Beware of SERVU local right to raise

As a result of the last Test Servu local power, so think of the earlier two Webshell, but there was no way to mention power, just got the Webshell, no further access to authority. So login to the two sites webshell--unexpectedly more than a year, Webshell still in-- One of the sites is Wscript.Shell, but it supports ASPX, so it uses the ASPX version of the SERVU Local authority, uses NC bindings to write the Cmd.exe bounce back, and then succeeds in getting a shell with system privileges. (But strangely, this right to the page I tried to run several times, the results sometimes prompted errors, sometimes normal, almost think that the wrong to give up) , another is to support Wscript.Shell, but the default does not have access to Windows Cmd.exe, so I uploaded a cmd.exe (directly also cannot upload, to use the ADODB.stream download function), and then use this Cmd.exe upload up the SERVU _local.exe, IUSR_XXXX promoted to administrator. (hehe, this is also strange, NC rebound does not come back, but it is not like a personal firewall, do not know if there is a hardware firewall), restart IIS after Webshell has administrator rights. My goal is simply to elevate the authority and then stop ignoring it.

Servu Although easy to use, but put on the server or be careful ah. I hastened to dispose of the ServU.exe on the server I managed--a new SERVU user, then the SERVU server started with this user. Oh, it seems to be prudent for each server, can not use the default administrator rights to run, otherwise unlucky is their own. MSSQL I also do so, so that even if a virtual host has injected loopholes, there is no way to back up the database to get Webshell, there is no way to execute the command through xp_cmdshell. Oh