Net Send

Hullo again,
At school today my whole computer programming class was in trouble becuz we were sending msgs through net send. We were told not to do it and someone thought it would be funny to send the following msg. Net Send * Eat **** and Die ****ers
Obviuosly this made the teacher mad. His computer was off and he didnt find out about it until the next day. Now I was talking to our student helper and he said that every net send msg made a log. I kinda knew that this would happen, but I was wondering where and how you can find these logs.
Just to let you guys know that I am not a bad kid or nothing, I was not the one who sent the msg to everyone, and I am not going to try to hack the school network to get rid of the logs. I would just like to know to feed my need for info. Thank you.

-Ep

You could try doing a file search for " .log ". You would prob have a hell of a lot of results but if you take the time and look through them you could find the right one??

Here is a nice article for you (http://www.winnetmag.com/Articles/In...leID=3509&pg=1)

It is about most if not all NET commands.

there is also a way to send messages to all with the Username as "/Domain".

Well, if they were smart they would use a sniffer program like tcpdump or some such to "log" packets as they pass through the network (with source IP). That would avoid having to have this stored locally and with timestamps, it wouldn't be that hard to figure out who the "evil doer" was.

Open up the Event Viewer on any Windows NT/2K/XP/2K3 machine.
Select the System log.
The Event ID number for Net Send messages is #26, from the "Application Popup" source.
And you will see 1 popup message. It looks similar to this:

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 9/26/2003
Time: 12:59:58 PM
User: N/A
Computer: YOURMACHINE
Description:
Application popup: Messenger Service : Message from MACHINE1 to YOURMACHINE on 9/26/2003 12:59:58 PM

"Your message here"

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



So, just have the teacher check the Event Viewer logs for the message. The sending machine of the message will be listed.

hope this helps

/edit
Ya, what he said----------------------- :withstupi

I might be wrong (it's happen once before), but I believe they get stored in the event logs.




Cheers:

There is so much more you can do with the net commands. You can share folders on you computer. And if one of your buddys also does that then you can use
"net use k: \\UserIP\UserFolder"
That command will map your friends folder as drive K:\ on your computer. Makes it very easy to transfer files.


I Attached A Batch File That I Created. It Contains Most Of The NET Commands in a step by step process.

Now the only thing about it in the event log is this:

We used terminal services in a test lab for some training. Now I would log into another computer using terminal services and send a net send message from another computer. So the event log will not always tell you who sent the message.

Here's how we do it. Net Send leaves an entry in the local system's Event Log. We also keep a database of logins and logouts that can be searched by machine, user or date. So, we check the event log of one of the machines that got a net send, get the source IP, query the database for who was logged in at the originating machine at the time.

Then we take the offending student out to the back, strap him or her to the pillory and whip them.

Just kidding.

We do process an AUP violation on the student though. They get three, with escalating consequences for each one.

jarrod, but if the sysadmin had been doing their job they would have set the terminal server to log all login/logout event and from there he would have been able to narrow down to a few people. there are probably a few other ways to narrow this down even further but I cant thik of any off the top of my head.

Well the thing is, we have a new teacher. He is kinda learning with us. The lab aid, is helping the teacher learn the stuff as we go. So that is why some of the security is very low. That and this is a programming class. Most of the students in here are pretty smart the way it is. Last year, they put full security on the programming network ( the programming class has its own network just for the security reason). They had so many students hacking into the system is was crazy. I think it was 5 students were expelled becuz someone has instulled Doom on the hard drive, and they were playin it in class. So this year they left the computer all on default. We have full access to the computer except for other students profile (but we all know that most of us can get into them if we wanted to). We have access to the run button, windows explorer, the c drive, the actual network. It is nutz, and this is the result. Pure Mayhem. So I dont know if you can blame the sysadmin for this becuz it was the priciples idea to let us roam free. But either way you look at it, it was a disaster. Anyway, that is enuff of my story. See ya.

-Ep

Ok MsMittens them damn evil doers are all over the place LOL. OK while you all debate stuff I'm just gonna throw in one small little item cammed the PDC (Primary Domain Controler) pesky thing it is all sorts of logs can reside there and ya may not even realize it but it's the damn thing that defines your network name like myschoolnetwork. Funny thing is this may not even reside in the lab or building your in and if you have and you will not have much more then an account along with many others, and each account activity can be logged as well as major and minor network functions like messaging. Chance of the person sending can be found 100% from the PDC if that is the object of the log search. Event logs that are local are a small part of the PDC so there is the local Admin at the school level and then the PDC Admin those be the pucker your butt cause if ya piss them off they will find you on their network now days :) tired old fart kinda people fed up with the patch schedule from M$...but hey without them I'd be out of a job so I love M$ screw ups! makes me $$$ :)

How exactly do u do net send??


Nightfalls_Girl

Net send is a basic msg service through a local network. As far as I know there are many ways to do it, but some of the most common are to go into the command prompt in windows and type "net send 'IP' msg here" You can also do the same thing in the run line, and you can also compile the same thing in a C++ compiler. Where it says IP, you would of course put an IP that is on your LAN, but you can also use the user's name, computers name, and I think you can use the MAC address also. I am no sure on the last one. If I am wrong on any of this please correct me.

-Ep

ok so are you able to do it via the internet??
or a vpn (vertual privat network)


Nightfalls_Girl

I am not sure about the vpn, mainly becuz I have not heard of it, :). No, you can not use the net send command over the internet. The net send command is a network command. I think you can only you it on a network...:). I have tired to use net send to a friend over the internet and it did not work. Now, there might be a command for internet sending, I dont know, but net send doesnt work.

-Ep

hmm ok, thats somthing for me to think about for a while then,
a vpn is a net work tho it is based over the internet.


EG it enables me to access work files, folders, data on servers ect at home, using a proggy over the internet enabeling me to link on to the network..


Nightfalls_Girl

Cool,
I will have to ask some of my friends at school about that vpn. Some of my class mates are really smart on this kinda stuff. I on the other hand, am not :). And another thing, I almost feel like I am chatting and not posting on a forum. Weird huh, lol.
/note If you didnt get my lil joke, check the times the last couple post were made.

-Ep

yah.. i got the joke when you sayed it..
i unlink some am not dumb or slow...

Oh well of for a driving lession i go...


Nightfalls_Girl

Not on the Net Send topic now but,
I just noticed my sig is not showing up on my last few post? Any reason? Does it take longer for the sig to show or what? My sig shows on the first couple but not on the last ones, weird...

-Ep

/Edit
I just checked my profile and the sig is still there, and it is still showing up for all of my other posts, just not my last few.

uha i wouldnt worry about it too much its probably just a bug. mine is doing th same thing. one min its ther te next pof its gone..


Nightfalls_Girl

sorry im late for the chat.

Net Send works just fine accross a vpn. As does every thing else that the tunel/firewall shuts out. the tunnel puts the remote computer right on the local network.

good luck with your driving lesson

thanks im back now.. i8m going good. got 10 hrs up out of 50...


Nightfalls_Girl

Quote:

---

Originally posted here by Palemoon
Ok MsMittens them damn evil doers are all over the place LOL.

---

Hehehe.. Yup... and all of them are in my class. And if they are really "evil" they get As or A+s. :D

I belive NetSend with Windows ME and below does exist but not as a dos command. It is the program known as WinPopUp. To disable this, at my school everytime a user logs onto the network a batch file is ran that executes drive mapping commands so that the users have access to some of the folders on the network. There is also a command that deleted winpopup. I belive that it is something like "del c:\windown\winpopup.exe" or something like that.

Quote:

---

Originally posted here by r8devil
jarrod, but if the sysadmin had been doing their job they would have set the terminal server to log all login/logout event and from there he would have been able to narrow down to a few people. there are probably a few other ways to narrow this down even further but I cant thik of any off the top of my head.

---

Well we all had admin access to this network. So we would just log into another machine, Turn on terminal services server and go back to our other machine and then log into that first computer through Terminal Services Client.