Penetration Testing mailing list archives
Re: Terminal Services
From: John the Kiwi <kiwi () kiwicomputing com>
Date: Fri, 11 Mar 2005 16:29:34 -0600
I don't use any tools for RDP testing. I have thought about writing a perl script to try and brute force with rdesktop, but thinking about it is all I have done. I consider the RDP Protocol to be pretty reliable and secure, there are some things you can do to obfuscate it. I normally change the default RDP Port that the server listens on. There's a registry entry you can change the port 3389 to something else, I don't have a link handy but you can probably do a search for 3389 in the registry. This has the added benefit of allowing you to publish as many workstations (XP Professional anyway) behind your NAT as your router will let you forward ports for. It's not bullet proof, but it defeats random scans. I've also heard you can use ZeBeDee - http://www.winton.org.uk/zebedee/ to add an extra layer of encryption on a different port. I've never had a customer request it and it adds a lot of complexity for the user but the example usage I saw made setting it up look pretty straight forward. John the Kiwi On Thu, 2005-03-10 at 17:13 -0500, AEHeald wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings, group! I am de-lurking to inquire if anyone has some pointers on Microsoft Terminal Services. I'm testing a client who allows 3389 into their terminal server for the Remote Desktop Client. Other than the Bad Thing of allowing inbound traffic onto their LAN, I'm trying to hunt down ways to enter all the way in. I have seen TSCrack referenced, but the program is nowhere to be found. Any suggestions gratefully received. Eigen -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBQjDGeQGhZ4M3hyK+EQIh2QCg8y1LWs/oc4B303gBM5CLAD0BG4QAoJ+A QyWBGr7piv9nmNmHjFIUuRVi =xKXQ -----END PGP SIGNATURE-----
Current thread:
- PHP Directory Transversal Andres Molinetti (Mar 10)
- Re: PHP Directory Transversal Felikz (Mar 10)
- Re: PHP Directory Transversal Andres Molinetti (Mar 10)
- Re: PHP Directory Transversal David M. Zendzian (Mar 10)
- Re: PHP Directory Transversal Cedric Foll (Mar 10)
- RE: PHP Directory Transversal Ravish (Mar 10)
- Terminal Services AEHeald (Mar 11)
- Re: Terminal Services Kinnell (Mar 11)
- RE: Terminal Services Jerry Shenk (Mar 11)
- Re: Terminal Services John the Kiwi (Mar 11)
- RE: Terminal Services Ola (Mar 14)
- RE: Terminal Services Mark Woan (Mar 16)
- Terminal Services AEHeald (Mar 11)
- Re: PHP Directory Transversal Felikz (Mar 10)
- Re: PHP Directory Transversal John GALLET (Mar 14)