1

Server information:

Windows XP

Service Pack 2

Microsoft-IIS/6.0

Generally speaking the server is out of my countrol (for the time being.) I can request patches that are missing but can't change the version of Windows or the version of IIS.

Hack information:

The following but of HTML is added to our aspx files, right below the tag. This means they have at minimum read/write access to our files. It also means that the page is no blank as they have an extra <div> tag thats not getting closed. I should note that on some pages the extra, unclosed, <div> is not there so the page continues to load just fine.

<script language="javascript" type="text/javascript">
document.write("<div style='display:none;'>");
</script><div> <a href="http://www.wowgoldlife.com/">wow gold</a> 
<a href="http://www.guidespower.com/">runescape gold</a> 
<a href="http://www.riftstore.com/">rift gold</a> 
<a href="http://www.riftgoldsale.com/">rift platinum</a>
<a href="http://www.mywowgoldsite.com/">buy wow gold</a> 
<a href="http://www.wowgoldsonline.com/">cheap wow gold</a> 
<a href="http://www.mmogoldsonsale.com/">world of warcraft gold</a> 
<a href="http://www.rsgpstore.com/">rs gold</a>
<a href="http://www.rsgoldlife.com/">buy runescape gold</a>
<script language="javascript" type="text/javascript">
document.write("</div>");
</script>

The Questions:

  1. What are the possible entry points for this hack?
  2. Given my restrictions above, how can I prevent this in the future?

Update

Seems like IIS6 on XP caused some comments. From what I can tell, I'm running IIS6 on WindowsXP... This code tells me I'm on XP and Request.ServerVariables["SERVER_SOFTWARE"] tells me I'm on IIS6.

5
  • Even though this is XP as a 'server' ;) This should probably be moved to ServerFault.com - voted to close/migrate.
    – techie007
    Apr 21, 2011 at 0:09
  • 2
    IIS 6.0 on Windows XP? wow where can i find a copy like yours?
    – icelava
    Apr 21, 2011 at 6:07
  • @icelava +1 - I assume he means IIS5.1 Apr 22, 2011 at 12:43
  • 1
    You're running a bonafide website on XP and you want help with this hack? This hack is the least of your problems quite honestly.
    – GregD
    Apr 22, 2011 at 18:21
  • 2
    possible duplicate of My server's been hacked EMERGENCY
    – jscott
    Apr 22, 2011 at 18:55

3 Answers 3

2

We have no way to be able to tell you what "can be causing the following hack". The fact that you're running a public facing website on Windows XP tells me something about you or your companies abilities to deal with this issue.

  1. Whoever set this up doesn't know what they're doing.

Which leads me to the rest of my conclusion.

  • Please hire proper consultants to help you setup and maintain a public facing website.

The issues with this particular setup, coupled with the fact that you've left out a ton of information, makes it nigh impossible to help you with this issue. Regardless, it could be literally anything that caused this particular hack, from xss to an unpatched Windows XP install.

0

You need to take that application offline.

Right Now

...and keep it offline until you can get the server "under control". If not yours, someone who has some idea how to administer a server.

If information is being added to your source code in this manner, your server is what we like to call "pwned". That box is no longer yours. There's probably more going on you don't even know about. Very likely, there's either a wide-open FTP account, or there's some sort of application hole which is exposing the site's source both read and write.

You don't give enough information to say more than that. At absolute minimum, I would get the network cable of this system unplugged until you find out the extent of what is going on.


Oh... and IIS5.1 is what would be on XP. And XP should not be being used as a publicly-facing web server, but that's a whole 'nother ball of wax...

2
  • From what I can tell, I'm running IIS6 on WindowsXP... support.microsoft.com/kb/304283 that code tells me I'm on XP and Request.ServerVariables["SERVER_SOFTWARE"] tells me I'm on IIS6
    – Justin808
    Apr 22, 2011 at 18:13
  • IIS6 only comes on Windows Server 2003. Windows XP Professional only comes with IIS5.1. You can not 'upgrade' IIS by itself. Aside from IIS5.1, the only other possible IIS you could have would be IIS Express, which would be version 7.5. Apr 23, 2011 at 19:51
0

I'd guess it is most likely a SQL injection attack on your application. Is the code dynamically generated by a database?

Audit the file access to check which account is making the changes.

And, as others have said, get the server offline. Windows XP should never run a website outside of development.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .