????? ?????? ??? ????? ?????? ?? ??????? IIS

???? ???????: 207671 - ??? ???????? ???? ????? ????? ??? ???????.
????? ???????? ????? ????? ??????? ?????? ?????? ???????
????? ???? | ?? ????

?? ??? ??????

??????

???? ??? ??????? ??????? ??? ????? ?????? ??? ??????? ???????? ??? ??????? ??? ???? ???? ??????? ?????? (IIS) ?? ???? API ???? ?????? (ISAPI) ?? ???? ????? ?????? ?????? (ASP) ?? ????? ????? ???????? ??????? (CGI). ???? ??? ??????? ??? ???????? ???????? ??? ???????? ???????? ???? ????? ???.

??? ????? ?? ?? ????? ??? ??????? ???? ????? ?? ???? ?????? ??? ????? ??? ??????? ?????? ????? ??? ???????? ??????? ????? ??????? ?????? ?????. ?????? ?????? ??????? ??????? ???? ????? ????????? SQL Server ????? ????????? ???? ???? ?????? (COM) "?" ??????? ????? ???? (RPC). ???? ???? ??? ??? ???????? ????? SQL Server ??? ???? ?? ?????? ???????? ???? ?????? "?????? ?? Microsoft Windows NT ????? ??????? ???? ????????? ??????? ?? ??? ???????. RPC ?COM ???? ????? ??????? ????? ??????? ?????? ???? ????? ??? ????? ???????? ?????? ??????. ????? ???? ????? ???????? ?? ??? ??????? ??? ?????? ?????? ?? ?????? ????? ???? ??????? ???? ?????? ?? ??????? IIS.


?????? ?????? ????????

????? ????? IIS ??? HTTP, ????? IIS ???????? ???? ??? ????? ?????? ??? ??????? ??? ?????? ????? ???? ?????. ???? ?????? ??????? ????? ??? ??? ???????? ????? ?????. ??? ???? ?????? ???????? ????? ???????? ???????? ?? IIS 4.0: 
Authentication Type                          Impersonation Type
  
Anonymous Access (no authentication)         Network
Auto Password Synchronization is
ON (ON=default)
 
Anonymous Access (no authentication)         IIS Clear Text
Auto Password Synchronization is OFF         

Basic Authentication                         IIS Clear Text 

NT Challenge/Response Authentication         Network 

Client SSL Certificate Mapping               Interactive

????? ????? ??????

?? ?? ?? ??? ?????? ??????? ??? ????? ?????? ????? ??? ??? ??? ?????? ???? ???? ??? ???? ?????? ?????.
  • "NOT" ????? ?????? ??????? ???? ??????? ?????? ??? ????? ???? ???????. (?????? ??????? ?????? ??? ????? ??? ??? traditionally ??? ????? ??? ????? ?? ????? ?????? ?????? ???? ??? ?????? ?????? ??? ??????. ?????? ?????? ???????? ???? ?? ????? ?????? ????? ???? ???? ????? ? ?????? ??? ???? ??? ???? "?????" ?? ????? ???? ???? ??????.)
  • ??? ??????? ?????? ??????? ??????? traditionally ??? ?????? ?????? ???? ??? ???? ?????????. ??? ?????? ?????? ??????? ?????? ??????? ??? ??????? ??? ??????.
  • ?? ????? ?????? ??????? ?????? ????? ???? ???? ???? ????? ???? ??????. ?????? ??????? ?????? ?? ???? ???? ?? ?????? ??? ??????.
????? IIS ????? ????? ?????? ?? ???. ????? ?????? "??? ?? ????? ??? ????? ????? ?? IIS ???? ?????? ??? ?? ?? ??? ???????? ????? ?????? ?? ?? ????. ????? ?????? ?? ?? ??? ??? ????? ???? ?? ??? ?????? ??? ???? ??? ???? ?????? ?? ????? ???? ??????? ?????? ????? ??????? LogonMethod ?? ????? ?????. ?????????? ????? ??? ???? ?????? ??????? ?????? ?? ??? ???? ?? ?????? ??? ????? ???? ???????. ???? ????? LogonMethod ?? ?????? ?? ?? ?????? ?????? ??????? ?????? ?? ????? ?????.

impersonates ?????? ??????? ??? ???? ????? ??????? ????? ?????. ?????????? ???? IIS ???? ?????? ????? ???? ???? IUSR_ <machinename>??????? ??? ?????? ??? ??? ??????. ???? ??????? ??? IIS 4.0 ??????? ???? ???? "????? ?????? ?????? ?????????" ?????? sub-authority ???? ?????? ????? ??????. ?????? ??????? ???? ?? ??????? ???? ??????? ???? ?????? ??????? ?????? ???? "NOT" ???? ?????? ??? ????? ????????? ?????? ??? ???? ???????. ??? ?? ????? "?????? ???? ?????? ?????????" IIS ????? ????? ?????? ???? ??????? ???????? ?????? ?? ???? ???? ??????. ?????? ???? ?????? ???????? ??????? ??? ?? ??? ???????? ???????? ??? ??? ????????? ??? IIS. ????? ??? ??? ?????? ?????? ??????? ??? ???? ???? ?? ????? ??????? "?????? ???? ?????? ?????????" ????? ????? ???? ?? ???. ????????? ??? ??? ????? IIS ??? "???? ???? ?????? ????????". ?? ??? ??????? ??? ?????? ?????? ??? ????????? ??????. ???? ????? ?????? ??????? ? ?????? "?????? ???? ?????? ?????????" ?? ?????? ?? ?? ?????? ?????? ??????? ?????? ?? ????? ?????.

??? ?? ???? ???? ??? ????? ?????? ????? ???? ?? ?????? ??? ???? ??? ??????. ??? ????? ?????? ???? ???? ?????? ??? ?????? ??? ??????. ?????????? IUSR_ <machinename>???? IIS ????? ????? ??????? ????? ??? ????????? ?????? ???. ??? ?? ???? ????? "?????? ???? ?????? ?????????" ???? ????? ?????? ??? ?????? ????? ?????? ???? ???? ?????? ??? ????? ???? ??????? IUSR_ <machinename>????? ??? ??? ???? ?????? ??? ????? ???? ??????? ???? ??? ??? ?? ???? ??? ??? ????? ??? ????? ??????? ????. ??? ???? ?????? ??? ????? ???? ??????? ?? ??????? ??????? ??? ??????? ?????? ????????? ???? ?? ???? ??? ???? ??????? ???? ?????? ???? ?????? ???? ????? ?????????. ??? ??? ?????? IIS ??? ???? "???? ??????" IUSR_ <machinename>?????? ?? ???? ???? ??? ??? ?? ??? ?????? ????? ?????? ????? ????????? ?????? ??? ???? ??????? ??? ????? ????? ?????.


avoidance ???????

???? ??? ??? ????? ???? ????? ??? ?????? ??? ????? ???? ??????? ?? ????? IIS:
  • ????? ??????? ??? ????????? ??????.
  • ?? ????? ??? ?????? ????? ?????? ????? ????. ???? ?????? ?????? ???? ????? Windows.
  • ????? ????? ?????? ??????? ??? ????? ???? ??????? ?? ????????? ?? ???? ????? ???? ????? ??:
    "?????? ?????? ??? ??????? ???."
    ??? ????? ???? ???? ?????? ??? ????????? ???? ????? ????? ?????? ?? ???? ????? ?????? ??? ???? ?????? ???? ?????. ". ???? ??? ??? ????? ?? ??? ???????? ???? ?? ????? ?????? ???????. ???????? ??? ?????? ????? ???? ??????? ??? ?????? ???? ??????? ?? ???????? ?????? ??? ????????? IIS.
  • ??????? ???????? ???????? ?? ???????? ???????? ??? "?????? ???? ?????? ?????????".

    ???? ???????? ???????? ???? "???? ??????? ??????" ??????? ???????? ???????? ????? ??? ???? ???? ?????? ??? ????? ???? ??????? (???? ??????? ?????? Windows NT/? ????? ???? ??? ???? ?? ???? ?????? ??? ????? ???? ???????). ?????? ??? ???????? ???????? ????? ?????? ???? ??? ?????? ??? ???? ???? ????? ??? ?? ????? "?????? ???? ?????? ?????????". ???? ???????? ??? ????? "?????? ???? ?????? ?????????" ??? ????? "???? ??????? ??????" ?????. ?? ??? ???????? ????? ????? ?????? ?????? ????? ????? ?????? ??? ????? ???? ???????.
    259353
    (http://support.microsoft.com/kb/259353/ )
    ??? ????? ???? ?????? ?????? ??? ????? ???????? ???? ??????
  • ????? ?????? ??????? ???? ????.

    ??? ???? ????? ????? ?? ?????? ??????? ??? ??????? ??? ??????. ???? ???? ????? ????? ?? ?????? ??? ?????? ???? ??? ?????? ?????? ??????? ??? ???? ???? ??? ??????? ???????? ???? ????? ???? ???.
  • ????? ?????? ??????? ???????? ??? ??? ???????? ????? ?????? ??? ???? ????????? ???? ??? ?????? ????? ???? ??????? ?? ?? ?????? ?? "?????? ???? ?????? ?????????".

    ??? ??? ???? ???? ?????? ?? ?? ?????? ????? ?????? ??????. ??? ??? ??????? ??? ??????? ????? ???? "????? ?????? ??????? ????? ????" ???????? ?????? ??? ???? ???? ??.
  • ???? ??????? NullSessionShares ? NullSessionPipes ?????? ??????? ??? ?????? ???? ????? ?? ??? ????? ????? ???? ??? ?????? ????? ????? ?? ?? ??? ???? ?????.

    ??? ??? ???? ??? ???? ????? ?????? ????? ????? ????? ???? ????? ???? ??????? ????? ????? ????? ???? ????? ??? ?????? (????? ????? "?????? NULL"). ??? ????? ??? ??????? ??????? ??? ????????? ???? ????? ???? ???? ??????? ???? ??? ????????? IIS. ??? ????? ?????? NullSessionShare ?? NullSessionPipe ?? ??? ?????? ??? ??????? ?????? Microsoft Windows ????????? ?? ?????? ??? ?????? ???????? ??? ???? ???????? ???? ???????? ???? ?? ???????.
  • ????? ????? ???????? ????? ?? ?????? ??? ???? ????? ??? ???? ?????? ???? ?? ??????? ?? ????.

    ???? ??????? ?????? LogonUser ??????? ImpersonateLoggedOnUser ????? ???? ?????. ????? ??? ???? "??? ??" ??? ???????? ????? ?????? ????? ??? ???????? ??? ????????? ???????? ?????? ??. ????? LogonUser ????? ?? ?????? ???? ?????? LogonUser ?? ?????? "????? ???? ?? ???? ???????" ?? User Manager. ???? ???????? ??? ????? ???? ???? ?????????? ????? impersonates IIS ????? ?????? ??? ?? ??? HTTP ?? ???????? ???. ??? ???? ???? ?????????"?? ??????" ????? ?? ????? ?????? ?? ???? ?????? ??????? ??? ????? ??? ???? ?????? ?????? ??? ?????? ?????? ?????? "????? ???? ?? ???? ???????". ??????? DLLs ISAPI ???? ??? ??????? ?? ????? ???? ????? ????? ???? ?????? ???? ?? ??????? ?? ??? IIS ??? ???? ?????? ?????? ???????? ???? RevertToSelf. ??? ??? ???? ?????? ??????? IIS "???? Process" ??? ?????? ?? ???? ???? ??????? ???? ???? ??????? ??? ??????? ??? IWAM_ <machinename>???? ? ???? "?????? ??????". ???? ???????? IWAM_ <machinename>"" ?? ?????? ?????? ?????? "????? ???? ?? ???? ???????".
  • ????? ???? ???? ?? ???? ASP ???? Server ???? ????????? ?? Microsoft "(MTS) ?? ?????? ???? COM + ?? ?? ?????? ?????? ???? ????? ??????.

    ?????? ??? ????? ?????? ?? ??? .exe ?????? ???? IIS.
  • ?? ?????? ??????/????? ????? ???? ?? ???????? ????? ???????? ???????? SSL ???? ?? ????? ?????? ?????? ??? ?????? ???????? ?? ???? ???? ?????. ?????? ??? ???? ?? ????????? ??? ????? ????? SSL ???? ??? ??? ??????? ?????? ?????? ?? "????? ??????? ?? Microsoft:
    228991
    (http://support.microsoft.com/kb/228991/ )
    ????? ????? ?????? ????? SSL ?? Internet Information Server 4.0
?????? ?? ???? ??? ?????? ??? ???? ??????? ??????? ????? ??? ??? ????? ?????? ????? ?????? ? ????? ???????? ???????? ???????? ???????? (?? ??? ?????? ????? ??????) ??? ??? ?????? ??????? ????? ??????? LogonMethod ??? "2" (??????? ??? ??????? ????? ???? ???? ????? ?????? ??? ?????? ????). ??? ??????? ??????? ??????? ?????? ????? ???? ????? ?????? ?????? ??????? NullSessionShares ?? NullSessionPipes.

?? ?????? ???? ?????? ??????? ???? ?? ??????? ??? ??????? ??????. ?? ???? ??? 26 ??? ?????? ??????? ???????? ?????? ?? ???? ??? ????? ??????? ??? ???? ????? ???? ?? ?????? ?? ???? ???? ?????? ???? ?? ???? ?????. ????? ?? ???? ??? ????? ??????? ????? "?????? ??????? ???????" (UNC) ??????? ??? ???????. ??? ?? ???? ??????? ????? ??? ???:
\\MyServer\filesharename\directoryname\filename
?????? ??? ???? ?? ????????? ??? ??????? UNC ???? ??? ??? ??????? ?????? ?????? ?? "????? ??????? ?? Microsoft:
280383
(http://support.microsoft.com/kb/280383/ )
?????? ???? IIS ??? ??????? ?????? UNC
????? ????????? ?? ??? ?????? ??? ??? ???? "??????? ??????" 4.0. ?? ???? ??????? ?????? 5.0 (???? ?? ??????? ?? Windows 2000) ? ???? ??????? ???? ??? ????? ???????? ????? ????????. ??? ????? ?? ??? ????? ????? ???? ?????? ?? ??? ??????? ??? IIS 5.0 ? ?????? ??? ????? ?????? ??????? ???????? ???? ??? ??????? ?? ??? ????? ???????? ?? ??? ?????? ????? ????? IIS 4.0.

319067
(http://support.microsoft.com/kb/319067/ )
????? ????? ????????? ??? ?????? ?? ???? ???? ??????
???? ?? ????? ?? ????? ???? ??? ????? ?????? ??? ???? IIS ??????? ?? ????? ???? ????? ??????? ?????? ????? ?????? Logoffs. ???? ??????? ???????:
  1. ???? ??? ???? ? ???? ??? ??????? ? ????? ??? ???? ?????? ? ???? ??? ????? ?????? ?? ???? ??? ??? ?????? ??????.
  2. ??? ??? "??? ?????? ??????" ?? ????? ?????? ?? "????? ??? ??????" ???? ??? ??????? ?????? "? ???? ??? ????? ??????? ?? ???? ??? ??? ???????.
  3. ???? ????? ??????? ??? ????? ????? ????? ?????? ??? ?? ???? ??? ???? ????. ??? ????? ??????? ??? ??????? ??? ??? ??????. ????? ????? ??? ????? ?????? ?????? ????? ??? ?????? ????? ??? "??? ????? ??????":
2 = ??????
3 = ???? ???????
4 = ????
5 = ??????

???? ??? ?????? | ????? ???????

?????

????? ?? ????????? ??? ???? ?????? ???? ??? ????? ???????? ??????? ?????? ?? "????? ??????? ?? Microsoft:
124184
(http://support.microsoft.com/kb/124184/ )
??? ????? ?????? ??? ???? ?????? ?????? ??? ???? ???????
180362
(http://support.microsoft.com/kb/180362/ )
????? ??????? ??????? ?????? ???????
319067
(http://support.microsoft.com/kb/319067/ )
????? ????? ????????? ??? ?????? ?? ???? ???? ??????
280383
(http://support.microsoft.com/kb/280383/ )
?????? ???? IIS ??? ??????? ?????? UNC
259353
(http://support.microsoft.com/kb/259353/ )
??? ????? ???? ?????? ?????? ??? ????? ???????? ???? ??????
???? ??? ?????? | ????? ???????

???????

???? ???????: 207671 - ????? ??? ??????: 29/????? ???????/1429 - ??????: 6.2
????? ???
  • ???? ??????? ?????? 3.0
  • Microsoft Internet Information Server 4.0
  • Microsoft Internet Server Application Programming Interface 4.0
  • Microsoft Internet Information Services 5.0
????? ??????: 
kbmt kbhowtomaster kbhttp KB207671 KbMtar
????? ????
???: ??? ????? ??? ?????? ???????? ?????? ????? ???? ????? ?????????? ????? ?? ????????? ?????? ????. ???? ???? ?????????? ???? ?? ???????? ???????? ?????? ????????? ????? ????????? ???????? ????? ???????? ?????? ?? ?????? ??? ?? ???????? ???????? ?? ????? ??????? ?????? ??? ??????? ?????? ??. ?????? ?? ???? ??? ??????? ???????? ????? ?? ???? ????? ?????? ??? ????? ??? ????? ??????? ?? ????? ?? ?????? ??? ??? ??????? ??????? ?? ????? ????? ????? ????? ?????. ?? ????? ???? ?????????? ??????? ??? ????? ?? ??????? ?? ????? ?????? ?? ??? ????? ?? ????? ??????? ?? ???????? ?? ??? ???????. ???? ???? ?????????? ???????? ??? ????? ?????? ??????? ??????
???? ??? ????? ??????? ?????? ??????????207671
(http://support.microsoft.com/kb/207671/en-us/ )
???? ??? ?????? | ????? ???????

????? ???????

 
???? ??? ?????????? ??? ??????