Modify the banner of IIS6.0

 

By default, IIS cannot modify the HTTP Banner. I think this is a weakness of IIS. Without the source code published by IIS, you cannot directly modify the source code and compile it. I do not like windows as a server at all. configuration is troublesome, maintenance is troublesome, and security is also troublesome. However, we still need to use it. Today, the scanners are very powerful. We will scan your IIS version based on the HTTP fingerprint, so we thought of an evil way to directly modify the data in the PE file, after studying N for a long time, I finally succeeded. I checked it online and win2000 was modified in this way, but the modification method of win2003 was not found.

1. win2003 has system file protection. You can delete w3core. dll in c: \ windows \ system32 \ dllcache.

 

2. Use Uedit32 to Open c: \ windows \ system32 \ inetsrv \ w3core. dll.

 

3. Directly search for the keyword "6.0" and check "ascii ":

 

4. You can change the search result as needed. I changed it to 8.0:

 

5. Stop the IIS Admin Service and save the modification to w3core. dll. If it still cannot be saved, use attrib-R to modify its attributes. If not, you can save it as another name, and then try to delete the original w3core. dll, and then replace the new file with this name.

 

6. Start the IIS Admin Service and restart the Service again. If the Service fails, restart the system.

 

7. Come and check the packet capture:

 

Scan the server again:

 

Simple script

 

From: Fresh blog