hacking test

Thanks. My main question was that how do I write a file to a drive (for instance a trojan or a java script file which can exploit other things) when I have IUSR account full permissions?

May be via file shares (or virtual directories) you can "plant" something in it? You would want to test it on access to it but do note the OS security access control as well (if the OS AC is to everyone, you can access it via this account else it is still block).

Check out past queries in
http://www.experts-exchange.com/Software/Server_Software/Web_Servers/Microsoft_IIS/Q_21350246.html

Extract of how to create file share:
Internet Information Services (IIS) allows users to share their files and make them accessible from a Web browser. This is also an alternative to using FTP to host files. The easiest way to share files through IIS is to create a virtual directory for the folder you want to share and configure it for browsing. Follow these steps:

   1. Open the IIS console, right-click Default Web Site, and choose New | Virtual Directory.
   2. Using the Virtual Directory Creation Wizard, enter an alias for the virtual directory. Remote clients use the alias to access the folder. For example, you might use an alias of files, as in www.XXX.com/files.
   3. Select the physical directory containing the files you want to share, and click Next.
   4. Select the Browse permission, click Next, and click Finish.
   5. Point a Web browser to http://<server>/<alias>, where <server> is the IP address or host name of the computer, and <alias> is the virtual directory's alias. You should then see a file listing. Clicking a file link should begin a download.

Hi stranger_ind,
Have you found out exactly how the attack was carried out? Perhaps more details on that could help the experts here to ascertain if the IUSR account  permissions had a role to play in this case.

With that said, I would recommend NOT giving the IUSR account full permissions. Even if the attack in this case was not because of the IUSR account permissions, in future, there may arise an attack scenario that was made possible because of the permissions level of the IUSR account.

Do agree with ryecatcher. Can also take a look at recent ISS6 attack that deals with anonymous access and rights
>http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1356759,00.html?track=NL-102&ad=704143&asrc=EM_NLN_6975169&uid=2258515
>http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9133248&source=CWNLE_nlt_security_2009-05-19

The tools in nmap may reveal the vulnerability

WebDAV VULNERABILITY
Summary: On May 15, 2009, a researcher released a document describing an authentication-bypass vulnerability affecting Microsoft IIS 6.0 with WebDAV. The flaw allows an unauthorized user to gain unfettered access to restricted files. Public reports indicate that IIS7 + WebDAV are not vulnerable to this issue. Update2: Microsoft has released security advisory 971492 to acknowledge this issue and has suggested workarounds.

WebDAV detection using the Nmap Scripting Engine (NSE)
Someone has come out with a nse to scan for WebDAV. It took less than 60 seconds to scan a /24 public network.
http://ack-rst.com/scripts/webdav.nse

Additional information
"The Nmap Scripting Engine (NSE) is one of Nmap's most powerful and flexible features. It allows users to write (and share) simple scripts to automate a wide variety of networking tasks."

http://nmap.org/book/nse.html#nse-intro

Hi,

I think some one exploited using Unicode vulnerability Exploit!

Read this for more information about the attack recreation.

http://www.sans.org/security-resources/malwarefaq/wnt-unicode.php

Cheers,
Sajan.S

Ammasajan, thanks for that link.. but I now think that this is due to XSS attack!..