Printable View
i run a windows 2000 sp4 and full security updates box and i turn off the default shares of C$ and D$. then i check a while later and they are turned back on! this is a huge security risk. why does 2000 insist on reseting these? i've noticed this type of behavior wtih things such as msn messenger where it resets the avatar. the box is adware, spyware, trojan, virus free. i have also tried it on many computers.
These are called Administrative Shares... Here is some information on how to control/remove them...
http://support.microsoft.com/default...roduct=win2000
http://support.microsoft.com/default...roduct=win2000
Hope this helps.
:)
one note to make is that the $ sign at the end of them make them not visiable through file sharing etc..
Also note that the C$ and D$ are only accessable by members of the administrators group so it's not the huge security risk you think it is. If your administrative shares are accessable by someone else you have bigger problems (ie somebody has administrative rights they're not supposed to).
Yes, The C$ shares are especially useful on Windows Domains, Because they allow Domain administrators to see the whole drive from any machine, whist denieing users who are not part of the admins group
How, exactly, is having the default shares, a "huge" security risk? Excuse me if I'm being pedantic but:Quote:
1. They are only accessible to members of administrators group
2. Those members are capable of creating shares remotely anyway, including sharing any folder they want including C and D
3. Those members are basically capable of doing absolutely anything remotely, provided the server service is enabled.
It's a policy setting, it may be set in the domain. But don't change it unless you understand.Quote:
why does 2000 insist on reseting these?
Now you're being rediculous - MSN messenger resetting its avatar is clearly due to some bug in that program, and is totally unrelated to default shares being created.Quote:
i've noticed this type of behavior wtih things such as msn messenger where it resets the avatar.
Slarty
well i found a quick way to fix it. and it can be a huge security risk if you have a blank admin password. yes i know this is stupid but this is for my home network and my dad wants functionality > security. i have found a quick .reg file that seems to have fix this.
REGEDIT4
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters]
"AutoShareWks"=dword:00000000
just put that into a file with the .reg extension and export it into the registry.
i know about the $ signs meaning a hidden share. but any slightly experienced hacker also knows about these.
also i didnt find a way to control it in local security policy.
NOOOQuote:
Originally posted here by wassup
well i found a quick way to fix it. and it can be a huge security risk if you have a blank admin password.
you totally missed the point, idiot!
Having a blank admin password is the security risk.
NOT the default shares.
Having disabled default shares, admin users CAN STILL, REMOTELY, DO ANYTHING
Just because you can't access C$, doesn't mean you can't own the machine with the admin pw.
Slarty
Slarty pretty much nailed. I would add c$ is the least of your concerns, having dcom and netbios/smb services available over the internet is the huge security risk. Much easier target then trying to brute force even a reasonbly obscure password.
no i didnt miss the point. i realize that the shares in itself are not a security risk. but combined with the null admin pass it is a security risk. hell a null admin pass in itself is NOT a security risk if the users cant do anything with it. as i said i cant add a pass because my dad wants functionality over security.Quote:
Originally posted here by slarty
NOOO
you totally missed the point, idiot!
Having a blank admin password is the security risk.
NOT the default shares.
Having disabled default shares, admin users CAN STILL, REMOTELY, DO ANYTHING
Just because you can't access C$, doesn't mean you can't own the machine with the admin pw.
Slarty
True, but turning off the default shares does NOT prevent that risk.Quote:
Originally posted here by wassup
a null admin pass in itself is NOT a security risk if the users cant do anything with it.
In order to prevent having a null admin pass being a risk, you must not run any services which use NT authentication. This means turning off the "Server" service and ensuring that it remains off. Also, SQL server, IIS and any other network services which use NT authentication need to be disabled.
Slarty
i dont have any server services facing the outside world. if i did run any server type software on that box i would not be so stupid to leave a null admin password.
If the box isn't facing the outside world, and is behind your firewall/router, then why even worry about disabling the shares? If you're not going to protect even with a password, then you are wasting you time with everything else.Quote:
Originally posted here by wassup
i dont have any server services facing the outside world. if i did run any server type software on that box i would not be so stupid to leave a null admin password.
By the way, how does creating a password(s) decrease functionality? :confused:
You just have to type it in at startup...
Just to ensure that those drives are not being shared... simply disable the "server" service in services.msc from start, run. Or, get to it via control panel, admin tools...
Yes you do. To enable file sharing you must have the "server" service running, thus the " marks.Quote:
i dont have any server services facing the outside world
And as phish said why not put a simple password on it, even a short simple one(other than password) is a lot better than nothing. And you don't need to reboot your comp every day generally.
Without it your wasting your time.
WIth a blank admin password your hosed, hidden shares or no, give me your IP if you need a demonstration.
Nuff said.
Not setting the administrators password is a huge security risk anyone who has physical access to the pc can get administraters access. If i were you i would set a password on the administraters account asap. I,m not talking about users that are admins, win 2000 has a seperate admin account as does xp. If there is no password set then its just a case of doing ctl+alt+del at the log in then clicking ok and you have complete control of the pc.
If your dad cant be bothered to enter a password at log in then thats ok, give him a resricted account.
Maybe this is the slacker kinda way... but thats pretty much why i got into computers in the first place, so i didnt have to "work".
Couldn't this whole ordeal be avoided by setting your firewall to deny all Netbios packets. If you need to share something you can always set to allow a single IP. Thats what i would do, and just be done with it. Thats just my two cents..
ya,
i agree with the others, it's not the fact that they are being shared, it's the fact that Win 2k PRO comes with the Administrator account assigned a null password!!!
There are many papers about using the netbios to gain access to networks. Try http://www.packetstormsecurity.com
well to be honest if ur using windows and hoping to get a respectable level of security is optamistic at best!
The C$ and D$ shares is 1 of the biggest security flaws in windows..well its not really a flaw coz its purposfully built ****..i mean IN :rolleyes:
A friend gave me his RH-9 box to sort out a couple of problems, he failed to give me the root password.. well he didn't have to.. he some how managed to set it to null on install.. how the hell did he manage that? (fixed now- i expect i will need to pay a bit more attention on my next install)
BTW: other than the SQL exploit (slammer et al) with weak passwords.. wasn't there a exploit for the Admin Password in XP.. a hole in IE or was that a java prob,
Point
The weakness is not always the unbolted door, it could be the open window..
..
But if the door is unlocked why waste your time climbing in the window..
Weak/no Admin Pass is an unbolted door, X$ shares are the open window.
The more Idiot enabled the OS the less secure it becomes.. compare Lindows with RH/SUSE..etc or Any Current Linux with Win 2K/XP
Cheers
I think built in security is a little overated. You can't expect to ever have a well secured box right from the install thats available to the masses, if you did it would take the functionality and freedom from the user, right from the start. If the user doesn't care to set an admin password, they shouldn't be forced too. I might add if the user chooses not to set a password, the OS shouldn't be blamed for a lack of security.
RH9 requires a root password with a mininum length, but doesn't restrict the use of the word 'password'. Which effectively nulls the whole "security" measure.
In response to Toker's post, blocking a service is a far cry from turning it off. It just means you need to exploit the firewall before you exploit the service.
how about $ipcs .... and how do i turn it off ... coz i have the same prob except my pswd is a bit longer etc but hey good info here ;)
Okay, another nice rant-like post from me in this thread:
1. linux_wynter919 saidNo they are not. For reasons I mentioned before, they pose no additional security risk whatsoever. Windows may have many security flaws, but that is not one of them.Quote:
The C$ and D$ shares is 1 of the biggest security flaws in windows
2. Having a null admin password
This may be convenient, but I'd advise against it.
True, you may feel safe with "Server" disabled, with a null admin password, BUT "Server" is not the only service which uses Windows authentication. Others include IIS (Web/FTP), SQL server and Terminal Server - any of which may grant access to administrator with an empty password.
There is no guarantee that third party apps won't use Windows authentication too (example: 3rd party FTP servers, remote control programs).
In windows 2000 it's possible to enable auto-login - there are numerous tools which will do this. Having auto-login and a strong administrator password should be at least as convenient and much more secure than a null password.
3. Stimpy saidDisable the "Server" service. If ipc$ is not enabled, no other shares will be able to be connected to (AFAIK). If you don't want ipc$, you don't want any others, therefore, just disable "Server"Quote:
how about $ipcs .... and how do i turn it off ?
---
Note that in some documents I've read, M$ frequently cite disabling "Server" as a good preventative security measure, although most sysadmins find it terribly inconvenient, as many other things (NT remote admin and a lot of other stuff) rely on it.
Also, AFAIK, domain controllers must have "Server" enabled for their Domain control / Active Directory to work.
But totally stand-alone boxes (e.g. Web servers) don't need Server.
Slarty
the box is facing the external world. and besides rpc (with dcom off) there is nothing else. now i just wanted to ask this C$ question for the sake of asking it. i have turned netbios off on external interfaces. i just asked this because i was wondering why it does it. seeing as there is no remote login to my box through netbios or active directory i dont see this as a security risk.
slart: technically C$ as default share IS a security risk. its a risk that can be secured. Microsoft has a huge problem in the way they do things. they turn too much stuff off by default. if you want this on you should turn it on yourself later. its like leaving finger open. its not needed and can be a security risk (because the daemons have a list of problems with them). your logic is like saying that its okay to have a vulnerable ssh daemon running as long as you firewall it to certain ranges or something of similiar tongue.
IPC$ is the communication share for windows. as slarty stated it will be needed for other shares and a lot of stuff to work.
sorry slarty, u r 99 % right, what i ment to say was that the shares thing "WAS" 1 of the biggest security risks on windows, untill they realesed a few udates and stuff and reduced the problem.
And if u dont belive me pick up any security books or security web sites and they will hav a ton load on this thing.
I have 2 good books at home on security (very good books) and both have the largest section dedicated to this subject and is very detailed
I performed an install of SuSE 9 last night, and it auto-magically set up Samba. I was quite suprised to see C$, D$ and E$ from my XP Pro machine on the list of shared directories. Without any problem, I could access the root drive using my user login from SuSE. Thanks Microsoft!
Also be aware, some utilitied require the administrative share for remote software. SMS client deployments are one example.
As for the funtionality vs. security, you may want to consider having the workstation log on automatically with the password stored locall in the registry (this can be accomplished using TweakUI). While this does pose a security risk (because anyone with physical access can log in without a password), it should help slow remote exploitation of your workstations by a hacker or a virus.
Unless you have a blank admin password, I don't believe it. One possibility is you actually shared your c drive.Quote:
Originally posted here by pf1359
I performed an install of SuSE 9 last night, and it auto-magically set up Samba. I was quite suprised to see C$, D$ and E$ from my XP Pro machine on the list of shared directories. Without any problem, I could access the root drive using my user login from SuSE. Thanks Microsoft!
No, I have disabled the 'Administrator' account and password-protected the account with admin privileges. I have several other computers in my home workgroup, and have even used several other flavors of Linux, and none have ever displayed the root shares in Samba. The first time I accessed C$, it opened right up. The second time it asked for the admin password.
Obviously, I have edited the registry to close that particular loophole. Wouldn't it make more sense to DISABLE those shares by default, and allow them to be ENABLED by an admin who needs them for remote administration?
[SLIGHTLY ANTI-MICROSOFT RANT]
Someone suggested using a restricted user account earlier. I use XP on my laptop (because I need to use some windows tools like word, etc. and IBM won't give me an XP install disk which means I'm screwed if I mess something up). I tried setting up a restricted user account and then found out that I could do basically nothing with it.
The restricted user account did not seem to be customisable, and did not even allow you to install programs (not even in your own share). I now just use the admin account all the time because I can't be bothered logging off then back on every time I want to do something that involves slightly higher priviledges.
On my linux box I can install programs as a normal user assuming they don't need to be put in a "system" directory, and even if that isn't the case I can su. From my use of XP, it almost seems to me as though introducing a multi-user system was pointless because the functionality as an unpriviledged user is so low.
Obviously I'm not really a windows person anymore so I can't be sure if there is actually some way to customise the unpriviledged accounts, but if there isn't, what is the point of having them? Surely it's obvious that not everyone has exactly the same situation, so a case of priviledged and unpriviledged user without being able to customise it more than that is not very good.
[/SLIGHTLY ANTI-MICROSOFT RANT]
Oh, and I will be happy to accept that this could just be to do with the fact that I know relatively little about windows XP despite the fact that I now use it most days :P
ac
Gothic_type: MS has something similar to su. If you're logged on as a regular user you can start any program as a different user, including administrator (right click on setup.exe i.e. and choose Run As...) This will allow you to run the setup as an administrator.
The reason you cannot install anything as a regular user is actually quite simple. Just as you need to be root on un*x to install something in the "system" directories, you'll need to be an admin on windows because alot of software needs to install something in the "system" directories of windows. But usually it's because the software tries to register itself in the HKEY_LOCAL_MACHINE registry hive and only members of the administrators group are able to write to it.
Also NT/2K/XP/2K3 have a more fine grained accesscontrol system then linux. So your assumption that a regular user account cannot be customised is incorrect.
SirDice, that's cool. What I actually said was that I didn't know of any way to customise it (because I'm not really a windows person despite the fact that I use it). Thanks for explaining that to me...I had a feeling that it would be something to do with editing the registry.
I wonder why there isn't a way for individual users to have their own "registry", though, that would enable them to install programs, but only in their own space. I mean, surely not all of the programs that edit the registry when they install need to make changes on a global basis (i.e. need to change settings for every user).
Anyhow...thanks for the reply.
ac
There is a registry hive for individual users (HKEY_USERS and HKEY_CURRENT_USER). Most programs use that part of the registry to store settings perticular to that user (like windowsize, what toolbars and other settings). This way an administrator can configure global settings and the user settings are kept seperated from each other i.e. each user can have their own settings.Quote:
Originally posted here by gothic_type
I wonder why there isn't a way for individual users to have their own "registry", though, that would enable them to install programs, but only in their own space. I mean, surely not all of the programs that edit the registry when they install need to make changes on a global basis (i.e. need to change settings for every user).
It basicly all boils down to how this program was written (and set up) and what features of windows it uses. I have to admit that there's alot of crappy written software out there that just doesn't want to work as it should :rolleyes:
Its possible you had/have simple file sharing enabled, which allows unauthenticated access to shares. And what do you mean it didn't ask for the password the first time but did the second, with out changing anything??Quote:
Originally posted here by pf1359
No, I have disabled the 'Administrator' account and password-protected the account with admin privileges. I have several other computers in my home workgroup, and have even used several other flavors of Linux, and none have ever displayed the root shares in Samba. The first time I accessed C$, it opened right up. The second time it asked for the admin password.
Obviously, I have edited the registry to close that particular loophole. Wouldn't it make more sense to DISABLE those shares by default, and allow them to be ENABLED by an admin who needs them for remote administration?