Re: Terminal Services Banner - Rdesktop, Tsgrind, Tscrack

[Shohn Trojacek <trojacek () gmail com>]

David,

Yeah, I tried that too and it worked about as well as BP's recent
efforts. Thank you for the response regardless. Oh well, maybe I'll
release a patch for rdesktop and help people lock out accounts more
often.

Shohn

On Wed, Jun 9, 2010 at 4:16 AM, David Ball <david.ball () db com> wrote:
> Use the -b switch with tsgrinder to get past the banner.
>
> tsgrinder.exe -w wordlist.txt -u administrator -b 192.168.1.1
>
>
>
> Shohn Trojacek <trojacek () gmail com>
> Sent by: listbounce () securityfocus com
>
> 06/09/2010 02:53 AM
>
> To
> pen-test () securityfocus com
> cc
> Subject
> Re: Terminal Services Banner - Rdesktop, Tsgrind, Tscrack
>
>
>
>
> Thanks for writing back; however, the question still stands with
> regard to the legal banner ;)
>
> Shohn
>
> On Tue, Jun 8, 2010 at 1:46 PM, Jacky Jack <jacksonsmth698 () gmail com> wrote:
> > I never do bruteforce on this except checking weak passwords a few times
> > mainly because of account lockout, which is not a desired option in pentest
> > engagement.
> >
> > On Fri, Jun 4, 2010 at 9:29 PM, Shohn Trojacek <trojacek () gmail com> wrote:
> > > Hello:
> > >
> > > Trying not to reinvent the wheel here, does anyone have any idea with
> > > regard to a method for performing dictionary attack against terminal
> > > servers that have the legal banner enabled? I'm finding that in all
> > > cases the legal banner seems to stop the password guessing. I'm
> > > guessing that a modification to simply send a keypress through is all
> > > that is needed.
> > >
> > > I've tried this with rdesktop brute force patch (both patches),
> > > tsgrinder, tscrack, etc. but to no avail. Any plans by the authors of
> > > those tools to update or release source :P
> > >
> > > Shohn
> > >
> > > ------------------------------------------------------------------------
> > > This list is sponsored by: Information Assurance Certification Review
> > > Board
> > >
> > > Prove to peers and potential employers without a doubt that you can
> > > actually do a proper penetration test. IACRB CPT and CEPT certs require a
> > > full practical examination in order to become certified.
> > >
> > > http://www.iacertification.org
> > > ------------------------------------------------------------------------
>
> ------------------------------------------------------------------------
> This list is sponsored by: Information Assurance Certification Review Board
>
> Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
> and CEPT certs require a full practical examination in order to become certified.
>
> http://www.iacertification.org
> ------------------------------------------------------------------------

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified. 

http://www.iacertification.org
------------------------------------------------------------------------