RE: Terminal Services

From: Ola (lawal_at_shaw.ca)
Date: 03/13/05

  • Next message: roger.franks_at_middleeastadvertising.com: "Pen Testing capabilities of Flash Files"
    Date: Sun, 13 Mar 2005 09:08:40 -0700
    To: kiwi@kiwicomputing.com, 'AEHeald' <arianheald@bellsouth.net>
    
    

    Gentlemen,

    You can use a tool called TSGrinder to brute force a terminal server using a
    dictionary password for the administrator account. I have been playing
    around with this tool this weekend and it really rocks. You will find
    detailed information from the hammerofgod site:
    http://www.hammerofgod.com/download.htm

    TSGringer is a "dictionary" based attack tool, but it does have some
    interesting features like "l337" conversion, and supports multiple attack
    windows from a single dictionary file. It supports multiple password
    attempts in the same connection, and allows you to specify how many times to
    try a username/password combination within a particular connection.
    Note that the tool requires the Microsoft Simulated Terminal Server Client
    tool, "roboclient," which may be found here:
    ftp://ftp.microsoft.com/ResKit/win2000/roboclient.zip

    Hope this helps.
    Kind regards
    Ola

    -----Original Message-----
    From: John the Kiwi [mailto:kiwi@kiwicomputing.com]
    Sent: March 11, 2005 3:30 PM
    To: AEHeald
    Cc: pen-test@securityfocus.com
    Subject: Re: Terminal Services

    I don't use any tools for RDP testing. I have thought about writing a
    perl script to try and brute force with rdesktop, but thinking about it
    is all I have done.

    I consider the RDP Protocol to be pretty reliable and secure, there are
    some things you can do to obfuscate it.

    I normally change the default RDP Port that the server listens on.
    There's a registry entry you can change the port 3389 to something else,
    I don't have a link handy but you can probably do a search for 3389 in
    the registry.

    This has the added benefit of allowing you to publish as many
    workstations (XP Professional anyway) behind your NAT as your router
    will let you forward ports for. It's not bullet proof, but it defeats
    random scans.

    I've also heard you can use ZeBeDee - http://www.winton.org.uk/zebedee/
    to add an extra layer of encryption on a different port. I've never had
    a customer request it and it adds a lot of complexity for the user but
    the example usage I saw made setting it up look pretty straight forward.

    John the Kiwi

    On Thu, 2005-03-10 at 17:13 -0500, AEHeald wrote:
    > -----BEGIN PGP SIGNED MESSAGE-----
    > Hash: SHA1
    >
    > Greetings, group!
    >
    > I am de-lurking to inquire if anyone has some pointers on Microsoft
    > Terminal Services. I'm testing a client who allows 3389 into their
    > terminal server for the Remote Desktop Client.
    >
    > Other than the Bad Thing of allowing inbound traffic onto their LAN,
    > I'm trying to hunt down ways to enter all the way in. I have seen
    > TSCrack referenced, but the program is nowhere to be found.
    >
    > Any suggestions gratefully received.
    >
    > Eigen
    >
    >
    > -----BEGIN PGP SIGNATURE-----
    > Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>
    >
    > iQA/AwUBQjDGeQGhZ4M3hyK+EQIh2QCg8y1LWs/oc4B303gBM5CLAD0BG4QAoJ+A
    > QyWBGr7piv9nmNmHjFIUuRVi
    > =xKXQ
    > -----END PGP SIGNATURE-----
    >
    >


  • Next message: roger.franks_at_middleeastadvertising.com: "Pen Testing capabilities of Flash Files"

    Relevant Pages

    • Re: What is the best GPS Plotter to buy
      ... Meindert on the net is the manufacturer of a nice NMEA multiplexer. ... manufacturer stuff to connect just to one port. ... Just feed each device into a terminal server port and go from ... is a terminal server using tcp/ip a serial connection to the source of the NMEA output that connects to more RS232 ports, that is...is it a piece of hardware that is a serial port connecting cable that "branches" into a module having any number of additional serial ports, and whose original single input signal is then available for "processing" on each of the module's additional connecting devices? ...
      (rec.boats.cruising)
    • Re: thin client com ports
      ... I'm glad that you got at least one more client working! ... MCSE, CCEA, Microsoft MVP - Terminal Server ... the COM port settings? ... I am testing several thin clients. ...
      (microsoft.public.windows.terminal_services)
    • Re: Shared User Folders and printer setup
      ... So something with the printer port your creating doesn't actually pay attention to properly mapped drives. ... Microsoft MVP - Terminal Server ... In order to get this software to work Trans-Micro (the makers of Check Factory) have a detailed procedure that allows multiple Terminal Server users to run the software at the same time. ... Does anyone have any idea why and how can I get it to look at the Home directory path Z: ...
      (microsoft.public.windows.terminal_services)
    • RE: Externe toegang SBS
      ... The system controls the port creation and deletion automatically. ... to let the printer redirection work in the Windows 2003 terminal server, ... You must enable the printer redirection on the RDP client. ... Windows Printer Mapping ...
      (microsoft.public.windows.server.sbs)
    • Re: Sun E450 Serial Console Problems...
      ... is setting the port to 7-e-1. ... I needed to set imask_7bits to Y on the terminal server. ... It said that there should be no port monitor service running on the serial ... It comes through with characters with umlaudaes and other ...
      (SunManagers)