Server 2003 - IIS 6 - Hacked

[powert]

Hi all,

 

We've been having a bit of trouble with some Iranian hackers (calling themselves the Iran Security Team) hitting our school's webserver repeatedly. When it started, they were just dumping phoney 'index.html' and 'index.php' files to the root folder of our website (luckily our ACTUAL index page runs within a nested folder, so there was no interruption). Then they stepped it up and left hacking tools embedded in web pages. Now they've left files which open web pages requiring a password - having done some research it seems hackers can use a loophole in IIS which means that a site requiring password authentication can be used to step up privillages...so now they're getting WRITE privileges and managed to delete a whole bunch of important files! So it's getting worse!

 

We deleted all their files (after gathering as much info as we could from them) and ran a system update on the server. Loads of security updates got patched, but they still hit us again. I've run the update service once more and there was one more patch, but that's it. I don't have faith that this single patch will save the day, so does anyone have any suggestions?

 

We are running IIS 6 on Server 2003. All of the erroneous files were created by the IIS Anonymous User Account (IUSR_*serverName*) - so I suspect it's something to do with tying that down. I determined this by right-clicking the phoney files - the Security tab showed permissions set for IUSR_*serverName*...however this account does not show for any of our legitimate files...

 

Is it something to do with the Anonymous IIS Account? Am I barking up the wrong tree?

 

...suggestions are much appreciated!

 

Many thanks,

 

Tom

Edited May 23, 2013 by powert

[Deanuk]

I think the answer to this problem is in your title.... Server 2003 - IIS 6

[SovietRussia]

Turn off your server! Then get IIS 7/8

[cpjitservices]

Either that or use a Linux web server, if you install CentOS you can select web server on installation and once its rebooted you have a working web server and its secure and will be up to date, having IIS6 on the net now isnt a very good idea at all.

[kevin_lane]

their is a tool called IIS lockdown you could try if this server is connected to your main lan then yet you def have a problem you should really keep this server in a different segment of the network (if it is then scratch what I have just said) however you also want to make sure that your services accounts are turned off and that you have basically only the lowest user account to access the site they most prob use some Unicode to do a buffer overflow on the iis server or something of that nature my if you really want a secure web server then you either get it hosted some were else or you use apache or go along down the server core route

[2097]

Wasnt IIS 6 prone to the Unicode Exploit also ?

 

Id suggest changing over to Apache/Centos . Only reason we use IIS is for anything asp related such as Home Access Plus

[Arthur]

I'd suggest changing over to Apache.

Apache isn't much better.

 

• Attack hitting Apache sites goes mainstream, hacks nginx, Lighttpd, too
  
• Admin beware: Attack hitting Apache websites is invisible to the naked eye
  
• Ongoing malware attack targeting Apache hijacks 20,000 sites
  
• Security flaw in Apache could allow attackers into internal networks
  
• New DoS tool lets a single PC bring down an Apache server
  

[powert]

Thanks for all the suggestions folks - I'd say that if you forgive the patronising demeanour of 'Deanuk', there are all some really useful ideas. So thanks very much for that!

[cpjitservices]

Most if not all those bugs in Apache have been patched.

[Marci]

If the exploit may have enabled them to read anything sensitive, make sure you notify your school's Data Protection Officer.

[Dos_Box]

Server 2003/IIS6 hasn't been supported for about 6 years now. As the others have said, whatever exploits are being used will most likely never be patched.

i would seriously suggest looking to upgrade/migrate it to a newer version of Windows Server/IIS with haste.

[SovietRussia]

Just dont go for XAMPP - Full of security holes.

[Michael]

I'd say in the short term, disable your website in IIS6 and migrate it to either IIS7.5 in Server 2008 R2 or IIS8 in Server 2012. By default both of these are harder, as a lot of options/services are turned off by default.