Re: IIS web server hacked..any tips?

From: Tim Igoe (tim_at_igoe.me.uk)
Date: 12/15/04

  • Next message: Jim Tuttle: "RE: IIS web server hacked..any tips?" 
    Date: Wed, 15 Dec 2004 19:24:50 +0000
To: Francesco <francesco@blackcoil.com>

    Francesco wrote:

    >I have a Windows 2003 Server running IIS 6, SQL Server 2000, MailEnable,
    >and ASP.NET 1.1. WWW and FTP are enabled, but restricted by IP. FTP is
    >additionally protected by authentication.
    >
    >Yesterday someone managed to access the server and dump 8GB of DVD files
    >into a deeply nested folder in a backup directory, for sharing I
    >presume. The payload folder was NOT within the available folders given
    >access to FTP users. Someone was able to "see" the entire D drive and
    >figure out a hidden enough location at their whimsy.
    >
    >I thought the server was fairly well locked down, but apparently not.
    >What is the usual method of intrusion for "warez" attacks like these?
    >
    >Francesco
    >
    >
    I can't really give a lot of help here, but a few days ago a friend
    noticed his (Win2k) IIS FTP had been used for a warez dump too, I
    couldn't work out how however, using the anonymous (which is disabled)
    username in the logs. The folder that was used, I couldn't get into
    using an FTP client nor could he access directly from the box. It had a
    name of nothing, in the logs showing as /+/

    Again, it seemed to be uploading warez, didn't see any downloading in
    the logs however.

    We've managed to delete it now, and shut the FTP off but I've no idea
    how the attacker got in, would like to find out myself

    Windows was fully up to date, this some un-known security hole?

    Tim

  • Next message: Jim Tuttle: "RE: IIS web server hacked..any tips?"

    Relevant Pages

    • Re: my iis has been hacked :-(
      ... One step is removing the folder. ... FTP services enabled and the anonymous user ... hidden FTP server like Serv-U FTP. ... In one of the subdirectories i found 2 subdirectories, ...
      (microsoft.public.inetserver.iis.security)
    • Re: Connecting to ftp with File Browser
      ... I selected "ftp with login" as type of connection. ... I'm being hosted on a Windows server, ... In my ftp client the folder structure is as follows. ... In file browser all that loads is the root folder shown above and the ...
      (Ubuntu)
    • FTP Permissions Issues and other issues
      ... One is the public facing FTP server and the other ... is the server where the actual FTP folder is (the public facing server has ... and make directories but only within the root folder. ...
      (microsoft.public.inetserver.iis.ftp)
    • Re: STUPID NAVIGATION BAR!
      ... > folder on the hard drive, edit, select all, right mouse ... > the ftp) and once again - no nav bar/menu down ... I also have MS FP Server Extensions 2002 ... >>Certain features of the navigation bar requires the site ...
      (microsoft.public.frontpage.client)
    • When publishing web page, show the upload but doesnt actually create the site.
      ... Frontpage Server Extensions almost always must be ... there is a way to modify your FTP client to show them. ... Make sure those folder have been uploaded. ...
      (microsoft.public.frontpage.client)