Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Server information:

Windows XP

Service Pack 2

Microsoft-IIS/6.0

Generally speaking the server is out of my countrol (for the time being.) I can request patches that are missing but can't change the version of Windows or the version of IIS.

Hack information:

The following but of HTML is added to our aspx files, right below the tag. This means they have at minimum read/write access to our files. It also means that the page is no blank as they have an extra <div> tag thats not getting closed. I should note that on some pages the extra, unclosed, <div> is not there so the page continues to load just fine.

<script language="javascript" type="text/javascript">
document.write("<div style='display:none;'>");
</script><div> <a href="http://www.wowgoldlife.com/">wow gold</a> 
<a href="http://www.guidespower.com/">runescape gold</a> 
<a href="http://www.riftstore.com/">rift gold</a> 
<a href="http://www.riftgoldsale.com/">rift platinum</a>
<a href="http://www.mywowgoldsite.com/">buy wow gold</a> 
<a href="http://www.wowgoldsonline.com/">cheap wow gold</a> 
<a href="http://www.mmogoldsonsale.com/">world of warcraft gold</a> 
<a href="http://www.rsgpstore.com/">rs gold</a>
<a href="http://www.rsgoldlife.com/">buy runescape gold</a>
<script language="javascript" type="text/javascript">
document.write("</div>");
</script>

The Questions:

  1. What are the possible entry points for this hack?
  2. Given my restrictions above, how can I prevent this in the future?

Update

Seems like IIS6 on XP caused some comments. From what I can tell, I'm running IIS6 on WindowsXP... This code tells me I'm on XP and Request.ServerVariables["SERVER_SOFTWARE"] tells me I'm on IIS6.

share|improve this question

migrated from superuser.com Apr 22 '11 at 12:34

This question came from our site for computer enthusiasts and power users.

    
Even though this is XP as a 'server' ;) This should probably be moved to ServerFault.com - voted to close/migrate. –  techie007 Apr 21 '11 at 0:09
2  
IIS 6.0 on Windows XP? wow where can i find a copy like yours? –  icelava Apr 21 '11 at 6:07
    
@icelava +1 - I assume he means IIS5.1 –  Andrew Barber Apr 22 '11 at 12:43
1  
You're running a bonafide website on XP and you want help with this hack? This hack is the least of your problems quite honestly. –  GregD Apr 22 '11 at 18:21
2  
possible duplicate of My server's been hacked EMERGENCY –  jscott Apr 22 '11 at 18:55

3 Answers 3

We have no way to be able to tell you what "can be causing the following hack". The fact that you're running a public facing website on Windows XP tells me something about you or your companies abilities to deal with this issue.

  1. Whoever set this up doesn't know what they're doing.

Which leads me to the rest of my conclusion.

  • Please hire proper consultants to help you setup and maintain a public facing website.

The issues with this particular setup, coupled with the fact that you've left out a ton of information, makes it nigh impossible to help you with this issue. Regardless, it could be literally anything that caused this particular hack, from xss to an unpatched Windows XP install.

share|improve this answer

You need to take that application offline.

Right Now

...and keep it offline until you can get the server "under control". If not yours, someone who has some idea how to administer a server.

If information is being added to your source code in this manner, your server is what we like to call "pwned". That box is no longer yours. There's probably more going on you don't even know about. Very likely, there's either a wide-open FTP account, or there's some sort of application hole which is exposing the site's source both read and write.

You don't give enough information to say more than that. At absolute minimum, I would get the network cable of this system unplugged until you find out the extent of what is going on.


Oh... and IIS5.1 is what would be on XP. And XP should not be being used as a publicly-facing web server, but that's a whole 'nother ball of wax...

share|improve this answer
    
From what I can tell, I'm running IIS6 on WindowsXP... support.microsoft.com/kb/304283 that code tells me I'm on XP and Request.ServerVariables["SERVER_SOFTWARE"] tells me I'm on IIS6 –  Justin808 Apr 22 '11 at 18:13
    
IIS6 only comes on Windows Server 2003. Windows XP Professional only comes with IIS5.1. You can not 'upgrade' IIS by itself. Aside from IIS5.1, the only other possible IIS you could have would be IIS Express, which would be version 7.5. –  Andrew Barber Apr 23 '11 at 19:51

I'd guess it is most likely a SQL injection attack on your application. Is the code dynamically generated by a database?

Audit the file access to check which account is making the changes.

And, as others have said, get the server offline. Windows XP should never run a website outside of development.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.