#server 2003

I work doing mostly Tier 2 and a bit of Tier 3 IT Support for my full time job. I mostly really enjoy it. There are days, however, where you just want to grab your French Press mug, your tool kit and walk right out of the door. I recently had one of those days.

In the morning I heard whispers from my manager’s direction of a Windows 2K3 box no longer booting. “Haha!” I thought “I’m glad that’s a server, we won’t need to touch it! Jokes on you, server team!”. The joke, infact, was on me. The server team rejected the incident as it turns out that the server is located underneath someone’s desk and argue that it falls out-with their remit. Into my stack it goes.

On visiting the desk and talking to the analyst that administers it, it turns out that the machine has been sitting underneath the desks of various users for the last ten years. So lets have a quick look over what I picked up on:

Is a small form factor HP 5100

Machine is at least ten years old

Is standing up on its side with no support, next to people’s feet

Is used by devs on a daily basis

HAS NO BACKUPS

I laughed. It was either that or I would start crying. I tried reseating everything in the dusty old thing first in case someone had knocked it over and a connection came loose, but no dice. As soon as I get to BIOS, I’m being told that the drive is goosed, there’s no option for safe mode and it’s unreadable as a slave when booting into Ubuntu from a USB drive. In nicer words, I advise the analyst that they might be fracked. I’m a professional, you know.

I remove the disk from the machine and very carefully make my way back to my desk.

I bought Spinrite a couple of years back when a friend’s secondary disk was in a similar state. They had years of photos that hadn’t been backed up and would have been devastated if they couldn’t be recovered. Ever since then, I’ve been looking for excuses to try the tool out to see if it’d resolve the issue. I pulled out my version, as I’ve tried to get the licensing team to buy this in for a while, but I’ve always been knocked back.

Spinrite, save me

I hooked the disk up to a spare machine at my desk. Everything kicked off alright. The first hour presented a few bad sectors, but nothing major. After the photo was taken, everything kicked off though. I was getting more unrecoverable sectors than not. Thankfully it was just a 40GB HDD, so it only took a few hours to go over the whole thing, switching to level 2.

Towards the end of the day, I moved the HDD back over and took a deep breath as I pressed the power button. No SMART error for a start was a good sign, and although it took a long time, Server 2003 started to boot and we were at a login screen. Something was definitely corrupt as the text entry boxes were all black, but you could still type in details and log in. I swiftly, but safely, took the box back to the analyst who handled it before and couldn’t express clearly enough how this needed to be backed up and decommissioned. They advised that a server analyst would be creating a new VM instance and they’d be migrating everything over there when done.

I returned to my desk victorious, but uneasy. I know how things go in there. We’d be hearing from the analyst again soon. Surely enough, an incident was logged a week later for the same issue. I handed the Spinrite disk to a colleague and wished them good luck. It wasn’t going to go as well as it did for me the last time.

Backup, yo!

By now, almost everyone is aware of Microsoft’s Windows XP’s official end-of-life, which took place last year.  This year, another popular Windows version is also going to have its support dropped.

Windows Server 2003is the “bigger brother” to Windows XP, and is designed to run on all kinds of servers, ranging from a simple file server for a small business to clusters of servers in a datacenter.…

A user reported having a hard time shutting down her Windows XP machine. By design (though not my own), the PC has no access to the internet, which is accomplished by assigning a static IP with no default gateway. The user would initiate the shutdown process from the Start menu, and the PC would hang there for several minutes - sometimes up to ten - before showing the shutdown dialogue. 

I thought at first that the PC was having trouble contacting the DC on the network. I know that Windows PCs on a domain can act funny if they cannot contact the DC.  A ping to the server's hostname resolved to a WAN address, and not even the correct one for this particular network. I thought this was odd, so I checked the DNS entries in the LAN adapter. This was set to the gateway address for the network. I set it instead to the IP for the DC, and just to be sure, I added an entry to the HOSTS file for the server. I could then ping the DC by name. I shut down the PC with no problems.

However, the user came back about a half hour later, saying the problem had come back. She tried to shutdown, and it sat for five minutes before showing the dialogue, and then sat for another five with the "Windows is shutting down" message. 

I finally check the system event log, and found a DCOM error right about the time.

(NOTE: The time in the image is not correct, as this was an image I found here. Thanks to OP!)

Some Googling found a handful of articles describing the same problem with shutting down. It appeared to be a problem with Windows Updates. Because the PC has no access to the internet, and WSUS had not been configured on the domain, the Update service was locking up when trying to shut down. 

Let me start out this post by saying that normally I would enter this sort of thing in my KB section of my blog.

Assumingly you would need to recover the passwords for IUSR_[machinename] or IWAM_[machinename] if you changed the account in IIS that a particular site was running as, and now you would like to change it back to IUSR_[machinename].

Let's take it from a security approach today. Let's say you're a pen tester or have "other intentions", and you "somehow gain access to a windows 2003 IIS web server."

Of course you could create accounts, modify passwords, etc, but isn't that a little TOO noticeable(YES)?!!

How about acting as an account on the machine?! Since you're on a 'box running IIS and if it's windows and not some taped up mesh solution, there is likely two accounts with various permission sets that already exist on the server. You can run as these accounts with little effort and zero cracking.

These two accounts are to help out IIS in running services and authenticating guest users, and set a (random?) long password during the iis installation.

There is actually a tool that can help you determine what those passwords are..provided by microsoft.

You'll need to have the windows server support tools installed and your gem will be adsutil.vbs.

The article at http://www.windowsitpro.com/article/passwords/how-can-i-check-the-password-of-the-iusr-and-iwam-local-accounts-on-a-machine-describes how to use adsutil to dumb the passwords of the two accounts, as well as change them if needed.

But since we're staying stealth, lets just dump them.

The prior mentioned web site says:

You first need to update the adsutil.vbs script, which you'll find in the AdminScripts folder under the Inetpub folder, to display sensitive information (e.g., passwords) instead of just asterisks. Open the adsutil.vbs file in Notepad and search for the text "IsSecureProperty = True", replace this text with "IsSecureProperty = False" and save the file. Now run the following commands to return the passwords(/anonymoususerpass is the IUSR account; /wamuserpass is the IWAM_ account).

Note: this is around line 2592, right before the Else condition. Then, run the following commands(in bold)

C:\Inetpub\AdminScripts>cscript adsutil.vbs get w3svc/anonymoususerpass anonymoususerpass : (STRING) "/XEv`J01T"!69I" C:\Inetpub\AdminScripts>cscript adsutil.vbs get w3svc/wamuserpass wamuserpass : (STRING) "ikI37Q"W5\[,uu%"