Serv u software attack defense

Before reading this article, there are a few points to note.

1, everyone's full control of the directory must not appear on the server.

2, the permissions on the WEB directory are independent. The general case is read and write, no run right

3, ipsec has defined the relevant outbound port access

Serv-u local default management port, log in as the default administrator Create a new domain and user to execute the command. The default local management port of Serv-u V3.x or later is: 127.0.0.1:43958, so only the local machine can be connected. Default administrator:

LocalAdministrator, default password : #l@$ak#.lk;0@P, which is integrated inside Serv-u, can be connected with Guest permission, manage Serv-u, as shown in Figure 1

Prevention methods and countermeasures: Serv-U v6 and below versions can directly modify the files ServUDaemon.exe and ServUAdmin.exe with Ultraedit, and change the default password to other characters of the same length, use

Ultraedit opens ServUAdmin.exe to find the last B6AB (43958 hex), replaced with a custom The port is, for example, 3930 (12345), but because serv-U v6 or later has a remote buffer overflow vulnerability, it is not recommended to use

serv-U v6 or higher. You can add LocalSetupPortNo=12345 to ServUDaemon.ini. Can change the default management port, use ipsec to limit any IP access to 12345 port access

, that is, increase the blocking of port 12345, if you do not change the default port, increase the blocking of port 43958, if "use setting changes The password " button, that is, add the MD5 password such as

LocalSetupPassword=ah6A0ED50ADD0A516DA36992DB43F3AA39 in ServUDaemon.ini, if the default management password is not modified, the original #l@$ak#.lk;0@ P is still saved only when the password is empty, plus the management port's limited LocalSetupPortNo=12345, of course, the program also needs to change the port

Set the directory permissions, by removing the Web directory IIS accesses the user's execution permission to prevent the use of Webshell to run the Exp program, but this method has certain limitations, there are many directories to be set, there can be no omission, if there is a directory setting error, it will It is possible to upload and run Exp in this directory, because the permissions on the WEB are independent. In general, it is read and write. There is no running right. Then it is unlikely to upload other files for execution. Modify Serv-u installation. Directory C:\\Program Files\\Serv-U permissions (for example, this directory, but for security, please do not use the default directory), the administrator group has full control, refuses the Guest group users to access the Serv-U directory, this is to prevent users from using webshell To download ServUDaemon.exe, use Ultraedit to open the Serv-U account password, and modify the compile upload operation, then the previous work has no effect, because the default management port has been modified in the program file, in ServUDaemon.ini It has also been modified, so the default administrator connection is not on the

the last one, because Serv-U is started by the service, the default is to run with System privileges. The possibility of privilege escalation. Just change the Serv-U boot user to a USER group user, then there will be no so-called privilege escalation. However, it should be noted that this low-power user must have full control over the Serv-U installation directory and the directory or drive letter that provides the FTP service. It has been found through testing that Serv-U started with ordinary group users cannot add users and delete users, and everything else is normal.