IIS Admins Beware - Get your systems patched

Quote:

---

Originally posted here by Tiger Shark
DJM: I reran it against a real web site, (one of my own), and got the following reply:

www.mydomain.com: Asib Pazir Nist

Do we have any speakers of Arabic out there that can make a bit of sense out of this for us non-arabic types?

---

I did a search with google and found the following site: http://www.iranian.com/May96/Opinion/GolAgha.html

Quote:

---

Note: A common Iranian is usually referred to as Asib Pazir or "vulnerable" because he or she is vulnerable to inflationary pressures.)

---

So vulnerable.. something..

Quote:

---

Originally posted here by CXGJarrod
hmmm... I did (in DOS) tool.exe ip Address and it came up with a little text.

---

I get the same response with either IP address or domain name.

Quote:

---

<< SERVER MS-IIS NADARAD >>

---

:confused:

Cheers:

DjM: same here. I just tryed it on a default installation of IIS and it did the same thing. Well maybe its not as useful as I originally thought.

Results for me: << Ip Address Asib Pazir Nist >>

One search of NADARAD brought up the word morality (although I'm not sure if it has the same meaning). Guessing I might guess that it means it's secure or safe.

Have you checked to see if this "tool" isn't, in fact, sending information out?

MsM: I hate to say this without confirmation but I'll make a wild @$$ed guess that nist is Iranian for "not". It would fit with your research making the entire phrase "vulnerable not" and it is not unusual to have the negative after the verb in many languages. Also many languages negatives begin with "n".

[EDIT]

with regard to it sending info out: I was watching my machine with a HIDS and Ethereal and the server has HIDS too...... NOT a peep from either that is suspicious unless it has scheduled it but I have no additiona processes or services running.

[/EDIT]

That coupled with the fact I ran some other tools against that particular server this am to see if I was missing any patches and it came up good would further imply that the phrase means not vulnerable.

DJM: if i am right above, and looking at the syntax of the message it gave you, I would take a look at that server if it is open to the public. If I am right that my phrase means "not vulnerable" then logically yours implies "vulnerable"..... :eek:

CXG: I ran it against my same domain but only using the IP and got my same message back. Then I ran it against an IP with no web service and it came back with "Irad az Connection".... I think we can all guess that one....LOL

[EDIT]

What service pack and patch level are you running though. If they are only giving us 28 out of 255 a simple SP3 might block the 28 holes

[/EDIT]

Quote:

---

Originally posted here by MsMittens
Have you checked to see if this "tool" isn't, in fact, sending information out?

---

netstat shows no unusual connections, and my firewall is functioning and not complaining. I don't think the tool is trying to phone home.

Cheers:

Quote:

---

Originally posted here by Tiger Shark
DJM: if i am right above, and looking at the syntax of the message it gave you, I would take a look at that server if it is open to the public. If I am right that my phrase means "not vulnerable" then logically yours implies "vulnerable"..... :eek:

---

We don't have any IIS servers open to the public, they are all behind the firewall and most are just development servers.

It would be nice if we could get a clear translation of what this tool is telling us, guessing could just lead to needless panic attacks :D

Cheers:

Doesnt look like the tool is living up to its description. I tried it on a default installation of IIS on a Win2k Service Pack 3 Box and it gave the same message.

OK.... I figured..... Screw this..... :D

If I can't understand the Iranian I can see what it is actually doing via Ethereal 'cos my server speaks english........

The dump shows that it is simply looking for scripts or files in the scripts dir that are known vulnerable, MSADC exploits, and all the other nice little ones that come with a code red/nimda event. Though when it tries to exploit cmd.exe vulnerabilities it seems to issue strange commands, (I'm guessing it's english written arabic commands for cmd.exe).

[EDIT]

Duh..... It's issuing echo commands and the subsequent text is english written arabic..... Sometimes my lack of observation astounds even me.....<s>

[/EDIT]

Needless to say my server replied with "404 - Object not found" for each event thus indicating "Asib Pazir Nist" really does mean "Not Vulnerable" therefore indicating that it found some vulnerability on DJM's server.

Basically if your permissions are set correctly and you are not previously compromised, (cmd in the scripts dir for example), this tool isn't much different to any other skiddie scanner.

Quote:

---

Originally posted here by Tiger Shark
Needless to say my server replied with "404 - Object not found" for each event thus indicating "Asib Pazir Nist" really does mean "Not Vulnerable" therefore indicating that it found some vulnerability on DJM's server.

---

Thanks for the work Tiger, I likely won't look into what is wrong with that IIS server for two reason (well this will make it three) it's behind the firewall, it's old and is scheduled to be upgraded and ported to Apache. The fact it's a vulnerable piece of crap may speed up the process of replacing it.


Cheers:, I owe ya a beer.

DJM..... Glad to have helped you with your Piece of Crap.....LOL

Labbats Blue is my poison of choice and if you are near Detroit I can give you the address of my hangout and you can buy it in person....

Tiger Shark, (Who has _never_ been known to turn down a beer)