-
October 25th, 2005, 07:10 PM
#1
What is IPC$?
What IPC$ share?
What is it exist for in windows?
I know just that it is some unwanted shares in windows.
If thay exist so how can I use them? What is IPC$ good for?
I traid to mount but that share was empty and I was able to execute just shell commands in that folder where IPC$ was mounted to.
==My OS==
Local=linux mandriva 10.1
Remote=windows XP pro
// too far away outside of limit
-
October 25th, 2005, 07:13 PM
#2
Inter-Process Communication (IPC$) is used for data sharing between applications and computers.
Admin$ is an administrative share of the %systemroot% folder on the local device. (C:\windows or C:\winnt)
http://support.microsoft.com/?kbid=314984
09:F9:11:02:9D:74:E3:5B 8:41:56:C5:63:56:88:C0
-
October 25th, 2005, 07:19 PM
#3
Here you go Mr.Babis take a look at this [1] hopefully that explains it a little bit ...
[1] Special shared resources
-
October 25th, 2005, 08:12 PM
#4
Ok this is
A resource that shares the named pipes that are essential for communication between programs.
means that I can send commands to that remote computer/share(IPC$). But what kind of commands and how. or I need some special software for that? (from linux)
If I can mount it as all other folders so it means that I can do something inside of it or I am wrong?
// too far away outside of limit
-
October 25th, 2005, 11:24 PM
#5
Reading time
How to create and delete hidden or administrative shares on client computers: Here
Mounting Windows Network Shares: Here
Government 'Security's thoughts on IPC: Here
Skiddies talking about IPC: Here
NOTE: This info has been posted for reading. Anything you do with this info is up to you. I dont want you people to abuse this info, blah blah blah. Not my fault if you do anything bad with it
-
October 26th, 2005, 07:28 PM
#6
and the best bit of advice seen in those links...
You can disable the default ipc$ share by setting the following registry key value to 2
HKLM\system\currentcontrolset\control\lsa\restrict annonymous
Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden
-
October 30th, 2005, 07:29 PM
#7
Junior Member
Originally posted here by thehorse13
and the best bit of advice seen in those links...
You can disable the default ipc$ share by setting the following registry key value to 2
HKLM\system\currentcontrolset\control\lsa\restrict annonymous
My key value was set to 0 and i changed it to 2 but the share still shows up in Shares in Computer Management. How can i disable this share?.
-
October 31st, 2005, 01:08 AM
#8
My key value was set to 0 and i changed it to 2 but the share still shows up in Shares in Computer Management. How can i disable this share?.
Shares can be blocked by disabling net share service or blocking netbios or ports 139...
Here is a litle more about netbios
http://www.nacs.uci.edu/security/netbios.html
// too far away outside of limit
-
October 31st, 2005, 07:06 PM
#9
Even if the IPC share still exists, if the regkey is set to 2, you can't get anything back. To test this out, go download WINFO and aim it at your host. If you've set the key properly, it will not be able to enumerate anything via null pipes.
http://ntsecurity.nu/toolbox/winfo/
NOTE: You need admin rights to run this app.
--Th13
Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden
-
November 4th, 2005, 01:11 AM
#10
Junior Member
There is an excellent tutorial written here http://www.antionline.com/showthread...hreadid=264811 that is very relative to this post.
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|