Best NetBIOS brute forcing tool?

NAME
nat - NetBIOS Auditing Tool

SYNOPSIS
nat [-o <output>] [-u <userlist>] [-p <passlist>] <address>


How do you brute force with this?



By the way... I have obtained the enum source code, and I think that unless someone has enum+, I'm going to try and make it myself. Yes, I am stubborn. I know from wordlist tests that he has no lockout procedure, mainly because I could use that to permanently lock him out, I guess. This is a way I know that willl work, and so I'm going to try it.

Quote:

---

By the way... I have obtained the enum source code, and I think that unless someone has enum+, I'm going to try and make it myself. Yes, I am stubborn. I know from wordlist tests that he has no lockout procedure, mainly because I could use that to permanently lock him out, I guess. This is a way I know that willl work, and so I'm going to try it.

---

If you stop and reread this thread you would see the link I gave you. I'd be willing to bet you a dollar if you wrote that individual he would give you the tool. Just tell him you are experimenting with your own network. If he doesn't give it up, then think about physical security.

Sometimes physical security is the hardest to obtain. I'd also bet you with either knoppix std, or a set of nix boot disks I could steal SAM. Even if it is password protected on BIOS a few jumpers short of the password is all you need. Then you are most likely in. Besides, the best hacks are original. Study the set up, come up with an original idea. Don't look over the sholders of your peers. Create your own path.


Be safe and stay free

Quote:

---

Originally posted here by The Grunt
How would the ISP even know? He is doing this INSIDE his own network. It's FIREWALLED to the outside world... How would the ISP even know unless they were snooping around? And since he is quite certain his brother isn't running a firewall, there aren't going to be any firewall logs. And MOST people don't bother to check Event Viewer every day to see how many logins there have been... His hack is not supposed to remain undetected, he WANTS his brother to know about it... Why should he run nessus? He already found the only thing going on with his brothers computer. There is ONE service. He has to get in through that if he wants to get in directly with no user interaction. He has posted considering the other ways of doing it that others posted, and decided none of them will work, and that a brute forcer is the only way to do it...

---

Did I not say _be this a real case_? By which I mean, a real 'outdoor' attack. Brute-forcing a login on any system if done across the network is simply stupid. Yeah, he wouldn't have a problem with it when it's done to his brother's computer, but my reply was made from a learning perspective. Please read along more carefully next time.

I am surprised, however, that your brother hasn't simply blocked all requests coming from your IP. I mean, that will really turn the game up a notch wouldn't it? Getting into spoofing IP and etcetera... or, owning the firewall box and using that as a relay. Anyway, many possibilities/fun stuff to do.

I guess [don't have prior knowledge about it] that the NAT program would use a user and a pass list... don't know if used without those it would try to bruteforce.

I guess tweaking the enum source code is a good idea. It's much better than simply skidding the situation. Good luck on that attempt!

considering you are on the same LAN segment i would use a tool like Dsniff(network sniffer and password extractor program ) let it run for a couple of days then check if you got some password your brother uses on other sites, then use a program like hydra (dictionary hacker program ), wright a pass file of all different combos of previously sniffed passwords and you might get lucky people tend to either use the same password on lots of places or different combinations or adding numbers and so on.
good luck and happy hacking.
i hope this is for purely education purposes

I FOUND IT!!!

I got enum+ with full source code. The cool thing being that my own, modified enum source was beginning to look just like it. I was on the right track for sure. Now I have the answer, tho I will strive to figure out the rest of what I would have needed to change to activate real brute forcing.

So right now I am using enum+ to brute force his password, and I have also activated the suggested sniffer and it seems to be working (not that i've sniffed anything yet, cause he hasn't come home. I wonder if it will work, tho, cause our switch doesn't seem to send data to the hosts that don't have anything to do with mentioned data. I think there is a mirror funtion or something on it... hm.. that's a nice idea.

Also, I've checked out the power cutting option, and it seems I can make a plausible excuse out of it, however I am not sure if he would consider it a bad thing to do if he found out. We haven't actually sat down and discussed the rules for this game. heh


thanks for all the suggestions and help, guys
I'll lurk around in the shadows for a while and see if I can get comfortable with this forum.
you gave me a nice start :D

ehm.. it might be usefull for the rest of us if you pasted the link to the source..

that way the community learns too !!

Here we go. (attached)

Found it on http://www.whitehat.co.il

I believe I tracked Gothtec down.. heh! ;)

An extra hint, your NIC should be in promiscuous mode for the sniffer to work properly [unless it sets this mode on its own] Normally your NIC only listens for stuff that's directed at it, instead of looking at all the traffic on the network.

Something strikes me as very odd about this. I have seen any number of newbies get flames into smoldering ashes for asking questions alot more benign than this one. Now there was a lot of good advice given out in this thread. But one question lingers in my head. Why the insitance on the netBIOS brute force attack. With all the good suggestions being tossed in why does it HAVE to be netbios?

-Zombieman77

Quote:

---

With all the good suggestions being tossed in why does it HAVE to be netbios?

---

I considered this prior to my advice. While we may never know if in fact he is using this against his brother. He asked his question in a better fashion than most. So I personally didn't see much harm in giving 2 cents. I suggested he move to another forum. Reason being I felt he was on thin ice, and at any moment one from above might smite him.


Be safe and stay free

Hello again.

I've been away for a little while, doing school work. I am happy to say that the NetBIOS brute forcing succeeded and I got into my brothers comp :D

He has closed down his netbios services now, but then he can't access his files from his laptop, so I am looking forward to see what he's gonna do about that.

I planted a little worm on his comp, but of course he checked around and found it.

On the other hand, the link found to www.whitehat.co.il is correct. That is enum+ with source. Happy brute forcing.

If your handy with java, and you say you know all about exploits, you should write a worm that will run over IE. Better yet, you should work on a password enumerator that runs over IE in java.

Quote:

---

Originally posted here by kr5kernel
If your handy with java, and you say you know all about exploits, you should write a worm that will run over IE. Better yet, you should work on a password enumerator that runs over IE in java.

---

I don't follow you.. I already managed to break into his system, and now I am half waiting for his reposte, and half waiting for what kind of security he will put up next.

Have I ever said I know all about exploits? I see myself as an "experienced script kiddie with basic programming skills" or some other hilarious title. I am not one for writing an entirely new, undetected worm that will run over IE. And I am NOT (and I don't think you are either) one who can get my brother to click on a link I give him that does not look nice when he wgets it and checks the source.

Quote:

---

Originally posted here by -[PM.gothtec]-

How did you get it to do SMB? The command line options are:
- l: Login file to use.
Default file -> user.txt
- s: Use the same login.
- c: Password file to use.
Default file -> dic.txt
- r: Attack FlowPoint Router.
- t: Attack Telnet.
- f: Attack FTP.
- p: Attack POP.

I don't know what to do :confused:

---

Not sure if you understood me right or not? I was talking about Cain & Abel. As long as you have a HUB, you will easily pick up SMB and all the other protocols... and once you sniff one up, you right click on it to send it to the cracker engine.

That is maybe something you should run now, since it's your brothers turn now.. just sit there and monitor for any kind of usernames/passwords until it's your turn again.. hehe! ;)

Keep us posted! :)

For the rebound... start simple and set your firewall to ignore all connection attempts from any IP but the router's on your network [the gateway computer, in your case]. If you do use your laptop and need to transfer files between it and the desktop, allow it's IP/MAC per session only. Another way is to make the gateway computer assign fixed IPs based on the MAC of the requesting NIC [sure it can be spoofed, but you are simply taking the game a step higher].

It's not fool proof, no doubt, but it will make it harder :)

Quote:

---

Originally posted here by hypronix
For the rebound... start simple and set your firewall to ignore all connection attempts from any IP but the router's on your network [the gateway computer, in your case]. If you do use your laptop and need to transfer files between it and the desktop, allow it's IP/MAC per session only. Another way is to make the gateway computer assign fixed IPs based on the MAC of the requesting NIC [sure it can be spoofed, but you are simply taking the game a step higher].

It's not fool proof, no doubt, but it will make it harder :)

---

thanks, it's been done as you adviced

im confused... if you just cracked his netbios, how did you plant a worm on his comp? wouldnt you only be getting access to share drives? you wouldnt be able to execute any files on his comp, would you? did u use the schedueler thingy?

Quote:

---

Originally posted here by Phonedog911
im confused... if you just cracked his netbios, how did you plant a worm on his comp? wouldnt you only be getting access to share drives? you wouldnt be able to execute any files on his comp, would you? did u use the schedueler thingy?

---

nah. much more commonplace than that. i used the startup folder :rolleyes:

?? he has his startup folder shared over netbios?

the entire drive
he didn't think i would take the time to actually brute force it. or he didn't think at all.

Hypronix: He doesn't need to allow anything from his firewall/router either. There is no reason for it to be talking to his box and it just leaves another exploitable hole. The router will only be passing traffic from other IP's through to the initiating box so the IP's will all be on the public network. Assuming he is using 192.168.x.x then he can drop all packets from 192.168.0.0/16.

Goth: You wanna really piss off your brother? Add a second IP address to the desktops NIC. Make the subnet 10.x.x.x and add similar to the laptop too. For example:-

Desktop:

Secondary IP Address: 10.13.127.1
Secondary subnet mask : 255.255.255.252
Secondary default gateway: 10.13.127.2

Laptop:

Secondary IP Address: 10.13.127.2
Secondary subnet mask : 255.255.255.252
Secondary default gateway: 10.13.127.2

Add entries to each computers hosts file to point the computer name to the appropriate IP address. Then let him see you connecting freely to both. It'll take him a while to work out what you are doing and as long as both computers are online he can't get onto the subnet. You'll know if he tries because one of your machines will show an IP address conflict. If you want to go further set up IPSec or similar between the two boxes, then he can't sniff and won't be able to spoof the laptop if you remove it from the network.....

That will piss him off...... ;)

well... i guess sharing your entire hd(even with a password) is not a good idea if your little brother is trying to hack your computer

Phone: If he doesn't know how to turn off the default shares, (C$, Admin$ etc.), he doesn;t have any choice really..... ;)

sry, didnt mean to offend anybody or anything...

admin$ and c$ were never shared by default on my xp comp(i dont thing), whats in those shares? the only thing that i can find on my comp like that is ipc$. i checked out a few tuts on netbios but they didnt really have any info on the "secret shares".

They aren't "secret"..... Unless you have "fiddled" with the box in Win2000/XP there is a share, ("administrative"), for each drive on the box.... Connect to \\thebox\c$ and if you have the rights it will connect and show you the entire drive..... Unfortunately, you can't "simply" disable that share... you either have to firewall it off, close NetBOIS or disable them in the registry.

there is a dirty way of doing it without screwing around with the registry, i think
i believe all you have to do is ENABLE sharing of c: as C (or whatever the default name is), reboot and disable it. XP won't share the same partition twice, so enabling the share disables the default one, which remains off after disabling it again.

don't quote me on that one, but I believe I've seen that work...

the tut i was reading called them the secret shares... i tried the c$ share on my comp and it says that path doesnt exist. "net use f: \\mycomp\c$" am i not doing it right?

Quote:

---

Originally posted here by -[PM.gothtec]-
there is a dirty way of doing it without screwing around with the registry, i think
i believe all you have to do is ENABLE sharing of c: as C (or whatever the default name is), reboot and disable it. XP won't share the same partition twice, so enabling the share disables the default one, which remains off after disabling it again.

don't quote me on that one, but I believe I've seen that work...

---

No, if you do this in Win XP Pro, you end up with two share C$ and C. (assuming you aren't using Simple File Sharing)
In Win XP Home edition though, I don't think you have the C$ at all... (because it's limited to only allow for Simple File Sharing... I believe)