FTP, IIS 5.0 hack attemps

Short story long,

Running a Linksys RV082 firwall with a IIS 5.0 (W2k) machine as an ftp server.

We've had many people from overseas attack the site attempting to crack the password, usually very generic login names. none have been even close but this is a continuing attck. Initally the owner was blocking there WAN IP in the firewall by doing dnstools lookup.

Currently, we now have all trusted WAN Ip from customers accessing the FTP setup as port 21 Allowed. Everyone else is using default 21 Deny. Full access to LAN.

Yet were still getting logs like such:
2009-07-06 01:14:26 118.216.89.250 - MSFTPSVC1 DATA1 192.168.*.* 21 [62]PASS - 530 1326
2009-07-06 01:14:27 118.216.89.250 Administrator MSFTPSVC1 DATA1 192.168.*.* 21 [62]USER Administrator 331 0

We adjsuted IIS to do the same thing as the firewall and deny all and only allow our trusted WAN IPs but then we started having other issues with users not being able to log in. (after running a microsoft fix that undid those changes ) were back to square one.

Any idea how this is possible? I've had many people go over our firewall and it appears to be solid. A sheilds up test however will show the port as open. (when done from the ftp server)

Please help!
Phillip. :drink:

Quote:

---

Originally Posted by heavyfreak

Short story long,

Running a Linksys RV082 firwall with a IIS 5.0 (W2k) machine as an ftp server.

We've had many people from overseas attack the site attempting to crack the password, usually very generic login names. none have been even close but this is a continuing attck. Initally the owner was blocking there WAN IP in the firewall by doing dnstools lookup.

Currently, we now have all trusted WAN Ip from customers accessing the FTP setup as port 21 Allowed. Everyone else is using default 21 Deny. Full access to LAN.

Yet were still getting logs like such:
2009-07-06 01:14:26 118.216.89.250 - MSFTPSVC1 DATA1 192.168.*.* 21 [62]PASS - 530 1326
2009-07-06 01:14:27 118.216.89.250 Administrator MSFTPSVC1 DATA1 192.168.*.* 21 [62]USER Administrator 331 0

We adjsuted IIS to do the same thing as the firewall and deny all and only allow our trusted WAN IPs but then we started having other issues with users not being able to log in. (after running a microsoft fix that undid those changes ) were back to square one.

Any idea how this is possible? I've had many people go over our firewall and it appears to be solid. A sheilds up test however will show the port as open. (when done from the ftp server)

Please help!
Phillip. :drink:

---

Sorry I can't help you with the firewall, but It seems as if it's doing it's job. If it was a CISCO router and I had no customers in South Korea, I'd just block the entire country and set a NULL route so as not to clutter up my logs. As long as you are not in a D or DDoS situation... I'd just reconfigure IIS to allow only trusted IP's and be done with it.

Oh yea **** SHIELDS UP! worthless tool!

how to you block a country, or is this only in Cisco equipment. Are there standard IP / subnets I can place a deny rule for that would mock this feature?

do you have any other recommendations for checking open ports or just the plain old telnet (port)

Note:

even if per say the did mange to crack the login and password. Would it in theory still deny them being there wan is not matching or is the simple fact they get a login box suggesting that they would beable to access. In short. When accessing an ftp site. That has everyone denyed, does it still give a login prompt?

Quote:

---

I've had many people go over our firewall and it appears to be solid.

---

Apparently not since you are getting those entries on your IIS.

I have never used that router, but I believe for anyone to help you would have to supply the network layout and your firewall rules!

Is the IIS box on the DMZ ( WAN2 ) port?
From the documentation, one of the default rules is

Quote:

---

All traffic from the WAN to the DMZ is allowed.

---

Are your rules for the DMZ set up to override this? ( there are rules specific for wan2, and not just included in the LAN rules? )

The user guide suggests this is possible, though again, I have never used that router.

Quote:

---

Originally Posted by IKnowNot

Apparently not since you are getting those entries on your IIS.

I have never used that router, but I believe for anyone to help you would have to supply the network layout and your firewall rules!

Is the IIS box on the DMZ ( WAN2 ) port?
From the documentation, one of the default rules is

Are your rules for the DMZ set up to override this? ( there are rules specific for wan2, and not just included in the LAN rules? )

The user guide suggests this is possible, though again, I have never used that router.

---

No, Currectly they are only using Wan1 port WAN2 (DMZ is not configured but disabled.)

Do you suggest I look into DMZ and configure the IIS server to use this port?

Thanks for the help fellahs!
Phillip.

Quote:

---

Originally Posted by heavyfreak

how to you block a country, or is this only in Cisco equipment. Are there standard IP / subnets I can place a deny rule for that would mock this feature?

do you have any other recommendations for checking open ports or just the plain old telnet (port)

Note:

even if per say the did mange to crack the login and password. Would it in theory still deny them being there wan is not matching or is the simple fact they get a login box suggesting that they would beable to access. In short. When accessing an ftp site. That has everyone denyed, does it still give a login prompt?

---

For port scanning use nmap. But remember you have to have open ports.

For blocking and entire country. Not exactly what I meant. Sorry. I'd probably block
118.216.0.0 to 118.223.255.255 (Lookup via dnsstuff.com)

Most important DMZ!

Quote:

---

Originally Posted by dinowuff

For port scanning use nmap. But remember you have to have open ports.

For blocking and entire country. Not exactly what I meant. Sorry. I'd probably block
118.216.0.0 to 118.223.255.255 (Lookup via dnsstuff.com)

Most important DMZ!

---

We seem to get hit by a large range of IP, while I'll this is initially how we got into trouble to start off.
The router will only hold up to 50+ rules and we've used many of them already doing the WAN ftp trust. :confused:

I suppose I'm going to look into DMZ and see if it will do what I need.

::bangs head on desk::

Thanks again, Fellahs!

If you are not using WAN2, then the IIS box in on the LAN and you are port forwarding port 21 to that box?

Guess here is you have a rule or two out of order, or the nat-ing is causing the rules to be ignored.

Again, without seeing the complete rule set and the network setup there is no way for us to know.

And without having one to play with here is even worse!

So what type rule-set are you using to block the ftp?

Are you using rules on the LAN or WAN1?

Again, you should be able to write rules ( as you say you know the IPs of your customers ) to allow only them in and block everyone else. Then you would not have to worry about blocking certain countries at all.

Quote:

---

Originally Posted by IKnowNot

If you are not using WAN2, then the IIS box in on the LAN and you are port forwarding port 21 to that box?

Guess here is you have a rule or two out of order, or the nat-ing is causing the rules to be ignored.

Again, without seeing the complete rule set and the network setup there is no way for us to know.

And without having one to play with here is even worse!

So what type rule-set are you using to block the ftp?

Are you using rules on the LAN or WAN1?

Again, you should be able to write rules ( as you say you know the IPs of your customers ) to allow only them in and block everyone else. Then you would not have to worry about blocking certain countries at all.

---

Ok My linksys RV042 is connected as such..

IPS TO WAN 1, LAN to switches including all servers such as IIS box etc.

below are my denys and a few trusted. there are many more trested but this is the gist of it.


Allow FTP [21] WAN1 12.233.163.# ~ 12.233.163.2 192.168.#.# ~ 192.168.#.# Always


Deny All Traffic [0] * 121.14.5.# ~ 121.14.5.# Any Always

PassiveFT Deny PSVFTP [3000] WAN1 Any Any Always

Telnet bl Deny TELNET [23] WAN1 Any Any Always

CHNA Tel Deny All Traffic [0] WAN1 211.90.0.0 ~ 211.97.0.0 Any Always

Korea Tel Deny All Traffic [0] WAN1 125.128.0.0 ~ 125.159.255.# Any Always

fileshari Deny filesharin1 [6346] LAN Any Any Always

torrent Deny bittorrent [6881] LAN Any Any Always

fileshari Deny filesharing [2705] LAN Any Any Always


trsted ft Allow FTP [21] WAN1 198.140.240.10 ~ 198.140.240.10 192.168.169.251 ~ 192.168.#.# 6:0 ~ 23:0 Mon, Tue, Wed, Thu, Fri,

Allow FTP [21] WAN1 66.240.#.# ~ 66.240.#.# 192.168.#.# ~ 192.168.#.# 6:0 ~ 23:0 Mon, Tue, Wed, Thu, Fri,

Allow HTTPS [443] WAN1 Any 192.168.#.# ~ 192.168.1#.# Always

Deny All Traffic [0] LAN 60.16.0.0 ~ 60.23.255.255 Any Always

Deny MSG [135] * Any Any Always

Allow SMTP [25] * 209.26.#.# ~ 209.26.#.# 192.168.169.#~ 192.168.169.# Always

Deny SMTP [25] WAN1 Any Any Always
Allow All Traffic [0] LAN Any Any Always
Deny All Traffic [0] WAN1 Any Any Always
Deny All Traffic [0] WAN2 Any Any Always

This is the results of Nmap report.

21 tcp open ftp syn-ack Microsoft ftpd 5.0
113 tcp closed auth reset
443 tcp open http syn-ack Microsoft IIS webserver 6.0
990 tcp closed ftps reset
999 tcp closed garcon reset
1723 tcp open pptp syn-ack MoretonBay (Firmware: 1)
3389 tcp open microsoft-rdp syn-ack Microsoft Terminal Service
5678 tcp closed unknown reset
5679 tcp closed activesync reset
8080 tcp open http syn-ack Microsoft IIS webserver 6.0
60443 tcp open unknown syn-ack

heavyfreak , forget what I said in my PM. I do not think I am the one to help.

But I still think you should either remove the post with the rules in it, or at least obscure the IP addresses as in 12.233.x.x
That is a common and accepted way to post such information publicly.

I know, I am paranoid!

But when I see things like

Quote:

---

Allow HTTPS [443] WAN1 Any 192.168.169.249 ~ 192.168.169.249 Always

---

or

Quote:

---

Allow FTP [21] WAN1 12.233.x.x ~ 12.233.x.x 192.168.169.251 ~ 192.168.169.251 Always

---

and both the FTP and HTTP boxes are on your LAN, ..... I cringe. :shocked: They belong in a DMZ.
( is 12.333.x.x your public IP address? If it is then any rules that follow with less priority to deny access are useless! )

IMHO, I really think you need to sit down with someone proficient in network design and security, tell them what you have, what you need, and let them set things up for you from scratch!

Maybe dinowuff is available for hire?

:drink:



I though I had did that already!

I thank you fellahs for your time and quick responses! I'm going to look into DMZ and go that route. Worse case, keep an eye out for my

HELP DMZ setup now nothings working!!! post. Ha!

thanks again guys! :D