Penetration Testing mailing list archives
RE: Hacking to Xp box
From: Eduardo Suzuki <eduardo.ac.suzuki () gmail com>
Date: Sat, 3 Sep 2005 03:21:01 -0300
Hi, Marco! IMO, I think it's harder to attack a workstation compared to a server through a network, since servers must have some open port in listening state. On a workstation the user is the weakest point most of the time, while on a server there are many other parts to take into account. If there is a firewall in place (for example, the one that comes with XP SP2), which attacks are possible through a network? AFAIK just a few. Windows XP restricts most of the attacks that use anonymous connections. Service Pack 2 restricts even more. If you are a domain admin, there are many possibilities, but that's not the case here. What do you mean by "executing a jpg or a gif file"? I know there are buffer overflow vulnerabilities that can be exploited when opening an image, but it's not a trivial attack. I'm not sure (because I didn't try it), but I think it's even harder to do it when you need to merge an executable into an image using a joiner. I'd like to know what you think about it. Regarding the hxdef rootkit, you can find it out by using RootKitRevealer from SysInternals. It's available at http://www.sysinternals.com/Utilities/RootkitRevealer.html. BTW, hxdef isn't considered an attack tool. It's used after you successfully got access to a computer, when you want to hide files, open ports and so on. Just my $0.02. Regards, Eduardo Suzuki esuzuki_br () pop com br Eduardo.AC.Suzuki () gmail com "The essential is invisible to the eyes." -----Original Message----- From: Marco Monicelli [mailto:marco.monicelli () marcegaglia com] Sent: Friday, September 02, 2005 6:12 AM To: Juan B Cc: pen-test () securityfocus com Subject: Re: Hacking to Xp box Importance: High Ciao juan! If the CEO box is fully patched and FW is enabled, then your mission is a little bit more difficult to accomplish. Besides, there are thousands of recent exploits for windows which you can try. For example, did you try the Universal exploit for the Plug and Play vulnerability? It is published everywhere. You can try with more recent exploits than the DCOM exploit which is at least 3 years old. If you want to try with the trojan, I would suggest you to google for Bifrost, which is a Remote Administration Tool (you can call it trojan if you prefer) that is completely UNDETECTED by any AV (at the moment it is still 100% undetected). You can pack it inside any file (exe, jpg, gif....) and it will be executed silently and hiddenly. Moreover, Bifrost can bypass firewalls injecting itself into Explorer.exe process. Another good UNDETECTED tool is hxdef rootkit. Arp poisoning could do the job but why not trying to steal the SAM file and to crack it? You can do that remotely if the machine has the ports you mentioned opened. I bet you know some tool to steal the SAM and to crack it. I love SAMDUMP for example. ;) Last but not least, you can try with a Denial of Service to show your CEO how easily a kid can prevent you from working with a simple DoS. Why not sniffing the network? There are many undetected sniffers around the Web. Just my 2 cents ;) Marco Hi Guys Please give me a hend here. Im trying to penetrate the CEO box to show him why we need better security in our company, he told me to show me how it can be done. he has xp pro sp 2 with all the pathches installed and FW enbled but I cant ! I tried to use metasploit with the ms rpc dcom exploit but it didnt worked. nessus found port 135 139 2000 and ntp are opened and also he can read some smb shares and also outputed that this host doesnt disgard SYN packets that have the FIN flag set. and port 2000 (callback is open). what I can try more to break this box? any ideas? I know I allways can try to arp poison his arp table and pass all the machines traffic throw my laptop to capture some passwords but this is enough. or send him a trojan but we have a good anti virus protection . Does some of you have Ideas ? Thanks a lot ! Juan __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com ---------------------------------------------------------------------------- -- Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 ---------------------------------------------------------------------------- --- ---------------------------------------------------------------------------- -- Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 ---------------------------------------------------------------------------- --- ------------------------------------------------------------------------------ Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 -------------------------------------------------------------------------------
Current thread:
- Re: Hacking to Xp box, (continued)
- Re: Hacking to Xp box Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] (Sep 03)
- RE: Hacking to Xp box Jayson Anderson (Sep 02)
- Re: Hacking to Xp box Marco Monicelli (Sep 02)
- RE: Hacking to Xp box Omar A. Herrera (Sep 02)
- RE: Hacking to Xp box Michael Gargiullo (Sep 02)
- RE: Hacking to Xp box Omar A. Herrera (Sep 03)
- RE: Hacking to Xp box Enrique A. Sanchez Montellano (Sep 03)
- RE: Hacking to Xp box Michael Gargiullo (Sep 02)
- RE: Hacking to Xp box Josh perrymon (Sep 02)
- RE: Hacking to Xp box John Forristel (SunGard-Chico) (Sep 02)
- RE: Hacking to Xp box Eduardo Suzuki (Sep 03)
- RE: Hacking to Xp box Marco Monicelli (Sep 05)
- RE: Hacking to Xp box chad (Sep 03)
- RE: Hacking to Xp box Eduardo Suzuki (Sep 05)
- RE: Hacking to Xp box Marco Monicelli (Sep 05)
- RE: Hacking to Xp box McKinley, Jackson (Sep 05)
- Re: Hacking to Xp box Kelly Scroggins (Sep 06)
- Re: Hacking to Xp box Marco Monicelli (Sep 07)
- RE: Hacking to Xp box Steve.Cummings (Sep 06)
- RE: Hacking to Xp box Enrique A. Sanchez Montellano (Sep 06)
- Re: Hacking to Xp box Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] (Sep 06)
(Thread continues...)