Win2k Hacking

These are just a few tips on hacking win 2000, i know win is lame, but lets face the facts, something like 90% of comps on the net are running some flavor or windoze

these examples only work if the NBNS (udp 137) service is open:
(type these are command prompt of win2k box, i dont know what other win flavs will work on)

netview /domain:(target domain here)

this will show a list of subdomains in a given given domain
another way to do pretty much the same thing is

nbtstat -a (target ip here)

a useful to find info on a target win2k comp is

nslookup
> ls -d (target ip here)

ok, just one more for now, to establish an anonymous connection to a target machine (if possible)

net use \\(target ip here)\ipc$ "" /u:''

the two "" are usually a place for a username and a password.
hope this little tidbit helps

Such things will work on any NT-based windows. These are easily found by typing "net" at a dos prompt; it will list commands and extensions. Any you don't know, ie net send, thype "net send ?" for extension information. BTW there's a space between "net view".

People!
turn off file and printersharing!
got to settings->network select your adapter that connects to the net and remove all bindings. now
noODle
http://doscerveza.ontheweb.nl [coming soon]

Not all of the above are affected by file & print sharing. Many (most NET commands) refer to the Windows NT Services.

remove all the bindings like client for MSnetworks and MS family logon.
if you are not logged on to the network these thinks don't work.
correct me if i am wrong.

noODle
http://doscerveza.ontheweb.nl

They work fine without a network... Not all WinNT services are network-oriented. It is set up so that all services can be easily configured, started & stopped. YOU CAN RUN ALMOST ANY SERVICE LOCALLY. YOU DO NOT NEED A LOGON. This is given you are running WinNT, 2000 or XP (I think).

You are right.

Here is a description on how to diable this

from labmice:
Disable the default shares
Windows NT and Windows 2000 open hidden shares on each installation for use by the system account. (Tip: You can view all of the shared folders on your computer by typing NET SHARE from a command prompt.) You can disable the default Administrative shares two ways. One is to stop or disable the Server service, which removes the ability to share folders on your computer. (However, you can still access shared folders on other computers.) When you disable the Server service (via Control Panel > Administration Tools > Services), be sure to click Manual or Disabled or else the service will start the next time the computer is restarted. The other way is via the Registry by editing HKeyLocal Machine\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters. For Servers edit AutoShareServer with a REG_DWORD Value of 0. For Workstations, the edit AutoShareWks. Keep in mind that disabling these shares provide an extra measure of security, but may cause problems with applications. Test your changes in a lab before disabling these in a production environment. The default hidden shares are:

Set AllowAnonymous=2 in the registry (don't remember the path of the key)

In w2k this can be set in the Local Security Policies | Security options | Aditionnal restrictions for anonymous connections -> No access without explicit anonymous permissions

Ammo

*FART*

Yes, turn off file sharing! Even if you have your c drive password-protected they can still run trojans on your system.

If you do not want this bug to effect you my first reccomendation would be to take advise of my sig.
And remove Windows 2000. If you are using Windows 2000 maybe you should seek a new OS. as People
like me are happy to migrate somone to Linux. Other alternatives are FreeBSD, Solaris, Mac OS X, Lots more
info on Microsoft Alternatives could be found on www.windows-sucks.com