Re: Anonymous Access - NOTHING ABOUT IIS
From: Ondrej Sevecek (ondrej.sevecek@centrum.cz)
Date: 01/23/03
- Next message: Lance: "forgot my administrator password"
- Previous message: Ondrej Sevecek: "Re: LogonUser"
- In reply to: Steven L Umbach: "Re: Anonymous Access - NOTHING ABOUT IIS"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "Ondrej Sevecek" <ondrej.sevecek@centrum.cz> Date: Thu, 23 Jan 2003 09:53:20 +0100
Hi,
thanks everyone for answers. Here comes one another...
When computer is in domain, it has got its own computer account, hasn't
it? So, if service running under LOCAL SYSTEM account is trying to access
some network resource, which authentication will be performed - as ANONYNOUS
USER or by its ComputerAccount from AD?
Thanks Ondra.
"Steven L Umbach" <sumbach@ameritech.net> píše v diskusním příspěvku
news:iZGX9.800$eZ2.457949@newssrv26.news.prodigy.com...
> Thanks for the tip Karl. --- Steve
>
> "Karl Levinson [x y] mvp" <jamescagney90210@excite.com> wrote in message
> news:uX0H48mwCHA.2868@TK2MSFTNGP12...
> > Yes, Dumpsec is good, but note that RestrictAnonymous = 1 breaks dumpsec
> > while Getacct keeps working, so using Dumpsec would give you a false
sense
> > of security.
> >
> > On my job I use Dumpsec to determine whether RestrictAnonymous has
already
> > been set to 1, but I use Getacct if I really want to enumerate the login
> IDs
> > no matter what RestrictAnonyous has been set to.
> >
> > Hardening NetBIOS is I think pretty hard to do acceptably, especially in
a
> > domain environment... null sessions are required for any Windows domain
to
> > work. You just can't keep a hacker on your network from enumerating all
> the
> > login IDs on your domain controller.
> >
> >
> > "Steven L Umbach" <n9rou@attbi.com> wrote in message
> > news:6vzX9.83816$hl1.11309@sccrnsc04...
> > > Here is another good one dumpsec. Set up a null session and
it
> > can
> > > give all kinds of tabulated reports. --- Steve
> > > http://www.somarsoft.com/somarsoft_main.htm
> > >
> > > "Karl Levinson [x y] mvp" <jamescagney90210@excite.com> wrote in
message
> > > news:eGox1KiwCHA.2472@TK2MSFTNGP12...
> > > > PS download GETACCT from www.securityfriday.com to see how a hacker
> can
> > > get
> > > > a list of the login IDs, user names and share names etc. on your
> > computers
> > > > anonymously. Consider searching www.google.com or
> > > www.microsoft.com/support
> > > > for RestrictAnonymous [or RestrictAnonymousSam for XP] to learn how
to
> > > > harden Netbios null sessions. And be sure you're using a firewall
on
> > your
> > > > internet connection.
> > > >
> > > > http://securityadmin.info/faq.htm#harden
> > > > http://securityadmin.info/faq.htm#firewall
> > > >
> > > >
> > > > "Steven L Umbach" <n9rou@attbi.com> wrote in message
> > > > news:eCwX9.1566$nK6.1051@rwcrnsc53...
> > > > > Here is a link that helped me understand it better. --- Steve
> > > > >
> > > > > http://www.sans.org/rr/win/null.php
> > > > >
> > > > > "Ondřej Ševeček" <ondrej.sevecek@centrum.cz> wrote in message
> > > > > news:ePmTE5fwCHA.616@TK2MSFTNGP11...
> > > > > > Hello,
> > > > > > I don't understand the term "anonymous access" and the way one
> can
> > > > reach
> > > > > > this credentials on windows2000.
> > > > > >
> > > > > > I already know this:
> > > > > >
> > > > > > - built-in group "everyone" CONTAINS "anonymous user"
> > > > > > - built-in group "authenticated users" DOESN'T CONTAIN
"anonymous
> > > user"
> > > > > > - "...\LSA\RestrictAnonymous" is registry key for disabling
> > membership
> > > > in
> > > > > > "everyone" for "anonymous user"
> > > > > > - there are some other GPO settings about "anonymous user" such
as
> > > > > "Disable
> > > > > > anonymous access to registry keys", "Disable anonymous SAM
> > > enumeration",
> > > > > ...
> > > > > >
> > > > > > My question is:
> > > > > >
> > > > > > - when, why, where and which way one can gain this credentials
and
> > > will
> > > > > > therefore act as "anonymous user".
> > > > > > - what services, programs, and systems use this method for
access
> to
> > > > > > resources.
> > > > > > - how can one create program to impersonate with this
credentials.
> > > > > >
> > > > > > Many thanks in advance.
> > > > > > Ondrej Sevecek.
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > >
> > > >
> > > > ---
> > > > Outgoing mail is certified Virus Free.
> > > > Checked by AVG anti-virus system (http://www.grisoft.com).
> > > > Version: 6.0.443 / Virus Database: 248 - Release Date: 1/10/2003
> > > >
> > > >
> > >
> > >
> >
> >
> > ---
> > Outgoing mail is certified Virus Free.
> > Checked by AVG anti-virus system (http://www.grisoft.com).
> > Version: 6.0.443 / Virus Database: 248 - Release Date: 1/10/2003
> >
> >
>
>
- Next message: Lance: "forgot my administrator password"
- Previous message: Ondrej Sevecek: "Re: LogonUser"
- In reply to: Steven L Umbach: "Re: Anonymous Access - NOTHING ABOUT IIS"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
