From 27f8109170060d2d603246210985c59d1fca6a09 Mon Sep 17 00:00:00 2001 From: James Barnett Date: Wed, 5 Oct 2016 17:25:11 -0500 Subject: [PATCH 1/2] Enable FTP on IIS for uploaded backdoors. --- Vagrantfile | 4 +- resources/iis/applicationHost.config | 872 +++++++++++++++++++++++++++ scripts/installs/setup_iis.bat | 2 +- 3 files changed, 876 insertions(+), 2 deletions(-) create mode 100644 resources/iis/applicationHost.config diff --git a/Vagrantfile b/Vagrantfile index 9833c53..ff43b26 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -27,9 +27,11 @@ Vagrant.configure("2") do |config| config.vm.provision :shell, path: "scripts/configs/create_users.bat" config.vm.provision :shell, inline: "rm C:\\tmp\\vagrant-shell.bat" # Hack for this bug: https://github.com/mitchellh/vagrant/issues/7614 - # Vulnerability - Unpatched IIS + # Vulnerability - Unpatched IIS and FTP config.vm.provision :shell, path: "scripts/installs/setup_iis.bat" config.vm.provision :shell, inline: "rm C:\\tmp\\vagrant-shell.bat" # Hack for this bug: https://github.com/mitchellh/vagrant/issues/7614 + config.vm.provision :shell, path: "scripts/installs/setup_ftp_site.bat" + config.vm.provision :shell, inline: "rm C:\\tmp\\vagrant-shell.bat" # Hack for this bug: https://github.com/mitchellh/vagrant/issues/7614 # Vulnerability - Chinese caidao.asp backdoor config.vm.provision :shell, path: "scripts/installs/setup_caidao.bat" diff --git a/resources/iis/applicationHost.config b/resources/iis/applicationHost.config new file mode 100644 index 0000000..b51d78c --- /dev/null +++ b/resources/iis/applicationHost.config @@ -0,0 +1,872 @@ + + + + + + + + +
+
+
+
+
+
+
+
+ + + +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ +
+
+ +
+
+
+
+
+
+ +
+
+
+
+ +
+
+
+ +
+
+ +
+
+ +
+
+
+ + + +
+
+
+
+ +
+
+
+ +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/scripts/installs/setup_iis.bat b/scripts/installs/setup_iis.bat index 7bfdaab..6cf51af 100644 --- a/scripts/installs/setup_iis.bat +++ b/scripts/installs/setup_iis.bat @@ -1 +1 @@ -start /w PKGMGR.EXE /iu:IIS-WebServerRole;IIS-WebServer;IIS-CommonHttpFeatures;IIS-ApplicationDevelopment;IIS-ASPNET;IIS-NetFxExtensibility;IIS-ASP;IIS-CGI;IIS-ISAPIExtensions;IIS-ISAPIFilter;IIS-ServerSideIncludes; \ No newline at end of file +start /w PKGMGR.EXE /iu:IIS-WebServerRole;IIS-WebServer;IIS-CommonHttpFeatures;IIS-ApplicationDevelopment;IIS-ASPNET;IIS-NetFxExtensibility;IIS-ASP;IIS-CGI;IIS-ISAPIExtensions;IIS-ISAPIFilter;IIS-ServerSideIncludes;IIS-FTPServer;IIS-FTPSvc;IIS-FTPExtensibility; \ No newline at end of file From b7e0d8fc70968eea6a738b60cf455e09d30fffe1 Mon Sep 17 00:00:00 2001 From: James Barnett Date: Thu, 6 Oct 2016 11:05:19 -0500 Subject: [PATCH 2/2] Forgot to add file for setting up the FTP site. --- scripts/installs/setup_ftp_site.bat | 1 + 1 file changed, 1 insertion(+) create mode 100644 scripts/installs/setup_ftp_site.bat diff --git a/scripts/installs/setup_ftp_site.bat b/scripts/installs/setup_ftp_site.bat new file mode 100644 index 0000000..8ca3a0c --- /dev/null +++ b/scripts/installs/setup_ftp_site.bat @@ -0,0 +1 @@ +copy /Y C:\vagrant\resources\iis\applicationHost.config "%SystemRoot%\System32\inetsrv\config\applicationHost.config" \ No newline at end of file