Windows XP remote access methods for pen test

[Curt Wilson <netw3_security () hushmail com>]

While working with the Security Configuration and Analysis MMC snap-in 
(applying securews template in this case) in a Win XP Pro SP1 system, I 
came across some items that could be useful to the attacker and/or pen 
tester. Anyone who has played with XP security policies will have seen 
these, however I've seen little information about the security 
ramifications of the following items, and would enjoy a discussion about 
these elements:

Local Policies...Security Options...Network Access: Named pipes that can 
be accessed anonymously
 
COMNAP,COMNODE,SQL\QUERY,SPOOLSS,LLSRPC,EPMAPPER,LOCATOR,TrkWks,TrkSvr  

Remotely accessible registry paths:

System\CurrentControlSet\Control\ProductOptions,System\CurrentControlSet\C
ontrol\Print\Printers,System\CurrentControlSet\Control\Server 
Applications,System\CurrentControlSet\Services\Eventlog,Software\Microsoft
\OLAP Server,Software\Microsoft\Windows 
NT\CurrentVersion,System\CurrentControlSet\Control\ContentIndex,System\Cur
rentControlSet\Control\Terminal 
Server,System\CurrentControlSet\Control\Terminal 
Server\UserConfig,System\CurrentControlSet\Control\Terminal 
Server\DefaultUserConfiguration

(I'm assuming that these reg paths are useless to a remote attacker, 
unless the remote registry service is enabled and the attacker/pen tester 
has access. I always turn off remote registry so I've not explored these 
options)

Shares that can be accessed anonymously

COMCFG,DFS$

Has anyone successfully leveraged the existence of any of these elements, 
and do you have any information from practical experience that you would 
be willing to share? It strikes me that there could be some interesting 
content here if we could spend some time fuzzing and exploring.

Thanks

Curt Wilson
Netw3 Security Research
www.netw3.com





----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/