (Ubuntu)
    • FTP Permissions Issues and other issues
      ... One is the public facing FTP server and the other ... is the server where the actual FTP folder is (the public facing server has ... and make directories but only within the root folder. ...
      (microsoft.public.inetserver.iis.ftp)
    • Re: STUPID NAVIGATION BAR!
      ... > folder on the hard drive, edit, select all, right mouse ... > the ftp) and once again - no nav bar/menu down ... I also have MS FP Server Extensions 2002 ... >>Certain features of the navigation bar requires the site ...
      (microsoft.public.frontpage.client)
    • When publishing web page, show the upload but doesnt actually create the site.
      ... Frontpage Server Extensions almost always must be ... there is a way to modify your FTP client to show them. ... Make sure those folder have been uploaded. ...
      (microsoft.public.frontpage.client)