Re: NULL IPC$ Sessions

From: David LeBlanc (dleblanc@MINDSPRING.COM)
Date: 02/05/02 

Date:         Tue, 5 Feb 2002 09:29:39 -0800
From: David LeBlanc <dleblanc@MINDSPRING.COM>
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

> From: ThePsyko

> I've found that enum (http://www.cotse.com/tools/netbios.htm)
> is capable of pulling down much more information via a null
> session.

Actually, enum only pulls down a fraction of what's actually available.
What types of information are available is documented fairly thoroughly
in the Platform SDK, also available on the web, so none of this is
hidden - anyone who can read the SDK and write just a little C can see
what's there. Various tools have been created that gather much more
information. A lot of the information isn't especially useful to an
attacker, some of it is.

The available information also strongly varies with operating system
version and in the case of NT 4.0, service pack. The amount of
information available to the anonymous user is substantially less for
Windows 2000 than NT 4.0, and Windows 2000 allows RestrictAnonymous to
be set to 2 - which essentially denies all null sessions. If you're
going to set RA=2, please look up and read the KB articles. In Windows
XP, the information is even further restricted, and it is restricted by
default.

The real question as an admin is what to do about the information being
available. First, if all the users have strong passwords, there isn't a
problem. This can be accomplished by installing a password filter on NT
4.0, simply checking a policy item in Windows 2000 and later. Push it
down via domain policy if you have Win2k DC and clients. Next, audit
your network. Know what's out there. If you're really worried about it,
run Windows 2000 or better, turn off the browser service (RA=2 breaks
it) and set RA=2. Running Windows XP protects you even further. Lastly,
be sure and block ports 139 and 445 TCP from the internet.

David LeBlanc
dleblanc@mindspring.com

oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Delivery co-sponsored by Qualys - Make Your Network Secure
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Go Beyond PARTIAL Security: FREE White Paper

Stop hassling with half-baked ENTERPRISE SECURITY.
FREE White Paper shows you how to ensure TOTAL security for your Internet
perimeter with the most current and most complete PROACTIVE Vulnerability
Assessment solution. Get your FREE White Paper now. Click here!
https://www.qualys.com/forms/techwhite_86.html
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

Relevant Pages

  • [NT] Cryptographic Flaw in RDP Protocol Can Lead to Information Disclosure
    ... The Remote Data Protocol (RDP) provides the means by which Windows systems ... The first involves how session encryption is implemented in certain ... An attacker who was able to eavesdrop on and record ...
    (Securiteam)
  • Re: Security Question
    ... This article by Mark Russinovich about "Inside Windows Vista User Account Control" might be interresting... ... is logged into that session where it's displayed. ... Similarly, there is no sharp dividing line between two windows on the same desktop - they share a communication to and from the desktop, and sometimes between themselves. ... So, no, what the original poster describes is clearly _not_ the case - two processes running in different sessions should not interfere, because there is a security boundary between them. ...
    (microsoft.public.windows.vista.security)
  • RE: Spying, admin to user login?, Is it possible?
    ... shadow session could not be created directly on Windows XP computer. ... you could active only one user session at one time ... you need to remote desktop to a Windows 2003 ... Microsoft also publishes a KB to describe this work around in detail. ...
    (microsoft.public.windows.server.sbs)
  • Re: Remote Desktop Re-Connect
    ... does not include Windows 2003 or Windows Server. ... available target OS's are appropriate for Windows Server 2003 SE SP1? ... but my recollection was that the key is to look for event log errors at the ... remote session, and my local printer is not. ...
    (microsoft.public.windowsxp.work_remotely)
  • Re: Mapping network resources from a service
    ... > stations and desktops. ... I think I need to create a new windows station for each ... its own separate session id. ... so the TS session & security context represent the same boundary as ...
    (microsoft.public.win32.programmer.kernel)