I currently have a webserver running Windows Server 2012 which is running IIS as its webserver and using PHP.

Lets assume the a user is able to upload a trojan onto my server, either through a vulnerable hosted site or perhaps some other exploit.

If the user is able to find the site directory the file was uploaded to, he can navigate to it, thus executing the virus.

Recently I talked about this possibility to my colleague and he stated that his server is configured in a way that would only allow the execution of php scripts.

How does one configure his/her server to only allow php scripts to be run or at the least disallow certain file types from being executed by the attacker.



IIS Manager

There are a couple of ways you can do this which immediately jump to mind, but I think the most common way would be to use the Request Filtering module, which can be accessed via the IIS manager. I've highlighted it in red in the above picture. This lets you block requests with certain file extensions, HTTP verbs, URLs, HTTP Headers or query strings. You can set this up to only allow requests with a .php (and probably .css, .html, .png, .jpg ... other common static file types) to be processed by the server.

As an aside, the two items I've highlighted in blue might also be of interest in this scenario. Directory browsing (which is off by default) does exactly what you'd expect it to, it controls whether or not the web server will return a directory listing for a virtual directory if no file is specified in the request and no default document is configured.

Handler mappings control which applications are configured to deal with which file types. It's here where you tell IIS that when it sees a request for a .php file, it needs to run php.exe to deal with it. You could potentially remove all uncecessary handler mappings (including .) to remove any chance that your server would process a file with an unusual extension.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.