1

We have an IIS application that needs to execute an exe with potentially malicious input. Multiple applications run in this app pool and I would like to limit our risk as much as possible. The executable itself is trusted, but is very possible to contain vulnerabilities (such as ImageMagick). It's possible through a buffer overflow some other mechanism, that an adversary could gain control and execute with the same privileges (i.e. the app pool user) as the original executable.

I imagine the safest course would be to create a user that has permission to do nothing more than execute this exe, and read and write to a single particular folder, but it's difficult to find a guide on how to do this.

Improve this question
3
  • 1
    If you remove the user from all user groups it will have no permissions by default. Then you can grant it permissions, one by one, until it functions. Give it no more than what it needs to function.
    – HackSlash
    Nov 14, 2017 at 17:33
  • When you say "grant it permissions", could you be more specific? Where would you find this?
    – Sam Rueby
    Nov 14, 2017 at 18:27
  • There are many different things a user object can be granted permission to. It depends on what you want to allow. There are system functions that can be granted in the local security policy, there are filesystem permissions in NTFS, there are also application specific permissions in various Microsoft products. If you don't know what I'm talking about you're going to need a systems administrator and a security administrator to help you.
    – HackSlash
    Nov 14, 2017 at 23:13

1 Answer 1

Reset to default
2

If you really don't trust the system, you must isolate it. Use a separate server for your data, database, and anything else you want to keep away from the untrusted IIS server.

NOTE: Each of these lines items could take whole articles to explain. Hardening an internet facing IIS server can be a long road.

  1. Use the latest version of Windows and IIS
  2. Make a DMZ subnet and VLAN
  3. Place the IIS server in the DMZ
  4. Never join the IIS server to the domain
  5. Place a reverse proxy server with web application firewall in the DMZ
  6. Route all traffic, in and out, through a firewall with IPS capabilities
  7. Route all traffic to the reverse proxy server from the internet so that traffic never goes directly to the IIS server
  8. Install security software suite that includes a host firewall and behavior analytics
  9. Install Microsoft EMET: https://support.microsoft.com/en-us/help/2458544/the-enhanced-mitigation-experience-toolkit
  10. Deploy AppLocker to control what executable can run: https://technet.microsoft.com/en-us/library/dd759117%28v=ws.11%29.aspx
  11. Disable NetBIOS and SMB

-OR-

  1. Host the application in the Azure cloud and let Microsoft worry about what happens when it gets compromised.
  2. Still do some hardening on the server itself but now you don't have to secure the network around it.
Improve this answer
2
  • 1
    I'm not sure this really answers the question. And the Azure advice is lacking in a little detail. I'm assuming the Azure suggestion is to use the SaaS web hosting offering and not IaaS, since the latter would require similar work on the part of the asker to secure the VM and the virtual network.
    – Todd Wilcox
    Nov 14, 2017 at 17:35
  • Well, you can't safely run an executable with vulnerabilities is the real answer but that's not very helpful. The goal is to harden around the exploitable process so there is nothing to gain from exploitation. Also, step #10 might be all he needs to "answer the question" but I believe that to be insufficient.
    – HackSlash
    Nov 14, 2017 at 17:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .