Server information:
Windows XP
Service Pack 2
Microsoft-IIS/6.0
Generally speaking the server is out of my countrol (for the time being.) I can request patches that are missing but can't change the version of Windows or the version of IIS.
Hack information:
The following but of HTML is added to our aspx files, right below the tag. This means they have at minimum read/write access to our files. It also means that the page is no blank as they have an extra <div>
tag thats not getting closed. I should note that on some pages the extra, unclosed, <div>
is not there so the page continues to load just fine.
<script language="javascript" type="text/javascript">
document.write("<div style='display:none;'>");
</script><div> <a href="http://www.wowgoldlife.com/">wow gold</a>
<a href="http://www.guidespower.com/">runescape gold</a>
<a href="http://www.riftstore.com/">rift gold</a>
<a href="http://www.riftgoldsale.com/">rift platinum</a>
<a href="http://www.mywowgoldsite.com/">buy wow gold</a>
<a href="http://www.wowgoldsonline.com/">cheap wow gold</a>
<a href="http://www.mmogoldsonsale.com/">world of warcraft gold</a>
<a href="http://www.rsgpstore.com/">rs gold</a>
<a href="http://www.rsgoldlife.com/">buy runescape gold</a>
<script language="javascript" type="text/javascript">
document.write("</div>");
</script>
The Questions:
- What are the possible entry points for this hack?
- Given my restrictions above, how can I prevent this in the future?
Update
Seems like IIS6 on XP caused some comments. From what I can tell, I'm running IIS6 on WindowsXP... This code tells me I'm on XP and Request.ServerVariables["SERVER_SOFTWARE"] tells me I'm on IIS6.