Results 1 to 9 of 9

Thread: Wot could I do with a NetBios Null session?

  1. May 30th, 2003, 09:36 AM #1
    boomwoody
    boomwoody is offline
    Banned
    Join Date
    Feb 2003
    Posts
    12

    Wot could I do with a NetBios Null session?

    They told me that a Null session is sending a null for the user name and password when establishing a connection to the ipc$ (Inter Process Communication) pipe. And they said I'm able to establish a null session they can gain lists of user names, shares, etc...

    But how can I do that?
    Reply With Quote Reply With Quote
  2. May 30th, 2003, 10:49 AM #2
    SirDice
    SirDice is offline
    Just Another Geek
    Join Date
    Jul 2002
    Location
    Rotterdam, Netherlands
    Posts
    3,401
    Check the archives. There are probably a few tutorials/postings covering this topic.

    Oh i also have another rule for you to add to your signature:

    I must learn to search the OA archives before asking questions.

    http://www.antionline.com/showthread...=null+sessions
    Oliver's Law:
    Experience is something you don't get until just after you need it.
    Reply With Quote Reply With Quote
  3. May 30th, 2003, 11:53 AM #3
    thehorse13
    thehorse13 is offline
    Master-Jedi-Pimps0r & Moderator thehorse13's Avatar
    Join Date
    Dec 2002
    Location
    Washington D.C. area
    Posts
    2,885
    Yes, you can enumerate accounts via $IPC null sessions. This includes domain accounts should you be lucky enough to attempt this in a MS domain. However, there is also something else you can do, and that is go to jail. Think about what you are doing before you go running amuck on a network because people like me (and others here) are just waiting for people like you to step out of line on our networks.

    When asking questions, be clear about your intentions. If you ask a question like yours, it immediately smells of malicious intent. Try explaining your situation:

    "Hi, I'm a junior tech and I was told about account enumeration via $IPC shares. I have been given the task of identifying machines that are serving up these shares. Are there tools to identify this and what can I do to close this hole?"

    Behave in this fashion and you will reap all the benefits this site has to offer.

    Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
    Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden
    Reply With Quote Reply With Quote
  4. May 30th, 2003, 12:46 PM #4
    Tiger Shark
    Tiger Shark is offline
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    Posts
    5,197

    because people like me (and others here) are just waiting for people like you to step out of line on our networks.
    Hoss: You have never said a truer word my friend......

    From this sysadmin's POV it's..... C'mon down skiddies..... Wanna play with my network from the inside...... Ohhhhh..... I have dreams about this...... "Pick yer window son.... Y'er Leavin'..." <LOL>

    PS: Did we watch Platoon recently.... (your sig is a line from that)....
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides
    Reply With Quote Reply With Quote
  5. May 30th, 2003, 01:40 PM #5
    R0n1n
    R0n1n is offline
    Senior Member
    Join Date
    Oct 2002
    Posts
    314
    Rhino 9 prodcued a paper some time back which provided some detail on null sessions so that might be useful to you. ( I think the paper was entitled Windows hacking, or something similar). Also I suspect that any article on attacking Windows will provide coverage of this topic.
    Quis custodiet ipsos custodes
    Reply With Quote Reply With Quote
  6. June 1st, 2003, 12:51 PM #6
    boomwoody
    boomwoody is offline
    Banned
    Join Date
    Feb 2003
    Posts
    12
    Hi, I'm a junior tech and I was told about account enumeration via $IPC shares. I have been given the task of identifying machines that are serving up these shares. Are there tools to identify this and what can I do to close this hole?

    I am a Analyser, I know how 2 close is by editing .reg file. I'm just a little bit curious about how the crackers do.
    Any way... thank you all.
    Reply With Quote Reply With Quote
  7. June 1st, 2003, 02:42 PM #7
    hjack
    hjack is offline
    The Recidivist
    Join Date
    Nov 2002
    Posts
    460
    boomwoody, your not to quick are you? I mean the wheel is spinning, but the gerbil is dead man.



    hjack
    "Where the tree of knowledge stands, there is always paradise": thus speak the oldest and the youngest serpents.
    - Friedrich Nietzsche
    Reply With Quote Reply With Quote
  8. June 2nd, 2003, 05:56 AM #8
    Maestr0
    Maestr0 is offline
    Senior Member Maestr0's Avatar
    Join Date
    May 2003
    Posts
    604
    The mighty google knows all.
    "NetBios Null Session"
    I have answered you, now you must write 'I will not use NetBios for evil' one hundred times.

    -Maestr0
    \"If computers are to become smart enough to design their own successors, initiating a process that will lead to God-like omniscience after a number of ever swifter passages from one generation of computers to the next, someone is going to have to write the software that gets the process going, and humans have given absolutely no evidence of being able to write such software.\" -Jaron Lanier
    Reply With Quote Reply With Quote
  9. June 2nd, 2003, 01:18 PM #9
    boomwoody
    boomwoody is offline
    Banned
    Join Date
    Feb 2003
    Posts
    12
    hoho, Maestr0 is a googler
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules