Printable View
What IPC$ share?
What is it exist for in windows?
I know just that it is some unwanted shares in windows.
If thay exist so how can I use them? What is IPC$ good for?
I traid to mount but that share was empty and I was able to execute just shell commands in that folder where IPC$ was mounted to.
==My OS==
Local=linux mandriva 10.1
Remote=windows XP pro
Inter-Process Communication (IPC$) is used for data sharing between applications and computers.
Admin$ is an administrative share of the %systemroot% folder on the local device. (C:\windows or C:\winnt)
http://support.microsoft.com/?kbid=314984
Here you go Mr.Babis take a look at this [1] hopefully that explains it a little bit ...
[1] Special shared resources
Ok this is
means that I can send commands to that remote computer/share(IPC$). But what kind of commands and how. or I need some special software for that? (from linux)Quote:
A resource that shares the named pipes that are essential for communication between programs.
If I can mount it as all other folders so it means that I can do something inside of it or I am wrong?
Reading time :)
How to create and delete hidden or administrative shares on client computers: Here
Mounting Windows Network Shares: Here
Government 'Security's thoughts on IPC: Here
Skiddies talking about IPC: Here
NOTE: This info has been posted for reading. Anything you do with this info is up to you. I dont want you people to abuse this info, blah blah blah. Not my fault if you do anything bad with it :)
and the best bit of advice seen in those links...
You can disable the default ipc$ share by setting the following registry key value to 2
HKLM\system\currentcontrolset\control\lsa\restrict annonymous
My key value was set to 0 and i changed it to 2 but the share still shows up in Shares in Computer Management. How can i disable this share?.Quote:
Originally posted here by thehorse13
and the best bit of advice seen in those links...
You can disable the default ipc$ share by setting the following registry key value to 2
HKLM\system\currentcontrolset\control\lsa\restrict annonymous
Shares can be blocked by disabling net share service or blocking netbios or ports 139...Quote:
My key value was set to 0 and i changed it to 2 but the share still shows up in Shares in Computer Management. How can i disable this share?.
Here is a litle more about netbios
http://www.nacs.uci.edu/security/netbios.html
Even if the IPC share still exists, if the regkey is set to 2, you can't get anything back. To test this out, go download WINFO and aim it at your host. If you've set the key properly, it will not be able to enumerate anything via null pipes.
http://ntsecurity.nu/toolbox/winfo/
NOTE: You need admin rights to run this app.
--Th13
There is an excellent tutorial written here http://www.antionline.com/showthread...hreadid=264811 that is very relative to this post.