Solved

Netbios  - Using IPC$ null session to compromise windows system

Posted on 2004-04-27
5
4,592 Views
Last Modified: 2013-12-04
I am doing security penetration testing from a Linux (RH9.0) environment...

1: Port scan

2: nmblookup

3: smbclient

I have accessed my computer (remotely) using a null session to

//server/IPC$

with the following smbclient command

[user@localhost /] smbclient //server/IPC$ "" -dt/share -I 172.16.0.1 -N -W WORKGROUP

which gives me the prompt

smb \>

I do not have write access.

Where do I go from here on a Linux machine?

I want to emumerate users/shares/etc..  but I am using Linux...  Any ideas?

Also, what else can be done to gain access once you have a null session?


0
Comment
Question by:cduke250
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 38

Expert Comment

by:Rich Rumble
ID: 10934980
PERL !-)
http://www.roth.net/perl/scripts/scripts.asp?Null.pl
http://www.xav.com/perl/site/lib/Win32/NetResource.html

You can use perl in windows alot, even run it on them ... I remember using cygwin and a few others on winblows, and it was doing a fine job, then I found a book that helped me administer M$ how I always wanted too...
http://www.amazon.com/exec/obidos/tg/detail/-/1578700566/qid=1083120410/sr=8-1/ref=sr_8_xs_ap_i1_xgl14/104-5064769-9078301?v=glance&s=books&n=507846

I also found that *nix can make ton's of API calls and other very usefull interactions with M$ without much fuss :)

I hope that script helps ... it's very similar to how you can do the same thing's with windows itself... (winfo.exe is a great program)
GL!
-rich
0
 
LVL 3

Author Comment

by:cduke250
ID: 10943253
Sorry little confused here...

Are you saying to download perl and then download win32 and lanman libs/src and then compile this script in linux?

Will it work from linux or do I have to wine it?

I installed wine but haven't been able to get enum.exe , dumpSEC, nete, user2sid, sid2user to work with it yet...  wine debug
says it can't find certain functions of the netapi32.dll files.  

0
 
LVL 38

Expert Comment

by:Rich Rumble
ID: 10943354
no no the native perl should work... I was going a bit off topic- the win32 book i mentioned is for running perl on win2k etc... sorry... Perl doesn't compile... you save the script in a txt file, and make sure you have the modules it calls (use Win32::Lanman;use Win32::TieRegistry) that's all.  then run it...  "./null.pl"

wine won't work for most of those tools, VMware would... but you might as well have a M$ pc then...
-rich
0
 
LVL 3

Author Comment

by:cduke250
ID: 10954101
Tell me where to download win32::lanman and win32::tieregistry and how to install and you got yourself 400 points rich.
0
 
LVL 38

Accepted Solution

by:
Rich Rumble earned 500 total points
ID: 10954590
CPAN owns
Normally most of these are included, Perl will just make a CALL to them... http://www.cpan.org/misc/cpan-faq.html#How_installed_modules
http://www.cpan.org/modules/by-module/Win32/  (search for "tie" and "lanman"
and look here for additional help
http://perl.about.com/library/weekly/aa030500a.htm (4 page article)
GL!
-rich



0

Featured Post

U.S. Department of Agriculture and Acronis Access

With the new era of mobile computing, smartphones and tablets, wireless communications and cloud services, the USDA sought to take advantage of a mobilized workforce and the blurring lines between personal and corporate computing resources.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Container Orchestration platforms empower organizations to scale their apps at an exceptional rate. This is the reason numerous innovation-driven companies are moving apps to an appropriated datacenter wide platform that empowers them to scale at a …
OfficeMate Freezes on login or does not load after login credentials are input.
In a recent question (https://www.experts-exchange.com/questions/29004105/Run-AutoHotkey-script-directly-from-Notepad.html) here at Experts Exchange, a member asked how to run an AutoHotkey script (.AHK) directly from Notepad++ (aka NPP). This video…

737 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question