I had my clients site just hanging today. It appears a host.txt file was inserted into the root folder.

I run a Windows 2012 R2 server and IIS. The website has anonymous access allowed. I have set the Website Application Pool to run off the local system due to requirements.

I'm unsure how the file got there. It contained all the IIS Bindings of the site, but with different IP addresses.

I'm new to this kind of security and would like to know more about how this happened and how I can prevent it from happening again?

  • 4
    "The website has anonymous access allowed" -> "I'm unsure how the file got there"... Really ? – Luke Park Feb 22 '17 at 6:18
  • I switched off Allow Anonymous Access from my Web Panel, but that did not allow me to browse my website?. I get the '401 - Unauthorized: Access is denied due to invalid credentials.' error. – Orion Feb 22 '17 at 10:53
  • 2
    I wouldn't run a website with system authority. This is a very privileged account and you should always run with least privilege. You should set up an account that provides just the permissions you need and run under that – iainpb Feb 22 '17 at 12:43

First off, assume the site is completely owned. Anything you do now will be "closing the barn door after the horses have left." You will never be sure the attacker can't get back in again. If they could drop a file in the root folder, they could have installed other things in other places.

Step 1 - Nuke it from orbit - it's the only way to be sure.

It may be painful, but you need to rebuild a fresh system, from install media, and apply all the updates, before you do anything else.

After that, as one of the comments mentioned, create a new, unprivileged user just for the web server. Install the webserver as that user and not system/admin.

Rebuild the site. Do not allow anonymous access. Log all the accesses. Review the logs.

This is all necessary, but not sufficient. There are many ways to compromise a system. But this should be a reasonable start.

"I'm new to this kind of security" is a fine place to ask questions from, but not a great place to be admin-ing a system from. There is a lot to learn.

Hope this is of some use.

  • If I switch off Anonymous Access, then I can't browse the site? – Orion Feb 23 '17 at 9:20
  • I get the following error when Allow Anonymous Access is off. "401 - Unauthorized: Access is denied due to invalid credentials." – Orion Feb 23 '17 at 9:31

After removing Modify and Write permissions from the root folder of my website, I can confirm, that files are not being randomly inserted into the root of my website. I still have Anonymous Access enabled. But it now seems like the intruder cannot place files into my website root.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.