Need help hacking my virtual network

[robski_g]

Hi,
Ok I'm just starting off basic as i'm new to this, i've setup a windows xp pro on my vmware, i hav not installed any services packs or updates so it should be vunerable(in an earlier post someone suggested using DVL but im not that used to linux yet). I have jus ran an aggresive scan with NMap and i it has found multiple open ports which are as follows:

135/tcp open msrpc?
139/tcp open netbios-ssn
445/tcp open microsoft-ds Microsoft Windows XP microsoft-ds
1025/tcp open NFS-or-IIS?
5000/tcp open upnp Microsoft Windows UPnP

Anyway I jus want to know where should I go from here? What other information do I need to aquire ? Should i find exploits for these services and try to implement them?What else should I try? Also any articles or tuts on this would be most appreciated..Thanks in advanced...Rob

[ayu]

Well since it's completely opened you could just enter with

\\IP\C$

just press start -> run

and then type in \\computerIP\C$

=P


Well, checking every port for exact service and version might be useful, but if it isn't patched at all you could try the vulnerability that the blaster worm used.

http://www.milw0rm.com/exploits/69

Dunno if that is the exact one that the worm used, but should work anyway =)

Also, reading up on what all the services mean could be useful as well ^^ like what they do, etc

[bad_brain]

to stop Microsoft DS/close port 445:
Start->Run->regedit
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
create a new entry there:
"SMBDeviceEnabled"=dword:00000000
(the dword value is usually created as default)

to stop upnp (universal plug & play):
Start->Run->msconfig
pick the "autostart" tab and disable ssdpsrv.exe

to disable netbios:
right-click on "My Network Places"->Properties
right-click on your default connection->Properties
pick "Internet Protocol (TCP/IP)"->Properties->Advanced->WINS
disable "NetBIOS over TCP/IP"

restart your system when done.
I also disable all of the above on my system and experienced no problems yet.


msrpc is necessary for the system, disabling it would leave the system unusable. port 1025 is most likely not IIS or NFS, it is often used as local proxy by antivirus/firewall suites, best get "TCPview" from our downloads, it'll show you what program opened the port.

[robski_g]

Well since it's completely opened you could just enter with

\\IP\C$

just press start -> run

and then type in \\computerIP\C$

=P


Well, checking every port for exact service and version might be useful, but if it isn't patched at all you could try the vulnerability that the blaster worm used.

http://www.milw0rm.com/exploits/69

Dunno if that is the exact one that the worm used, but should work anyway =)

Also, reading up on what all the services mean could be useful as well ^^ like what they do, etc

Is that a null session or is just a way to enter the system thru netbios?....cheers..rob

[ayu]

Well seeing as you get access I don't think it's a NULL session =/

Think you would simply call it getting access through netbios, but I'm not sure ^^

[robski_g]

Nice one. I think a null session is used just to enumerate user names from a from the ip$ share and not to actually gain accessThanks for the advice tho pal i'll definately be giving it ago...Rob

[robski_g]

to stop Microsoft DS/close port 445:
Start->Run->regedit
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
create a new entry there:
"SMBDeviceEnabled"=dword:00000000
(the dword value is usually created as default)

to stop upnp (universal plug & play):
Start->Run->msconfig
pick the "autostart" tab and disable ssdpsrv.exe

to disable netbios:
right-click on "My Network Places"->Properties
right-click on your default connection->Properties
pick "Internet Protocol (TCP/IP)"->Properties->Advanced->WINS
disable "NetBIOS over TCP/IP"

restart your system when done.
I also disable all of the above on my system and experienced no problems yet.


msrpc is necessary for the system, disabling it would leave the system unusable. port 1025 is most likely not IIS or NFS, it is often used as local proxy by antivirus/firewall suites, best get "TCPview" from our downloads, it'll show you what program opened the port.

Thanks for the info badbrain.However i can't find the "TCPview" app u were referring to in the downloads section...Rob

[computathug]

Thanks for the info badbrain.However i can't find the "TCPview" app u were referring to in the downloads section...Rob

you can get if from here

http://www.suck-oold.com/modules.php?na ... tit&lid=32