Windows Server Running IIS Fails PCI Compliance Scan

If your web server is failing a PCI compliance scan because a specially crafted HTTP/1.0 GET request without a host header is causing it to divulge an internal private IP address, then read on.

Problem

In IIS 7 on Windows Server 2008 and higher, there is a vulnerability that will cause it to accept such a GET request and respond with the internal IP address as the realm for basic authentication. This does not happen with an HTTP/1.1 request.

More Information

In this example, the GET request was for /autodiscover/autodiscover.xml, which is in the Autodiscover application under the "SBS Web Applications" site in IIS 7 on a Windows Small Business Server 2008 computer.

You can test for the issue with openssl on Linux by running the following command:

$ openssl s_client -host hostname.domain.tld -port 443

Substitute the actual hostname for hostname.domain.tld. The server will respond with a bunch of SSL information ending in "---" followed by a blank line. On that line, type or paste the following:

GET /autodiscover/autodiscover.xml HTTP/1.0
Accept-Charset: iso-8859-1,utf-8;q=0.9,*;q=0.1
Accept-Language: en
Connection: Keep- Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
Pragma: no-cache
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */* 

Send a blank line at the end; the server will not respond until you do. An example of a response from a server affected by the vulnerability follows:

HTTP/1.1 401 Unauthorized
Content-Type: text/html
Server: Microsoft-IIS/7.0
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
WWW-Authenticate: Basic realm="192.168.1.201"
X-Powered-By: ASP.NET
Date: Fri, 05 Sep 2014 16:25:59 GMT
Connection: close
Content-Length: 58

You do not have permission to view this directory or page.read:errno=0

Resolution

To resolve the issue in this example, do the following:

1. Open the IIS 7 console, expand SBS Web Applications and click on Autodiscover.
2. Double-click Authentication.
3. Right-click Basic Authentication and select Edit...
4. In the Realm field, type the server's public hostname in the format hostname.domain.tld and then click OK.
5. If applicable (e.g.: on Windows SBS 2008), repeat the above process for the Microsoft-Server-ActiveSync and EWS websites in addition to Autodiscover.

Performing the same test in this example should now yield the following response:

HTTP/1.1 401 Unauthorized
Content-Type: text/html
Server: Microsoft-IIS/7.0
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
WWW-Authenticate: Basic realm="hostname.domain.tld"
X-Powered-By: ASP.NET
Date: Fri, 05 Sep 2014 16:30:41 GMT
Connection: close
Content-Length: 58

You do not have permission to view this directory or page.read:errno=0

Windows XP System Restore from Safe Mode with Command Prompt

If Windows XP has become unstable and you can't even use Safe Mode, but Safe Mode with Command Prompt still works, you can still launch System Restore.  Here's how:


http://support.microsoft.com/kb/304449

LogMeIn

One of my most trusted and relied upon tools is LogMeIn.  I use this almost daily to remotely control computers.  I install LogMeIn on all of my clients' servers so that I can remotely access them as needed.  I also install it on my clients' desktop and laptop computers so that I can help them with problems remotely instead of scheduling a service call.  It saves a lot of time and gas.


LogMeIn is very secure and works very well.  The free version does everything I need in most cases.  There's also a paid version that enables additional functionality such as remote printing and file transfer.


LogMeIn works closely with Intel and they have developed technology that allows you to remotely control a computer through LogMeIn below the operating system level (out-of-band).  That means that you can remotely get into BIOS and change settings and even remotely install an operating system.  The technology is available on some computers and motherboards now and will be available on more models in the future.


Besides the version that you have to install on the computer that you want to remotely control, they also have a free beta service called LogMeIn Express that lets you hold online meetings and remotely assist people who don't have any other remote access to their computer.  It even lets you transfer files!


Check out LogMeIn and LogMeIn Express:


http://www.logmein.com/
http://www.logmein.com/express/

MAC Address Lookup

If you've ever tried to track down an unknown computer on a network and all you have to go on is the IP address, hostname and/or MAC address, any additional information can help save time.


Often, it's helpful to know the manufacturer of the computer's network interface.  If you knew it was made by Dell, then you could save a lot of time by just looking for Dell computers.


There's a website that lets you put in the first half of the MAC address and then tells you who the manufacturer of that device is. I've relied on this site for years.  Here is the link:


http://coffer.com/mac_find/

Exchange Remote Connectivity Analyzer

Want to test remote connectivity to your Exchange Server?  Here's a Microsoft website that does exactly that:


https://www.testexchangeconnectivity.com/