access denied

[P1]

Hey guys,
I'm totally out of my league here, I don't even know how I got stuck
with this problem, it's obviously a webmaster issue and I'm just a lowly
net admin.

The error:

Starts here
9/5/2008 6:00:41 PM
Microsoft VBScript runtime error '800a0046'
Permission denied
/groupCalPDF.asp, line 19

Line 19 starts with wshell.run in the script below:

<%
response.Expires = 0
dim wshell, url, filename, memberid
'on error resume next
Response.Write("Starts here<br/>")

%>
<pre>
<%=now()%>

</pre>
<%

memberid = Request("memberid")
url = Request("url")
filename = "cal"& memberid &".pdf"

set wshell = CreateObject("WScript.Shell")
wshell.run "%comspec% /c c:\htmltools\htmltools.exe -append 0 """& url
&""" ""c:\PDFTemp\" & filename &""" >c:\htmltools\log.txt", 0, TRUE
set wshell = nothing

Response.write "Passed through<br/>"

if err.number <> 0 then
response.write "Error detected: " & err.number & ": " &
err.Description & "<br/>"
on error goto 0
response.end
end if
on error goto 0

Response.write "Run successfully<br/>"

Response.Redirect("http://calpdf.domain1.com/PDFTemp/" & filename)
%>
<pre>
<%=now()%>

</pre>


IIS and permissions:
The website has Scripts and Executables permissions.
The folder containing the asp script and htmltools.exe have full NTFS
permissions for IUSR_ account.

Some of the commands in the script I put in as part of suggestions found
while researching this problem. If I uncomment the "on error resume
next" line, the error changes to:

Starts here
9/5/2008 6:00:58 PM
Passed through
Error detected: 70: Permission denied

I've been using ProcMon but I can't find any errors, other than a couple
of BUFFER OVERFLOWs, which someone suggested can be ignored.

This is a revisited problem that I thought was solved before but is now
back with a vengeance. Before, procmon would report access denied
errors to c:\windows\system32\cmd.exe but once I gave IUSR_ permissions
to it, the problem was solved. Now I even removed those permissions but
procmon is NOT reporting the same error as before.

I'm lost, please help?

Thanks,
LP

 

[Ken Schaefer]

IUSR account doesn't have access to cmd.exe by default (assuming you are
using anonymous authentication). This is a security measure designed to
prevent anonymous users being able (e.g. via faulty code) from being able to
access a command prompt and run arbitrary commands on your server.

Cheers
Ken

 

[P1]

IUSR account doesn't have access to cmd.exe by default (assuming you are
using anonymous authentication). This is a security measure designed to
prevent anonymous users being able (e.g. via faulty code) from being
able to access a command prompt and run arbitrary commands on your server.

Cheers
Ken

Yes, I know. Last time I came across this problem I added the permission
explicitly. Now that the problem is back, I removed it just for
troubleshooting, to be able to see the deny error in procmon, but it
doesn't show.