HELP! PLEASE!! How can I access a remote Win98 box?

Hi, Please help! I recently lost the dedicated data connection to one of my remote data-collection stations running basic Win98 (This machine is unmanned, and in an isolated location, so I can’t just have someone install “PC Anywhere” or something similar. Weather delays are preventing us from getting the line repaired, and I need to do a data pull on this machine. The machine still has an active connection to the Internet, and I have done a port-scan which reveals the standard ports as being open (80, 81, 82, 119, 389,1002, 1080, 1720), but after I attempted an HTTP://IP_Address:80, I got nothing. My predecessor didn't tell me about any firewalls, so I am stumped. I am a UNIX guy dumped into this by default. Is there anyway that I can connect to the machine through one of these open ports and access data on C:\? I had always assumed that a Windows box with open ports and an active ‘net connection was pretty much there for the taking, but darned if I can figure it out. If anyone can help, or point me to a site that will help, I would really appreciate it. Thanks, Dave

Hrmm. It's interesting that there are some unusual ports open. Perhaps you should see what those ports hold open.

What exactly is this for and why use a Win98 box? Windows 98 isn't exactly server technology and certainly lacks the security that is needed, especially if it's "data-collection".

What is installed on it?

(I feel this might be a legit cause...)

Based on the 389(ldap) and 1720(h323hostcall) ports, it seems to me it might be running netmeeting... you might be able to connect and use the remote desktop functionnality...

Port 82 is listed as Xfer utility, so it might help but I've never heard of such a program... Anyone?

What happens when you try to connect with your browser (on port 80 of course)?
Does telneting (to port 80) show anything (don't forget to send 2 returns to a server message)...

BTW, how's that host usually managed?

Ammo

The machine in question is basically a dumb terminal. It takes feeds from several meteorological sensors (wind, temp, rain-fall), runs a couple of algorythms and then spits the info back down a dedicated line every six hours. (That is when the line isn't down 'cause of an ice-storm... something vaguley ironic about that isn't there?). As for the open ports, it is a bit unusual, but then the whole set-up is. It was cobbled together out of bits and pieces.... (Your tax dollars at work :eek: !!) and I just go thrown into the Sysadmin position for it a short time ago... never touched a Win98 box in my life.... Telnetting doesn't seem to get me anywhere (I understand Telnet is not an available feature on Win boxes by default?) and Doing an http:// to port 80 gets me "Connection closed by server" message

Win98???? :eek:


That makes things a little bit tougher. It doesn't run the full suite of services that an NT box would be by default. Hence, less to exploit in an emergency. The ports you list as being open are pretty weird for a workstation. I mean....LDAP, Socks, and H323 stuff....wierd indeed. If you have access to a *nix box have you tried scanning it with nessus? It will link you to the known security exploits on those porst. You could also look on CERT for some of the exploits, but I don't know of anything right off the top of my head to try. Sorry.


edit---damn y'all type fast. I try to post and get three ahead of me before I can even get this half-baked answer articulated. ;)

81/tcp Name Server NS
82/tcp XFER Utility XFER
119/tcp Network News Transfer Protocol NNTP
389/tcp Lightweight Directory Access Protocol LDAP
1002 is unassigned as a standard TCP/UDP port Possible Application(s) = NetMeeting or another non-standard LDAP
1080 is a SOCKS protocol or proxy
1720 is another non-standard port but NetMeeting and GnomeMeeting use this as RDS (Remote Desktop Sharing) also a common DoS vulnerability port

??????? Data-collection?

Thanks Xylinx for getting the Ports.

Off-hand, my first question is are you sure its a Win98 box?

Second, are you sure you have the right IP? Because none of those look like data collection ports (assuming standard databases).

Have you tried telnetting to each port to see what the response is (banner info)?

Ok... I am 99.99847875572% positive that it is a Win 98 SE box. Apparently it was grabbed at the last minute when the original machine kacked and died about six months ago. The data flow was supposed to go out on port 1720 (I think). All the 'data-collection work' is done by a fairly basic script that was put together about 3-4 years ago. It has worked, so no one ever bothered to improve on it, as for security, there is none... even if you found it, there is nothing on it but met data for a relatively unihabited area up north.

Unless there is some type of remote software on it.. I'm afraid yer dead in the water. Someone is gonna have to brave the "snot-freezing-in-your-nose" temperatures and get the data manually from the machine.

98 is definately not the serving out type of box. Also, there must be firewalls on this box or it's not Win98. Windows 98 ALWAYS has ports 135-139 open. Those aren't showing up in your scan.

Ok, thanks all.. I guess worse comes to worst, I can stiff the boss for a couple of days travel and some gas & food money. Anyone wanna go for a three-hour snow-shoe? Thanks all, appreciate it, Dave

do a search and get a copy of NetCat:

http://www.atstake.com/research/tool...ork_utilities/

run it like this:

echo GET/http1.0 \n\n |nc -v -n <ipaddress> 80

and try:

echo quit |nc -vv -n <ipaddress> 80,81,82,119,389,1002,1080,1720

you might get some usefull info on the ports

as you said a telnet server is not a stadard feature of a win (9x at least) machine but neither is a web server. software has been added to it that's keeping those ports open. first you have to find out what services are doing that. Is you can get a reply using NetCat (telnet is very awkard for this kind of thing) maybe we can figure a way to get a copy of NC running on the remote machine and give you a command prompt. if the machine has not been administered to in a while there might be some major holes.

if it transfers info over an isdn what is it doing being connected to the internet?

I know how to snow shoe. Seriously. I'd take some travel pay and drag an akio behind me to work on a 'puter in the middle of the wilderness some where. Sounds like fun to me. :D

I do wish you the best of luck though.

Hmmmm! An unmanned Windows 98 machine in an isolated location running as a remote data-collection station and you say you recently lost the dedicated data connection to it!

It seems odd that you have only recently lost the dedicated data connection to it, after all I would think that a Windows 98 machine even running some of the most mundane tasks would have crashed or come up with a BSOD (blue screen of death) within a few days.


Do yourself a favor when you travel out there to fix it, install a real OS like Linux that will offer you remote connectivity via SSH.


But then again, you said you where a Unix guy, so I bet this is already what you had in mind.

You're darn tooting.. if I had my way, the whole *$#&@ing world would run on Linux. Unfortunately, I lost the election for Global Emporer to Bill... Anyway, Yeah, I know running this whole thing on Win ANYTHING is asking for trouble. Appreciate all the help folks... gonna make a case to the boss to junk the machine and put a nice Sun Sparc in it's place. Telnet, rlogin... does life get any better?

Ick! telnet, rlogin? Please! Go with ssh!

Ammo

LOL.. SSH? That's for wimps. I still use Pine for email and write Perl scripts in VI!

Actually, SSH is good for wimps with security on the mind. And even I LOVE vi (and no, it's NOT pronounced VY) and I use SSH-2

;)

Quote:

---

Originally posted here by tirediron
LOL.. SSH? That's for wimps. I still use Pine for email and write Perl scripts in VI!

---

Huh? I don't get it? SSH is for wimps as opposed going arround with your pants down with rlogin and telnet?

"I still use Pine for email and write Perl scripts in VI!"
Yeah, so? What does this have to do with SSH??? Do you even know what SSH is???


Ammo

Hey Ammo... I was joking. There's no need to get nasty about it. Yes, I am very well aware of SSH, the point of my comment there was simply to repond to your original comment saying "Ick! telnet, rlogin? Please! Go with ssh!" it was simply meant to say that I prefer the older tools such as telnet, rlogin and such (Because that's what I 'grew up' with. There's nothing wrong with SSH, and on many occasions, Open-SSH has proved a very useful tool to me. Most of the machines that I admin have almost no security on them, (not my choice) so rlogin is perfect! Simple, quick, and easy, so naturally it, or an equivilent was my first thought! If I offended you, sorry. Most of the Unix people that I know take a perverse pride in their knowledge of arcane commands and processes.

Quote:

---

I LOVE vi (and no, it's NOT pronounced VY)

---

I pronounce it VIle, and on some days eVIL!
How about VIcious?
:cool:

Oh ok then...
Don't get me wrong, I too use (don't think I'd go as to say "prefer" but still) use good ol' tools like VI et etc. It's just that saying something like "LOL.. SSH? That's for wimps" (from someone new around, and not quite being sure if it's meant as a joke or not) is somewhat of a sacrilege around here...

I guess the way I (we?) see it is, good old tools/methods are fine, but if they're proven insecure, they get the boot quickly... And I (we?) do like our security to be as in depth as possible, so rlogin and telnet ain't satisfactory (to me (us?)) even in an internal lan...

Paranoid? Perhaps... up till now it's served me well though :) (never been hacked... that I know of!)

Anyways, no hard feelings ;)


Ammo