Netbios  - Using IPC$ null session to compromise windows system

Posted on 2004-04-27
Medium Priority
Last Modified: 2013-12-04
I am doing security penetration testing from a Linux (RH9.0) environment...

1: Port scan

2: nmblookup

3: smbclient

I have accessed my computer (remotely) using a null session to


with the following smbclient command

[user@localhost /] smbclient //server/IPC$ "" -dt/share -I -N -W WORKGROUP

which gives me the prompt

smb \>

I do not have write access.

Where do I go from here on a Linux machine?

I want to emumerate users/shares/etc..  but I am using Linux...  Any ideas?

Also, what else can be done to gain access once you have a null session?

Question by:cduke250
  • 3
  • 2
LVL 38

Expert Comment

by:Rich Rumble
ID: 10934980
PERL !-)

You can use perl in windows alot, even run it on them ... I remember using cygwin and a few others on winblows, and it was doing a fine job, then I found a book that helped me administer M$ how I always wanted too...

I also found that *nix can make ton's of API calls and other very usefull interactions with M$ without much fuss :)

I hope that script helps ... it's very similar to how you can do the same thing's with windows itself... (winfo.exe is a great program)

Author Comment

ID: 10943253
Sorry little confused here...

Are you saying to download perl and then download win32 and lanman libs/src and then compile this script in linux?

Will it work from linux or do I have to wine it?

I installed wine but haven't been able to get enum.exe , dumpSEC, nete, user2sid, sid2user to work with it yet...  wine debug
says it can't find certain functions of the netapi32.dll files.  

LVL 38

Expert Comment

by:Rich Rumble
ID: 10943354
no no the native perl should work... I was going a bit off topic- the win32 book i mentioned is for running perl on win2k etc... sorry... Perl doesn't compile... you save the script in a txt file, and make sure you have the modules it calls (use Win32::Lanman;use Win32::TieRegistry) that's all.  then run it...  "./null.pl"

wine won't work for most of those tools, VMware would... but you might as well have a M$ pc then...

Author Comment

ID: 10954101
Tell me where to download win32::lanman and win32::tieregistry and how to install and you got yourself 400 points rich.
LVL 38

Accepted Solution

Rich Rumble earned 2000 total points
ID: 10954590
CPAN owns
Normally most of these are included, Perl will just make a CALL to them... http://www.cpan.org/misc/cpan-faq.html#How_installed_modules
http://www.cpan.org/modules/by-module/Win32/  (search for "tie" and "lanman"
and look here for additional help
http://perl.about.com/library/weekly/aa030500a.htm (4 page article)


Featured Post

Will You Be GDPR Compliant by 5/28/2018?

GDPR? That's a regulation for the European Union. But, if you collect data from customers or employees within the EU, then you need to know about GDPR and make sure your organization is compliant by May 2018. Check out our preparation checklist to make sure you're on track today!

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Recently, a new law in my state forced us to get a top-to-bottom analysis of all of our contract client's networks. While we have documentation, it was spotty at best for some - and in any event it needed to be checked against reality. That was m…
In today's information driven age, entrepreneurs have so many great tools and options at their disposal to help turn good ideas into a thriving business. With cloud-based online services, such as Amazon's Web Services (AWS) or Microsoft's Azure, bus…
The video provides a quick and easy steps to migrate MBOX file to well known Outlook PST and Office 365. Besides this, it also supports and migrates more than 20 email clients of MBOX which include AppleMail, Opera, Thunderbird and SeaMonkey effortl…
Free Data Recovery software is an advanced solution from Kernel Tools to recover data and files such as documents, emails, database, media and pictures, etc. It supports recovery from physical & logical drive after a hard disk crash, accidental/inte…

597 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question