/*

This mitigation should help block attempts to exploit the IIS
semicolon zero-day (BID 37460), but no warranties and no guarantees.
It didn't crash my web servers during testing, but I make no
representations as to how it will or won't perform on anyone else's
web servers.  This mitigation is only intended for IIS 4.0, 5.x, and
6.0; IIS 7.0 does not appear to be vulnerable (although in my
testing, IIS 4.0, 5.0, and 5.1 didn't appear to be vulnerable,
either), and 7.5 is also reportedly not vulnerable.

If an attack is blocked, it should show up in the IIS logs with HTTP
status 403 and the made-up substatus 59; for example, on IIS 6.0:

  2009-12-27 12:34:56 W3SVC1 169.254.123.200 GET /evil.asp;x.jpg
  - 80 - 169.254.123.100 Mozilla/4.0+(compatible;+MSIE+...) 403 59 0

When passed a malformed file name by IIS due to the vulnerability,
most (non-.NET) ISAPI extensions will process the file, including:

  asp.dll / asp51.dll:  .asa, .asp, .cdx, .cer, .htr
  httpodbc.dll:         .idc
  ssinc.dll:            .shtm, .shtml, .stm

So to get the most protection, you'll need to remap the file
extensions for each different ISAPI extension to a different copy of
the mitigation DLL -- it uses the file name with which it loads to
figure out which ISAPI extension it's wrapping.  You'll also need to
set up the registry to tell it where to find the ISAPI extension it's
replacing.  For example:

  [HKEY_LOCAL_MACHINE\SOFTWARE\iissemi1]
  "iissemi1_asp.dll" = "C:\WINDOWS\system32\inetsrv\asp.dll"
  "iissemi1_ssinc.dll" = "C:\WINDOWS\system32\inetsrv\ssinc.dll"

Try out a malformed file name after deploying to make sure you have
everything set up properly.

Sorry I can't host an installer right now to automate all of this.
Hopefully most people won't need to use this mitigation, but if the
other options for reducing exposure aren't viable in your situation,
I hope this one will be.

-- Derek


P.S.  The vulnerability can also be exploited if a subdirectory
      containing ".xxx;" can be created; for instance, accessing
      "/~y.asp;y/z.jpg" would cause "z.jpg" to be executed by the
      ASP ISAPI extension as though it were an ASP script.

*/

////////////////////////////////////////////////////////////////
// iissemi1.cpp
//==============================================================
// Mitigation to prevent processing of file names that contain a
// semicolon or aberrant colon, to guard against the IIS
// semicolon zero-day.
//
// All file extensions that would normally execute an ISAPI
// extension must be manually remapped to a copy of the
// mitigation DLL.  The mitigation works by passing requests to
// the original ISAPI extension unless they contain a semicolon
// or improper colon.  It is hard-coded to track down asp.dll
// and a few other DLLs, if the mitigation DLL itself loads with
// a file name that indicates which ISAPI extension it's
// replacing; to override this default behavior, or to support
// an unrecognized ISAPI extension, add a registry value
// matching the mitigation DLL's file name in the
// "HKEY_LOCAL_MACHINE\SOFTWARE\iissemi1" registry key.
//
// To build:
//
//  1. Start Visual Studio 2008 (2005 should also work)
//  2. File -> New -> Project
//  3. Choose Visual C++: Win32: Win32 Project
//  4. Enter "iissemi1" for the name
//  5. In the Win32 Application Wizard, choose an
//     "Application type" of "DLL", and under "Additional
//     options", check "Empty project"
//  6. In the Solution Explorer, right-click on "Source Files",
//     Add -> New Item
//  7. Choose "C++ File (.cpp)" and enter "iissemi1.cpp" for
//     the name
//  8. Paste all of this source code into the new .cpp file
//  9. In the Solution Explorer, right-click again on "Source
//     Files", Add -> New Item
// 10. Choose "Module-Definition File (.def)" and enter
//     "iissemi1.def" for the name
// 11. Paste everything in the block comment below (between the
//     rows of ****'s) into the new .def file
// 12. Build -> Configuration Manager; for "Active solution
//     configuration", choose "Release"
// 13. For maximum portability, Project -> Properties,
//     Configuration Properties: C/C++: Code Generation: set
//     "Runtime Library" to "Multi-threaded (/MT)"; this will
//     keep iissemi1.dll from requiring MSVCR*.DLL
// 14. (While you're in there, Project -> Properties,
//      Configuration Properties: Linker: Input, and make sure
//      that "Module Definition File" contains "iissemi1.def")
// 15. Build -> Build Solution
//
// To use:
//
// 16. Open Internet Information Services Manager MMC snap-in
//     (run "inetmgr")
// 17. Right-click on "Web Sites" or machine node, Properties
//     (Master Properties: Edit, as applicable)
// 18. Home Directory tab, Configuration
// 19. Copy iissemi1.dll to a different file name for each
//     distinct ISAPI extension you need to replace; e.g.,
//     "iissemi1_asp.dll" if you need to replace "asp.dll",
//     "iissemi1_httpodbc.dll" for "httpodbc.dll", etc.
// 20. Remap the file extensions for every ISAPI extension which
//     you wouldn't want users to be able to supply with
//     arbitrary files, to instead use a copy of iissemi1.dll.
//     Make sure to keep a record of each mapping changed, so
//     that you can easily reverse the changes later.
//     (Note that you might get "requested resource is in use"
//      errors if you don't remap every file extension belonging
//      to an ISAPI extension -- e.g., if you remap ".asp" but
//      not ".asa", you might get HTTP 500 errors when you
//      access an ASA file.)
// 21. IIS 6.0: In the IIS Manager, go to the "Web Service
//     Extensions" folder, Action -> Add a new web service
//     extension, enter "iissemi1" for the extension name, add
//     each file created in Step 19 to the "Required files"
//     list, check "Set extension status to Allowed", OK
// 22. In Regedit, create the registry key
//     "HKEY_LOCAL_MACHINE\SOFTWARE\iissemi1"
// 23. In this new key, create string (REG_SZ or REG_EXPAND_SZ)
//     registry values named after the copies of iissemi1.dll
//     created in Step 19.  The data of each registry value
//     should be the full path and file name of the ISAPI
//     extension that was replaced; e.g., set the value named
//     "iissemi1_asp.dll" to
//     "C:\WINDOWS\system32\inetsrv\asp.dll", set the value named
//     "iissemi1_httpodbc.dll" to
//     "C:\WINDOWS\system32\inetsrv\httpodbc.dll", etc.
// 24. Restart W3SVC (run "iisreset")
//
// To uninstall, remap the file extension mappings changed in
// Step 20 back to their original executable paths.
//
// NO WARRANTIES.  Use at your own risk.  Redistribution of this
// source code in its original, unmodified form is permitted.
//
// Copyright (C) Derek Soeder - 12/27/2009
////////////////////////////////////////////////////////////////

/****  Paste the following into a new .def file:  *************

LIBRARY "iissemi1.dll"

EXPORTS
        AspStatusHtmlDump
        DllCanUnloadNow PRIVATE
        DllGetClassObject PRIVATE
        DllRegisterServer PRIVATE
        DllUnregisterServer PRIVATE
        GetExtensionVersion
        HttpExtensionProc
        TerminateExtension

***************************************************************/

#define WIN32_LEAN_AND_MEAN
#define _CRT_SECURE_NO_WARNINGS

#include <windows.h>
#include <objbase.h>
#include <httpext.h>
#include <stdio.h>

////////////////////////////////////////////////////////////////
// Original ISAPI wrapper
////////////////////////////////////////////////////////////////

WCHAR                   g_wszMyself[1024];

CRITICAL_SECTION        g_csWrappers;
HMODULE                 g_hmISAPI;
WCHAR                   g_wszISAPI[1024];

typedef BOOL (WINAPI * PFNASPSTATUSHTMLDUMP)( PVOID, PVOID );
typedef HRESULT (STDAPICALLTYPE * PFNDLLREGISTERSERVER)();
typedef HRESULT (STDAPICALLTYPE * PFNDLLUNREGISTERSERVER)();

PFNASPSTATUSHTMLDUMP    g_pfnAspStatusHtmlDump;
LPFNCANUNLOADNOW        g_pfnDllCanUnloadNow;
LPFNGETCLASSOBJECT      g_pfnDllGetClassObject;
PFNDLLREGISTERSERVER    g_pfnDllRegisterServer;
PFNDLLUNREGISTERSERVER  g_pfnDllUnregisterServer;
PFN_GETEXTENSIONVERSION g_pfnGetExtensionVersion;
PFN_HTTPEXTENSIONPROC   g_pfnHttpExtensionProc;
PFN_TERMINATEEXTENSION  g_pfnTerminateExtension;

const struct { void * ppfn; const char * sz; } LOOKUP[] =
{
        { &g_pfnAspStatusHtmlDump,   "AspStatusHtmlDump" },
        { &g_pfnDllCanUnloadNow,     "DllCanUnloadNow" },
        { &g_pfnDllGetClassObject,   "DllGetClassObject" },
        { &g_pfnDllRegisterServer,   "DllRegisterServer" },
        { &g_pfnDllUnregisterServer, "DllUnregisterServer" },
        { &g_pfnGetExtensionVersion, "GetExtensionVersion" },
        { &g_pfnHttpExtensionProc,   "HttpExtensionProc" },
        { &g_pfnTerminateExtension,  "TerminateExtension" }
} ;

BOOL read_reg_path(
        LPCWSTR                 wszKeyName,
        LPCWSTR                 wszValueName )
{
        HKEY                    hkey;
        DWORD                   dwtype, cb, cwch;
        WCHAR                   wsz[ sizeof(g_wszISAPI) /
                                     sizeof(g_wszISAPI[0]) ];

        if ( RegOpenKeyExW( HKEY_LOCAL_MACHINE, wszKeyName, 0,
                KEY_READ, &hkey ) != ERROR_SUCCESS )
        {
                return FALSE;
        }

        cb = (sizeof(g_wszISAPI) - sizeof(g_wszISAPI[0]));

        if (RegQueryValueExW( hkey, wszValueName, NULL, &dwtype,
                (LPBYTE)g_wszISAPI, &cb ) != ERROR_SUCCESS ||
                cb < sizeof(g_wszISAPI[0]) ||
                cb > (sizeof(g_wszISAPI) - sizeof(g_wszISAPI[0])) )
        {
                RegCloseKey( hkey );
                return FALSE;
        }

        RegCloseKey( hkey );

        g_wszISAPI[cb / sizeof(g_wszISAPI[0])] = L'\0';

        if (dwtype == REG_EXPAND_SZ)
        {
                cwch = ExpandEnvironmentStringsW( g_wszISAPI,
                        wsz, ((sizeof(wsz) / sizeof(wsz[0])) - 1) );

                if ( cwch == 0 ||
                     cwch >= (sizeof(wsz) / sizeof(wsz[0])) - 1)
                {
                        return FALSE;
                }

                wsz[cwch] = L'\0';

                memcpy( g_wszISAPI,
                        wsz, ((cwch + 1) * sizeof(g_wszISAPI[0])) );
        }
        else if (dwtype != REG_SZ)
                return FALSE;

        return TRUE;
} //read_reg_path

const wchar_t * __wcsstri(
        const wchar_t           * _Str,
        const wchar_t           * _SubStr )
{
        size_t                  cwchstr, cwchsub;

        cwchstr = wcslen( _Str );
        cwchsub = wcslen( _SubStr );

        if (cwchstr < cwchsub)
                return 0;

        for (cwchstr -= cwchsub; ; cwchstr--, _Str++)
        {
                if (_wcsnicmp( _Str, _SubStr, cwchsub ) == 0)
                        return _Str;

                if (cwchstr == 0) break;
        }

        return 0;
} //__wcsstri

BOOL try_defaults(
        LPCWSTR                 wszMyFileName )
{
        LPCWSTR                 wszdll;

        if (__wcsstri( wszMyFileName, L"asp51" ))
        {
                if ( read_reg_path( L"SOFTWARE\\Classes\\CLSID\\"
                        L"{D97A6DA0-A861-11cf-93AE-00A0C90C2BD8}\\"
                        L"InprocServer32", NULL ) )
                {
                        return TRUE;
                }

                wszdll = L"\\asp51.dll";
        }
        else if (__wcsstri( wszMyFileName, L"asp" ))
        {
                if ( read_reg_path( L"SOFTWARE\\Classes\\CLSID\\"
                        L"{D97A6DA0-A861-11cf-93AE-00A0C90C2BD8}\\"
                        L"InprocServer32", NULL ) )
                {
                        return TRUE;
                }

                wszdll = L"\\asp.dll";
        }
        else if (__wcsstri( wszMyFileName, L"httpodbc" ))
                wszdll = L"\\httpodbc.dll";
        else if (__wcsstri( wszMyFileName, L"ssinc" ))
                wszdll = L"\\ssinc.dll";
        else if (__wcsstri( wszMyFileName, L"urlauth" ))
                wszdll = L"\\urlauth.dll";
        else if (__wcsstri( wszMyFileName, L"w3isapi" ))
                wszdll = L"\\w3isapi.dll";
        else    return FALSE;

        if ( read_reg_path( L"SOFTWARE\\Microsoft\\InetStp",
                L"InstallPath" ) &&
             ( (sizeof(g_wszISAPI) / sizeof(g_wszISAPI[0])) -
               wcslen( g_wszISAPI ) ) > (wcslen( wszdll ) + 1) )
        {
                wcscat( g_wszISAPI, wszdll );
                return TRUE;
        }

        g_wszISAPI[0] = L'\0';
        return FALSE;
} //try_defaults

BOOL load_isapi()
{
        LPCWSTR                 wcp;
        size_t                  i;

        EnterCriticalSection( &g_csWrappers );

        __try
        {
                if (g_hmISAPI != NULL)
                        return TRUE;

                wcp = wcsrchr( g_wszMyself, L'\\' );
                if (wcp) wcp++; else wcp = g_wszMyself;

                if (!read_reg_path( L"SOFTWARE\\iissemi1", wcp ))
                {
                        if (!try_defaults( wcp ))
                                return FALSE;
                }

                g_hmISAPI = LoadLibraryW( g_wszISAPI );
                if (g_hmISAPI == NULL) return FALSE;

                for ( i = 0;
                      i < (sizeof(LOOKUP) / sizeof(LOOKUP[0])); i++ )
                {
                        *(void * *)(LOOKUP[i].ppfn) =
                                (void *)GetProcAddress(
                                        g_hmISAPI, LOOKUP[i].sz );
                }
        }
        __finally
        {
                LeaveCriticalSection( &g_csWrappers );
        }

        return TRUE;
} //load_isapi

////////////////////////////////////////////////////////////////
// ISAPI extension replacement exports
////////////////////////////////////////////////////////////////

BOOL WINAPI AspStatusHtmlDump(
        PVOID                   pArg0,
        PVOID                   pArg1 )
{
        if (!load_isapi() || g_pfnAspStatusHtmlDump == NULL)
                return FALSE;

        return g_pfnAspStatusHtmlDump( pArg0, pArg1 );
} //AspStatusHtmlDump

STDAPI DllCanUnloadNow()
{
        if (!load_isapi() || g_pfnDllCanUnloadNow == NULL)
                return S_OK;

        return g_pfnDllCanUnloadNow();
} //DllCanUnloadNow

STDAPI DllGetClassObject(
        REFCLSID                rclsid,
        REFIID                  riid,
        LPVOID                  * ppv )
{
        if (!load_isapi() || g_pfnDllGetClassObject == NULL)
                return E_UNEXPECTED;

        return g_pfnDllGetClassObject( rclsid, riid, ppv );
} //DllGetClassObject

STDAPI DllRegisterServer()
{
        if (!load_isapi() || g_pfnDllRegisterServer == NULL)
                return E_UNEXPECTED;

        return g_pfnDllRegisterServer();
} //DllRegisterServer

STDAPI DllUnregisterServer()
{
        if (!load_isapi() || g_pfnDllUnregisterServer == NULL)
                return E_UNEXPECTED;

        return g_pfnDllUnregisterServer();
} //DllUnregisterServer

BOOL WINAPI GetExtensionVersion(
        HSE_VERSION_INFO        * pVer )
{
        if (!load_isapi() || g_pfnGetExtensionVersion == NULL)
                return FALSE;

        return g_pfnGetExtensionVersion( pVer );
} //GetExtensionVersion

DWORD WINAPI HttpExtensionProc(
        EXTENSION_CONTROL_BLOCK * pECB )
{
        HSE_CUSTOM_ERROR_INFO   hseerr;
        BOOL                    fdanger;
        const char              * cp;

        if (!load_isapi() || g_pfnHttpExtensionProc == NULL)
                return HSE_STATUS_ERROR;

        if (pECB != NULL && pECB->lpszPathTranslated != NULL)
        {
                fdanger = FALSE;

                if (strchr( pECB->lpszPathTranslated, ';' ))
                        fdanger = TRUE;

#if 1 // also check for colon that doesn't belong
                cp = pECB->lpszPathTranslated;

                if ( cp[0] == '\\' && cp[1] == '\\' &&
                     (cp[2] == '.' || cp[2] == '?') &&
                     cp[3] == '\\' && cp[4] != '\0' && cp[5] == ':' )
                {
                        cp += 6;
                }
                else if ( cp[0] == '\\' && cp[1] == '?' &&
                          cp[2] == '?' && cp[3] == '\\' &&
                          cp[4] != '\0' && cp[5] == ':' )
                {
                        cp += 6;
                }
                else if (cp[0] != '\0' && cp[1] == ':')
                {
                        cp += 2;
                }

                if (strchr( cp, ':' ))
                        fdanger = TRUE;
#endif

                if (fdanger)
                {
                        if (pECB->ServerSupportFunction != NULL)
                        {
                                pECB->ServerSupportFunction(
                                        pECB->ConnID,
                                        HSE_REQ_SEND_RESPONSE_HEADER,
                                        "403 Forbidden",
                                        NULL, NULL );

                                hseerr.pszStatus = "403 Forbidden";
                                hseerr.uHttpSubError = 59;

                                pECB->ServerSupportFunction(
                                        pECB->ConnID,
                                        HSE_REQ_SEND_CUSTOM_ERROR,
                                        &hseerr, NULL, NULL );
                        } //if(pECB->ServerSupportFunction)

                        pECB->dwHttpStatusCode = 403;

                        return HSE_STATUS_SUCCESS;
                } //if(fdanger)
        } //if(pECB&&pECB->lpszPathTranslated)

        return g_pfnHttpExtensionProc( pECB );
} //HttpExtensionProc

BOOL WINAPI TerminateExtension(
        DWORD                   dwFlags )
{
        if (!load_isapi() || g_pfnTerminateExtension == NULL)
                return FALSE;

        return g_pfnTerminateExtension( dwFlags );
} //TerminateExtension

////////////////////////////////////////////////////////////////
// DLL initialization
////////////////////////////////////////////////////////////////

BOOL WINAPI DllMain(
        HINSTANCE               hinstDLL,
        DWORD                   fdwReason,
        LPVOID                  lpvReserved )
{
        DWORD                   cwch;

        if (fdwReason == DLL_PROCESS_ATTACH)
        {
                cwch = GetModuleFileNameW( hinstDLL, g_wszMyself,
                        ( ( sizeof(g_wszMyself) /
                            sizeof(g_wszMyself[0]) ) - 1 ) );

                if ( cwch == 0 ||
                     cwch >= ( ( sizeof(g_wszMyself) /
                                 sizeof(g_wszMyself[0]) ) - 1 ) )
                {
                        return FALSE;
                }

                InitializeCriticalSection( &g_csWrappers );
                g_hmISAPI = NULL;
                g_wszISAPI[0] = L'\0';
        }
        else if (fdwReason == DLL_PROCESS_DETACH)
        {
                // do this in TerminateExtension?
                //if (g_hmISAPI != NULL)
                //{
                //        FreeLibrary( g_hmISAPI );
                //        g_hmISAPI = NULL;
                //}

                DeleteCriticalSection( &g_csWrappers );
        }

        return TRUE;
} //DllMain