And for the love of god people, please secure IIS. It helps everyone, but especially people like me, who have to do incident response when your totally unsecured corporate site has been 0wn3d.
Here's how you can mitigate some of the most frequently exploited vulnerabilites-
Check
this FTP hot fix advisory and confirm that your particular version of IIS is appropriately patched.
Perform the following steps
1. Launch the Internet Services Manager
2. Select your web server
3. Right-click on MSADC and select ‘Properties’
4. Select the tab ‘Directory Security’
5. Click on the ‘IP address and domain name restrictions' option
6. Make sure that by default, all computers are DENIED access to this resource
7. List the computers that should be allowed to use it
See also: MS advisory MS02-065
Ensure these files are not present, unless necessary-
\iisadmpwd\aexp2.htr or, aexp2b.htr, aexp3.htr, or aexp4.htr
\cgi-bin\htimage.exe
\cgi-bin\imagemap.exe
\iissamples\sdk\asp\docs\CodeBrws.asp
the \iissamples directory including all of it contents
Unmap the .shtml extension, if not used.
To unmap the .shtml extension:
1.Open Internet Services Manager.
2.Right-click the Web server & choose Properties from the context menu.
3.Master Properties
4.Select WWW Service -> Edit -> HomeDirectory -> Configuration and remove the reference to .shtml/shtm and sht from the list.
Unmap the .HTR extension, if not used.
To unmap the .HTR extension:
1.Open Internet Services Manager.
2.Right-click the Web server & choose Properties from the context menu.
3.Master Properties
4.Select WWW Service -> Edit -> HomeDirectory -> Configuration and remove the reference to .htr from the list.