Cracker Trying To Get In...

Printable View

June 30th, 2002, 01:05 AM
jared_c

Cracker Trying To Get In...

I posted a few days ago with a log file that had numerous FTP attempts to the web sites I host. They were pretty much random attempts and I wasn't worried about them. Everyone here pretty much agreed that it was no big deal and probably just some script kiddie messing around.

Well, the plot thickens. I checked my log file today, and an IP Address located in China has been trying all day to get into the FTPs for these sites. Instead of just random user names and passwords, the person has been trying to crack root, administrator, guest and actual default accounts. I still wasn't too worried because I figured that was just some standard script that tried to crack default accounts. A little more smarter than the previous attempts, but still no big deal.

However, as the attempts increased I noticed that the cracker started trying to get into actual FTP accounts that are on the computer. There were numerous attempts to login to valid FTP logins such as: Jared, PJ, Margie, Dorothy. These are some actual login names for my network. It seems like somehow the cracker got a list of valid logins to my network, which has me stumped. Now I am starting to get worried. The attempts are coming from an IP Address in China, so he is probably going through a proxy. That kills my chances of tracking him down. Now since he has been trying valid logins, I want to know how he was able to obtain these names. I know that he isn't trying a brute force attack using random people's names because the attempts were ONLY for VALID login accounts that exist on my network. There were no more bogus or random user names tried.

Does anyone know how the cracker may have gotten a list of valid logins for my network? I never gave out a list, and I am the only one that has access to this network. I truely am stumped and want to stop this guy. At the least I want to find out how he got the logins so I can prevent that from happening again.

I am running a Windows 2000 Server network with the latest security packs and patches. Any ideas? I can really use some input. I am stumped.

Here is a snippet from the log file. You will notice that first standard default account logins were tried, but then actual valid user names started to get tried.

00:19:10 218.108.215.89 [1006]USER test 331 - - -
00:19:10 218.108.215.89 [994]USER access 331 - - -
00:19:10 218.108.215.89 [1012]USER root 331 - - -
00:19:12 218.108.215.89 [1006]PASS - 530 - - -
00:19:12 218.108.215.89 [994]PASS - 530 - - -
00:19:12 218.108.215.89 [1012]PASS - 530 - - -
00:19:12 218.108.215.89 [996]USER account 331 - - -
00:19:12 218.108.215.89 [995]QUIT - 530 - - -
00:19:12 218.108.215.89 [1008]USER user 331 - - -
00:19:12 218.108.215.89 [996]PASS - 530 - - -
00:19:12 218.108.215.89 [1012]USER root 331 - - -
00:19:12 218.108.215.89 [1008]PASS - 530 - - -
00:19:12 218.108.215.89 [1014]USER webmaster 331 - - -
00:19:12 218.108.215.89 [1012]PASS - 530 - - -
00:19:12 218.108.215.89 [1010]USER web 331 - - -
00:19:13 218.108.215.89 [992]QUIT - 530 - - -
00:19:13 218.108.215.89 [994]QUIT - 530 - - -
00:19:13 218.108.215.89 [1014]PASS - 530 - - -
00:19:13 218.108.215.89 [1008]USER user 331 - - -
00:19:13 218.108.215.89 [1004]USER oracle 331 - - -
00:19:13 218.108.215.89 [990]USER admin 331 - - -
00:19:13 218.108.215.89 [1010]PASS - 530 - - -
00:19:13 218.108.215.89 [1002]USER sybase 331 - - -
00:19:13 218.108.215.89 [1012]QUIT - 530 - - -
00:19:13 218.108.215.89 [1005]QUIT - 530 - - -
00:19:13 218.108.215.89 [996]USER account 331 - - -
00:19:13 218.108.215.89 [1008]PASS - 530 - - -
00:19:13 218.108.215.89 [1004]PASS - 530 - - -
00:19:13 218.108.215.89 [990]PASS - 530 - - -
00:19:13 218.108.215.89 [1014]QUIT - 530 - - -
00:19:13 218.108.215.89 [1002]PASS - 530 - - -
00:19:13 218.108.215.89 [1010]QUIT - 530 - - -
00:19:13 218.108.215.89 [996]PASS - 530 - - -
00:19:13 218.108.215.89 [1006]USER test 331 - - -
00:19:14 218.108.215.89 [1008]USER user 331 - - -
00:19:14 218.108.215.89 [1002]USER sybase 331 - - -
00:19:14 218.108.215.89 [1006]PASS - 530 - - -
00:19:14 218.108.215.89 [996]QUIT - 530 - - -
00:19:14 218.108.215.89 [1008]PASS - 530 - - -
00:19:14 218.108.215.89 [1002]PASS - 530 - - -
00:19:14 218.108.215.89 [1004]USER oracle 331 - - -
00:19:14 218.108.215.89 [990]USER admin 331 - - -
00:19:14 218.108.215.89 [1006]QUIT - 530 - - -
00:19:14 218.108.215.89 [1008]QUIT - 530 - - -
00:19:14 218.108.215.89 [1002]USER sybase 331 - - -
00:19:14 218.108.215.89 [1004]PASS - 530 - - -
00:19:14 218.108.215.89 [990]PASS - 530 - - -
00:19:15 218.108.215.89 [1002]PASS - 530 - - -
00:19:15 218.108.215.89 [1004]USER oracle 331 - - -
00:19:15 218.108.215.89 [990]QUIT - 530 - - -
00:19:15 218.108.215.89 [1002]QUIT - 530 - - -
00:19:15 218.108.215.89 [1004]PASS - 530 - - -
00:19:15 218.108.215.89 [1004]QUIT - 530 - - -
00:19:37 218.108.215.89 [1016]USER TsInternetUser 331 - - -
00:19:37 218.108.215.89 [1017]USER TsInternetUser 331 - - -
00:19:37 218.108.215.89 [1018]USER SQLAgentCmdExec 331 - - -
00:19:37 218.108.215.89 [1019]USER SQLAgentCmdExec 331 - - -
00:19:37 218.108.215.89 [1020]USER PJ 331 - - -
00:19:37 218.108.215.89 [1021]USER PJ 331 - - -
00:19:37 218.108.215.89 [1022]USER Margie 331 - - -
00:19:37 218.108.215.89 [1023]USER Margie 331 - - -
00:19:37 218.108.215.89 [1024]USER Jared 331 - - -
00:19:37 218.108.215.89 [1025]USER Jared 331 - - -
00:19:37 218.108.215.89 [1026]USER IWAM_WS1 331 - - -
00:19:37 218.108.215.89 [1027]USER IWAM_WS1 331 - - -
00:19:37 218.108.215.89 [1028]USER IUSR_WS1 331 - - -
00:19:37 218.108.215.89 [1029]USER IUSR_WS1 331 - - -
00:19:37 218.108.215.89 [1030]USER Guest 331 - - -
00:19:37 218.108.215.89 [1031]USER Guest 331 - - -
00:19:37 218.108.215.89 [1032]USER dorothy 331 - - -
00:19:37 218.108.215.89 [1033]USER dorothy 331 - - -
00:19:37 218.108.215.89 [1034]USER ASPNET 331 - - -
00:19:37 218.108.215.89 [1035]USER ASPNET 331 - - -
00:19:37 218.108.215.89 [1036]USER Administrator 331 - - -
00:19:37 218.108.215.89 [1037]USER Administrator 331 - - -
00:19:37 218.108.215.89 [1016]PASS - 530 - - -
00:19:37 218.108.215.89 [1019]PASS - 530 - - -
00:19:37 218.108.215.89 [1017]PASS - 530 - - -
00:19:37 218.108.215.89 [1018]PASS - 530 - - -
00:19:37 218.108.215.89 [1020]PASS - 530 - - -
00:19:37 218.108.215.89 [1021]PASS - 530 - - -
00:19:37 218.108.215.89 [1022]PASS - 530 - - -
00:19:37 218.108.215.89 [1023]PASS - 530 - - -
00:19:37 218.108.215.89 [1029]PASS - 530 - - -
00:19:37 218.108.215.89 [1031]PASS - 530 - - -
00:19:37 218.108.215.89 [1030]PASS - 530 - - -
00:19:37 218.108.215.89 [1024]PASS - 530 - - -
00:19:37 218.108.215.89 [1025]PASS - 530 - - -
00:19:37 218.108.215.89 [1026]PASS - 530 - - -
00:19:37 218.108.215.89 [1027]PASS - 530 - - -
00:19:37 218.108.215.89 [1028]PASS - 530 - - -
00:19:37 218.108.215.89 [1032]PASS - 530 - - -
00:19:37 218.108.215.89 [1033]PASS - 530 - - -
00:19:37 218.108.215.89 [1034]PASS - 530 - - -
00:19:37 218.108.215.89 [1035]PASS - 530 - - -
00:19:37 218.108.215.89 [1036]PASS - 530 - - -
00:19:37 218.108.215.89 [1037]PASS - 530 - - -
00:19:37 218.108.215.89 [1016]USER TsInternetUser 331 - - -
00:19:37 218.108.215.89 [1017]USER TsInternetUser 331 - - -
00:19:38 218.108.215.89 [1016]PASS - 530 - - -
00:19:38 218.108.215.89 [1037]USER Administrator 331 - - -
00:19:38 218.108.215.89 [1017]PASS - 530 - - -
00:19:38 218.108.215.89 [1019]USER SQLAgentCmdExec 331 - - -
00:19:38 218.108.215.89 [1018]USER SQLAgentCmdExec 331 - - -
00:19:38 218.108.215.89 [1030]USER Guest 331 - - -
00:19:38 218.108.215.89 [1037]PASS - 530 - - -
00:19:38 218.108.215.89 [1017]USER TsInternetUser 331 - - -
00:19:38 218.108.215.89 [1019]PASS - 530 - - -
00:19:38 218.108.215.89 [1018]PASS - 530 - - -
00:19:38 218.108.215.89 [1030]PASS - 530 - - -
00:19:38 218.108.215.89 [1031]USER Guest 331 - - -
00:19:38 218.108.215.89 [1020]USER PJ 331 - - -
00:19:38 218.108.215.89 [1017]PASS - 530 - - -
00:19:39 218.108.215.89 [1016]USER TsInternetUser 331 - - -
00:19:39 218.108.215.89 [1019]USER SQLAgentCmdExec 331 - - -
00:19:39 218.108.215.89 [1018]USER SQLAgentCmdExec 331 - - -
00:19:39 218.108.215.89 [1030]USER Guest 331 - - -
00:19:39 218.108.215.89 [1031]PASS - 530 - - -
00:19:39 218.108.215.89 [1020]PASS - 530 - - -
00:19:39 218.108.215.89 [1022]USER Margie 331 - - -
00:19:39 218.108.215.89 [1029]USER IUSR_WS1 331 - - -
00:19:39 218.108.215.89 [1023]USER Margie 331 - - -
00:19:39 218.108.215.89 [1016]PASS - 530 - - -
00:19:39 218.108.215.89 [1017]USER TsInternetUser 331 - - -
00:19:39 218.108.215.89 [1033]USER dorothy 331 - - -
00:19:39 218.108.215.89 [1035]USER ASPNET 331 - - -
00:19:39 218.108.215.89 [1036]USER Administrator 331 - - -
00:19:39 218.108.215.89 [1019]PASS - 530 - - -
00:19:39 218.108.215.89 [1018]PASS - 530 - - -
00:19:39 218.108.215.89 [1020]USER PJ 331 - - -
00:19:39 218.108.215.89 [1030]PASS - 530 - - -
00:19:39 218.108.215.89 [1031]USER Guest 331 - - -
00:19:39 218.108.215.89 [1022]PASS - 530 - - -
00:19:39 218.108.215.89 [1023]PASS - 530 - - -
00:19:39 218.108.215.89 [1029]PASS - 530 - - -
00:19:39 218.108.215.89 [1017]PASS - 530 - - -
00:19:39 218.108.215.89 [1033]PASS - 530 - - -
00:19:39 218.108.215.89 [1025]USER Jared 331 - - -
00:19:39 218.108.215.89 [1021]USER PJ 331 - - -
00:19:39 218.108.215.89 [1035]PASS - 530 - - -
00:19:39 218.108.215.89 [1036]PASS - 530 - - -
00:19:39 218.108.215.89 [1020]PASS - 530 - - -
00:19:40 218.108.215.89 [1034]USER ASPNET 331 - - -
00:19:40 218.108.215.89 [1031]PASS - 530 - - -
00:19:40 218.108.215.89 [1022]USER Margie 331 - - -
00:19:40 218.108.215.89 [1021]PASS - 530 - - -
00:19:40 218.108.215.89 [1025]PASS - 530 - - -
00:19:40 218.108.215.89 [1023]USER Margie 331 - - -
00:19:40 218.108.215.89 [1017]USER TsInternetUser 331 - - -
00:19:40 218.108.215.89 [1027]USER IWAM_WS1 331 - - -
00:19:40 218.108.215.89 [1036]USER Administrator 331 - - -
00:19:40 218.108.215.89 [1034]PASS - 530 - - -
00:19:40 218.108.215.89 [1022]PASS - 530 - - -
00:19:40 218.108.215.89 [1030]USER Guest 331 - - -
00:19:40 218.108.215.89 [1031]USER Guest 331 - - -
00:19:40 218.108.215.89 [1023]PASS - 530 - - -
00:19:40 218.108.215.89 [1021]USER PJ 331 - - -
00:19:40 218.108.215.89 [1025]USER Jared 331 - - -
00:19:40 218.108.215.89 [1029]USER IUSR_WS1 331 - - -
00:19:40 218.108.215.89 [1017]PASS - 530 - - -
00:19:40 218.108.215.89 [1027]PASS - 530 - - -
00:19:40 218.108.215.89 [1036]PASS - 530 - - -
00:19:40 218.108.215.89 [1033]USER dorothy 331 - - -
00:19:40 218.108.215.89 [1037]USER Administrator 331 - - -
00:19:40 218.108.215.89 [1026]USER IWAM_WS1 331 - - -
00:19:40 218.108.215.89 [1024]USER Jared 331 - - -
00:19:40 218.108.215.89 [1016]USER TsInternetUser 331 - - -
00:19:40 218.108.215.89 [1035]USER ASPNET 331 - - -
00:19:40 218.108.215.89 [1028]USER IUSR_WS1 331 - - -
00:19:40 218.108.215.89 [1031]PASS - 530 - - -
00:19:40 218.108.215.89 [1030]PASS - 530 - - -
00:19:41 218.108.215.89 [1021]PASS - 530 - - -
00:19:41 218.108.215.89 [1025]PASS - 530 - - -
00:19:41 218.108.215.89 [1033]PASS - 530 - - -
00:19:41 218.108.215.89 [1026]PASS - 530 - - -
00:19:41 218.108.215.89 [1029]PASS - 530 - - -
00:19:41 218.108.215.89 [1024]PASS - 530 - - -
00:19:41 218.108.215.89 [1037]PASS - 530 - - -
00:19:41 218.108.215.89 [1016]PASS - 530 - - -
00:19:41 218.108.215.89 [1035]PASS - 530 - - -
00:19:41 218.108.215.89 [1028]PASS - 530 - - -
00:19:41 218.108.215.89 [1020]USER PJ 331 - - -
00:19:41 218.108.215.89 [1032]USER dorothy 331 - - -
00:19:41 218.108.215.89 [1034]USER ASPNET 331 - - -
00:19:41 218.108.215.89 [1031]USER Guest 331 - - -
00:19:41 218.108.215.89 [1030]USER Guest 331 - - -
00:19:41 218.108.215.89 [1022]USER Margie 331 - - -
00:19:41 218.108.215.89 [1021]USER PJ 331 - - -
00:19:41 218.108.215.89 [1023]USER Margie 331 - - -
00:19:41 218.108.215.89 [1025]USER Jared 331 - - -
00:19:41 218.108.215.89 [1033]USER dorothy 331 - - -
00:19:41 218.108.215.89 [1026]USER IWAM_WS1 331 - - -
00:19:41 218.108.215.89 [1029]USER IUSR_WS1 331 - - -
June 30th, 2002, 01:27 AM
n01100110

Well the first thing i would have to say would be that maybe he used the "Finger" attack to get a valid list of user names, but thats UNIX and besides you said your running windows 2000 right ?so i would have to say he either used DUMP ACL ,Sid 2 user , or Onsite Admin exploits to attain a valid list.Thats all i can say .

i know you might have done this already , but i think i might of gotten his name
Trying whois -h whois.apnic.net 218.108.215.89

% Rights restricted by copyright. See http://www.apnic.net/db/dbcopyright.html
% (whois6.apnic.net)

inetnum: 218.108.88.0 - 218.108.247.255
netname: HZCNC-PPPOE
descr: HangZhou City Netcom Info Port Co. Ltd.
descr: No.9 Shuguang road,HangZhou city,ZheJiang province
descr: New Telecommunication Carrier Based on IP Backbone
country: CN
admin-c: QZ53-AP
tech-c: QZ53-AP
mnt-by: MAINT-CN-HZCNC
changed: [email protected] 20020621
source: APNIC

person: qin zhang
address: No.9 ShuGuang Road,HangZhou City,ZheJiang Province
country: CN
phone: +86-571-85111919
fax-no: +86-571-85214455
e-mail: [email protected]
nic-hdl: QZ53-AP
mnt-by: MAINT-NEW
changed: [email protected] 20020620
source: APNIC
June 30th, 2002, 01:32 AM
Lady HaxX0r

n01100110 is so cool! wow
June 30th, 2002, 01:47 AM
jared_c

Yea, I did a DNS lookup on the IP Address already. It's in China, that's why I think it is someone going through a proxy.

I just went throught my Web Server logs (the other was the FTP log) and I noticed that yesterday around the same time someone ran a scanner on my site. There were a whole bunch of common exploit attempts, and it was from the same IP Address. This guy is clearly out to get me.

Could you point me in the direction of where I can get more info on "DUMP ACL ,Sid 2 user , or Onsite Admin exploits". Maybe even some kind of scanner I can use to see if I am open for these type of attacks.

This guy is really getting to me. And I am still wondering how the hell he got a user list.
June 30th, 2002, 02:00 AM
droby10

you might want to check out a nbt enumeration utility to see if you're broadcasting allowing for sensitive information leaks. i would suggest nbtdump from @stake:

http://www.atstake.com/research/tools/index.html

{somewhat plug}
if you're wanting to scan the entire network for similar vulnerabilities, then it might be easier to use something equivalent to my own nbtdig:

http://droby10.addr.com/utility/nbtdig/
{/somewhat plug}
June 30th, 2002, 02:08 AM
n01100110

They have all of the information on dump acl and the other exploits on www.hackingexposed.com.

Goodluck my friend
June 30th, 2002, 02:12 AM
ammo

Ok, my guess would be that he enumerated the accounts with, like n01100110 said DUMP Acl or others that list trough netbios sharing. Do you have sharing activated on that computer? Are ports 137-139, 445 open (netstat -na), are you running a firewall of some sort?
This is pretty much the only way I see he could have got the account names.

As for stopping the attacks:
1- Block that IP address, either through the ftp server (is it IIS ftp server?), or with a firewall.

2- You pretty much have no choice but to contact the ISP. If the attack is being proxied at that IP, only they can really investigate further (contacting the customer). If it really originate from that IP, only the ISP can really deal with it... Try the [email protected], or try the e-mail on the dns record (ideally you'd search the ISP's website but I couldn't find it.. ). Don't forget to e-mail your ftp server's logs with the date and your timezone.

Hope this helps.. give us feedback..

Ammo
June 30th, 2002, 02:18 AM
khakisrule

I do not know what server you are using, but I do know that there are very configurable ftp servers that will allow you to block ftp connections from IPs that you have specified as banned. Lol, I learned the hard way when I got auto-banned cause I set cuteftp to re-connect every 25 seconds. And he may use a different proxy, then you can block that as well, and though I do not know for sure, I am fairly sure that there is some kind of ftp server that will look if the user is using a proxy, and block those connections. Try google or yahoo or alltheweb. Good luck.
June 30th, 2002, 02:21 AM
jared_c

First off, thanks everybody for your help.

I ran nbtdump on my server's IP Address. Holy **** is all I have to say. It returned a list of users, and also returned what kind of permissions they had. That is scary. How do I disable that? I think this explains how he got the users list.

It also said that null sessions can be established to IP$. I don't know what this means, but it listed a whole bunch of shares I have on the server. That scares the hell out of me. How can I stop this information from being available to anyone that runs this program on my IP?

Again. Thank you so much everyone for your help.
June 30th, 2002, 02:34 AM
khakisrule

And one more thing that may be very beneifcial in your case, some ftp servers can auto-ban somebody after a certain number of incorrect logins. It would stop your cracker no matter what proxy he used. And like I said, I don't know which one, but I logon on to IRC dumps a lot so I know that these kinds of servers do exist. I would reccoment getting one with that feature, it would be the best protection feature you could hope for.
June 30th, 2002, 02:37 AM
jared_c

Here are the ports I have open on the server: 135, 445, 1025, 1131, 1214, 1597, 1601, 3312, 3313, 5000

I do not have the servers behind a firewall.

khakisrule, thanks for the suggestion. IIS FTP does not have that feature. I'm going to look into some alternative FTP servers and find one that offers that feature.

Can anyone explain to me how I can stop that share information from being displayed, along with how to stop the account dump?
June 30th, 2002, 02:49 AM
droby10

firewall that bad boy, before it turns into either a warez site or a launch pad for attack against other unprotected computers...which brings to light one question - have you tried running nbtdump against the supposed host that the attack is originating from?
June 30th, 2002, 02:57 AM
jared_c

droby10, I'm not sure how to go about getting a firewall. Here is my situation:

I have two web servers on a DSL connection. I purchase IP Addresses from my DSL provider when I get new web sites to host. I have about 6 IP Addresses from them.

What kind of hardware firewall can I use for a setup like that? Any online stores anyone can refer me to? I actually asked about this a few months ago, but no one could help me out with a firewall to go along with my current setup.

This netbios thing is still bugging me out. Is there anyway to stop that other than blocking the port from the outside world with a firewall? Anyway to disable it for now at least until I get a firewall, and what would be any negative results of me doing that?

Sorry for all the questions, but I just want to get this locked down asap due to this cracker currently trying to get in. Thanks again everyone.
June 30th, 2002, 02:58 AM
droby10

"IIS FTP does not have that feature"

you can limit who and where people log in from with IIS 5.

suggested search and reading topics:

- win2k domain/local policies
- IIS lockdown measures
- null sessions

you asked earlier about null sessions, the null session may be something that is vital to your infrastructure - but there's no reason to allow it out in the open, so at least firewall it. otherwise i would suggest disabling it. IT is what allows for the enumeration of shares, users, services, etc.

quick fix, !!!!if it's not vital to infrastructure!!!!

then change the registry key for:

HKLM\SYSTEM\CurrentControlSet\Control\LSA\RestrictAnonymous

from DWORD 0 to 1 or 2 (depends on your needs). i would start out with 2 as it usually makes the most sense.
June 30th, 2002, 03:06 AM
khakisrule

Here is one ftp server, http://download.com.com/3000-2165-24...ml?tag=lst-0-1 the G6 ftp server. It supports anti-hammering which means it will block the user from connecting if they try to connect too many times or too fast.
http://download.com.com/3000-2165-10...ml?tag=lst-0-9 looks ok, it supports a ban feature.
http://download.com.com/3000-2165-10...l?tag=lst-0-13 I put guild-ftp in here because it also supports banning and anti-hammering but is free, unlike the other two which are only free to try.
These are just a few of the ftp servers I found on the first page of a search at download.com, so I imagine there are many ftp servers that have the anti-hammering feature. Look for it, I am sure you will find one to your liking. Good luck.
June 30th, 2002, 03:06 AM
jared_c

Quote:

you can limit who and where people log in from with IIS 5.

I have started blocking the IP Addresses as they come in. They are constantly changing though. This guy is really annoying.

Quote:

suggested search and reading topics:

- win2k domain/local policies
- IIS lockdown measures
- null sessions

I just got done reading the IIS 5 Security Check list, and the Windows 2000 Security check list on the MS web site. I did everything they suggested.

Quote:

you asked earlier about null sessions, the null session may be something that is vital to your infrastructure - but there's no reason to allow it out in the open, so at least firewall it. otherwise i would suggest disabling it. IT is what allows for the enumeration of shares, users, services, etc.

As soon as I get a firewall it is getting blocked. That is the first thing I am doing as soon as I hook the firewall up. Unfortunately, I'm really not sure if it is vital to my infrastructure or not. It is installed by default. I'm searching the web right now for more information on it. And I probably will disable it.
June 30th, 2002, 03:07 AM
ammo

Indeed, download a firewall, be it zonealarm, tiny firewall, outpost...
Only let in port 21 and 20. (if you want to allow pasv (passive) ftp transfers, you will need to open a bunch of high ports (6000-65535 for say..) too.)
If you run a web server, let in port 80 also.

Make sure ports 135-139 as well as 445 are firewalled: these are microsoft networking ports (netbios over tcp (nbt)).
If you are not using file sharing, go in network properties and remove "file and printer sharing for microsoft network".

If you are using file sharing on an internal network and the ftp server abseloutly has to be able to share too, and the computer is multihomed (it has 2 network cards, one on the LAN, one on the internet) - not recommanded-, go to network and dial-up connections, click the advanced menu and select advacend settings, select the network card of on the internet in the top list box, and uncheck file and printer sharing and client for microsoft network.
Also make sure that the ports mentionned above are well firewalled.

Also, go in control panel, administrative tools, local security settings, local policies, security options, double click additional restrictions for anonymous connections, select no access without explicit anonymous permission.

That should be a good first step in getting you secured.

From what you've told us up to now, your current setup is REALLY NOT SECURE! It's a good thing you asked us!

Ammo
June 30th, 2002, 03:24 AM
droby10

at least the passwords weren't stored in the user comments...right?
June 30th, 2002, 03:24 AM
n01100110

Well first of all , if you have file shares on your system , one way of protecting them from not appearing in Legion or any other lame file share searcher , when you are in the network menu and configuring your shares , say the share name was called MY_DOCS ; what you wanna do is append a $ at the end of the share name (IE MY_DOCS$)presto , it is hidden from remote attackers.This was not intended to solve the problem your facing , but it will help you all that much more
-N
June 30th, 2002, 03:30 AM
jared_c

Ammo, yes it is a good thing I asked. You guys have helped out so much, and I have learned a great deal in the past couple of hours.

Quote:

at least the passwords weren't stored in the user comments...right?

Oops.... just kidding :)

I think I have the server locked down a lot better than it was before, I just really need to get a firewall now. I'm a little sketchy on installing a software firewall on my Windows 2000 Server box. Has anyone done this with ZoneAlarm? I have been very pleased with ZoneAlarm on my personal PC, but I don't know how it would act on a Windows 2000 Server machine.

OK... Just disabled netbios over tcp/ip all together and nbtdump no longer displays any of the information. I am so damn happy now. I feel much safer... I am still shocked that that is enabled by default especially on a web server.

So anyone have any other suggestions on where to go from here to secure my servers? This whole experience has been an eye opener. I was always under the impression that as long as you keep up to date with patches you will be all good. I guess I almost became a statistic today.

Thank you again everyone for all your help. :)
June 30th, 2002, 03:53 AM
n01100110

Well if ur talking about file shares , then i know a little trick that gets the job done with legion or any other lame tool.For your file share name (ex my_stuff) , you would append an $ to the end of it so it would look like this (my_stuff$).Not elite , but it will get the job done.
-N
June 30th, 2002, 04:00 AM
avdven

Jared > In my experience, ZoneAlarm works terrific on a 2000-based server. I currently have ZoenAlarm Pro running on my 2000 servers without any problems. My hardware firewall blocks all incoming traffic except for very specific ports, but ZoneAlarm has been useful filtering that incoming traffic as well as all outgoing traffic. Hope that helps

AJ
June 30th, 2002, 04:07 AM
Palemoon

Well not sure how your firewall IP tables work but if I have a known IP 218.108.215.89 I can with my firewall then use the following
218.108.215.0 = nix 255 addys on that leg of the IP
218.108.0.0 = nix both addys and an entire leg
218.0.0.0 nix China alltgether cause I don't do business with them nor the site depend upon visitors from China
just my general firewall rules when I see sh..ah stuff I don't like and yep another table can take care of exceptions.

While I use Zone alarm at home another system at work but from what I see ZA covers this also.
June 30th, 2002, 07:20 AM
AngryBob

do you have restrict anonymous turned on? if not then its really easy for any script kiddie to find all of the user names on your computer. esp with w2000 i find it very common in my neck of the woods.
June 30th, 2002, 06:44 PM
Lady HaxX0r

DISCLAIMER:

Sorry for my lame message earlier in the thread, it got some bad reactions and justly so! It was after clubbing for a mate's birthday so I wasn't in the soberest state and just wanted to express general joy and appreciation, though obviously I picked the wrong medium - but hey! At least I can acknowledge it was stupid! So what exactly is a whois? How does it work? I know you've gotten past that now and it's really obvious to you all but I do wanna try to understand stuff even if I have minimal knowledge on which to base it, sooo...any handy links etc?

XXX
June 30th, 2002, 06:48 PM
ammo

There are registries of who "owns" what IP blocks, as well as who owns what dns names. When you register those they ask informations. A whois is simply querying those registries. You give it an IP address, it looks up in what IP block it is, it looks up who owns the ip block and returns the info provided by the owner... It's that simple..

Ammo
June 30th, 2002, 06:55 PM
Lady HaxX0r

Oh ok, I can kinda comprehend that, wow! But...how do you all know how to query the registries? Is that really common knowledge? Are they really accessible or something? And I know this is pretty dumb but why would you need to register them anyway? Sorry for being so persistently lame, and thanks for clarifying that ammo!

XXX
June 30th, 2002, 07:01 PM
str34m3r

The site at www.arin.net provides a nice web-based interface for the whois database. If the IP address you're asking about is under someone else's jurisdiction (such as APNIC in this example), they will give you a link to the APNIC whois so you can do the appropriate search there. It's a great way to do whois-type searches without needed a whois client.
June 30th, 2002, 07:08 PM
Lady HaxX0r

Brilliant, thankyou. I had no idea it was so simple, no wonder I sound like a ****. Ho hum. We live and learn. Additionally, is that similar to the databases you can get that identify homeowners' names, addresses, immediate family and phone numbers? Or are they not common access?

XXX
June 30th, 2002, 07:28 PM
str34m3r

The only time you should get a homeowner's address from his IP address is when he/she bought the IP address permanently. More typically, you'll get the name of the ISP or a company name associated with an entire IP block. Then you have to contact the ISP or company if you want to get any more detailed info. Often, though, they won't give you any info won't give you any of the info for the person in question, they'll just handle the complaint themselves. This is usually a good thing, since I sure wouldn't want my ISP giving away my home address to any Joe Schmoe who claimed that my IP had attacked them.
June 30th, 2002, 09:37 PM
Maverick811

Jared_c, if you haven't thought about it already, here is something to consider. If you are running multiple servers, ie web, ftp, etc, etc, you may want to look at purchasing a hardware appliance firewall. I'm not sure if you are hosting web servers for others or what your situation is, but I would definitely consider looking into a firewall appliance. My personal experience with WatchGuard Technologies, http://www.watchguard.com , has been very pleasing. For your situation, I'd recommend their Firebox SOHO: http://www.watchguard.com/products/fireboxsoho.asp

It's a Small Office, Home Office firewall. Watchguard provides pretty good support with their Live Security service, and as I stated earlier, my experience with them has been excellent. If you have the financial resources, this may be an option you will want to consider to better protect your network.

Just some thoughts...
July 1st, 2002, 06:05 PM
jared_c

Maverick.. That looks like the type of firewall I have been looking for....

The way my setup is:

DSL Modem -> Hub -> Servers plugged into hub. The servers use the IP Addresses that are assigned to us by the DSL provider.

Would this firewall appliance work if I plugged it directly into the DSL Modem, and then the hub into the firewall? The other firewalls I found were built into routers that required me to have the servers use internal IP Addressing (192.168.1.x).

Would this firewall allow me to use it with my current setup without having to use internal IP Addressing? That would be excellent.

Thanks for the info.
July 1st, 2002, 06:32 PM
Maverick811

Quote:

Originally posted here by jared_c
Maverick.. That looks like the type of firewall I have been looking for....

The way my setup is:

DSL Modem -> Hub -> Servers plugged into hub. The servers use the IP Addresses that are assigned to us by the DSL provider.

Would this firewall appliance work if I plugged it directly into the DSL Modem, and then the hub into the firewall? The other firewalls I found were built into routers that required me to have the servers use internal IP Addressing (192.168.1.x).

Would this firewall allow me to use it with my current setup without having to use internal IP Addressing? That would be excellent.

Thanks for the info.

Jared_c,

So you are purchasing IP addresses from your ISP, all of which get assigned to your DSL modem?

I'm not sure if you could do this without internal IP addresses or not, but here's what you could do - now I haven't personally used the SOHO (I've been using one the larger scale appliances from their Firebox series of appliances), but I'm pretty sure it would work the same. Using the SOHO, you may have to let your network be assigned internal IP addresses, but you can use reverse NAT on the SOHO to ensure that packets are sent to the right server. You can from within the Firebox setup designate how incoming traffic is handled. (Again, this is how I've used it with the larger scale Fireboxes, but it should work the same for the SOHO). For example, you can setup an incoming service, say HTTP for example. If Server A responds to traffic designated for IP address X, and Server B responds to traffic designated for IP address Y, and Server C responds to traffic designated for IP address Z, on the incoming HTTP service you setup, you direct incoming traffic to the respective machine. All traffic with a destination IP address of X is routed through the SOHO to Server A, all traffic with a destination IP address of Y is routed to Server B, and so on. I've done this in the past and it works great. You can set up FTP services, HTTP services, all kinds of different things. I've found the appliances really easy to use, but very powerful.

It may be worth checking with Watchguard Technologies to confirm this for use with the SOHO, but I know it has worked for me.

If anybody here is using a SOHO and can confirm my response or answer Jared_c's question, I would appreciate it.

Jared_c, feel free to post here or PM me if you have any more questions. I'd be happy to help...