Microsoft Index Server
                             Exposes IDs and Passwords

                           Reported May 15 ,1997 by Andrew Smith

  Systems Affected

  Windows NT with IIS and Index Server (e.g. any NT system using IIS with webhits.exe in the default
  location or locatable/executable path)

  The Problem

  MS Index Server (formerly code named Tripoli) is Microsoft's search engine for Internet Information Server.
  It recently shipped with Service Pack 2 for Windows NT and is installed on most Microsoft NT Internet
  Information web servers. Index Server is a very useful search engine for the Internet Information Server.
  One component contained in Index Server is called the Hit Counter. Hit counter enables users to view their
  searched documents with the words of their queries highlighted.. 

  The Hit Counter (webhits.exe) allows the web server to read files that should not normally be able to be
  read. This is similar to a bug found recently that allows users to read Active Server Script files by placing a
  period at the end of the URL. In many cases an Active Server script contains a username and password to
  a network resource, usually a SQL server. This password and username can be used to gain access to
  the SQL system and possibly to the web server itself.

  If the system administrator has left the default sample files on the Internet Information server, a hacker
  would have the opportunity of narrowing down their search for a username and password. A simple query
  of a popular search engine shows about four hundred websites that have barely modified versions of the
  sample files still installed and available. This file is called queryhit.htm. Many webmasters have neglected
  to modify the search fields to only search certain directories and avoid the script directories. 

  Once one of these sites is located a search performed can easily narrow down the files a hacker would
  need to find a username and password. Using the sample search page it is easy to specify only files that
  have the word password in them and are script files (.asp or .idc files, cold fusion scripts, even .pl files are
  good). 

  The URL the hacker would try is http://servername/samples/search/queryhit.htm then the hacker would
  search with something like "#filename=*.asp"

  When the results are returned not only can one link to the files but also can look at the "hits" by clicking
  the view hits link that uses the webhits program. This program bypasses the security set by IIS on script
  files and allows the source to be displayed. 

  Even if the original samples are not installed or have been removed a hole is still available to read the
  script source. If the server has Service Pack 2 fully installed (including Index Server) they will also have
  webhits.exe located in the path 

  http://servername/scripts/samples/search/webhits.exe

  This URL can preface another URL on that server and display the contents of the script.

  Stopping the Attack

  To protect your server from this problem remove the webhits.exe file from the server, or at least from it's
  default directory. I also recommend that you customize your server search pages and scripts (.idq files) to
  make sure they only search what you want - such as plain .HTM or .HTML files. Index Server is a
  wonderful product but be sure you have configured it properly.

  Microsoft's Response:

  Andrew Smith has made Microsoft aware of the problem, but they have yet to release a formal fix as of
  May 19, 1997.

  If you want to learn more about new NT security concerns, subscribe to NTSD. 

  Credit: 
  Andrew Smith
  Original page located here.
  Post on The NT Shop May 19, 1997