Printable View
I'm a network administrator at a company. We are currently having a problem with people downloading a valid list of usernames from our webserver. I ran a network security program called Retina, and it says they are going through Netbios. I'm wondering how they are doing it. I know you can use a program like Retina, but i wondering if there is a way they are doing it through just code on a webpage or some other way/program besides one such as Retina.
Any help would be greatly appreciated
If i remember retina right, it gives quite a detailed report of the problem, is that not been of any help?
I wouldn`t of thought the problem would be connected to netBios, cause surely if its a web server it will be locked down so the only way to connect to it would be through the http service?
This is whats called a NetBIOS null session or anonymous NetBios session. This allows people to enumerate all sorts of information from NetBIOS. There are many tools for enumerating NetBIOS accounts,shares,users,machines,policies and other information. The one I use is called enum.exe and will even perfrom a dictionary attack on the accounts it enumerates. This can be disbled through the "Local Security Policy" under the "Security" settings section by setting the "Additional Restrictions for Anonymous Connections" (There are a few options I think) or as a domain security policy via the MMC from the PDC. The most relevant key is:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\
RestrictAnonymous:REG_DWORD:"1"
This will disable anonymous NetBios sessions. There are other values for for this key in XP/2000 that allow more control but they may break certain fuctionality with NT or 98 machines.
-Maestr0
EDIT:I hope 'they' arent doing this from the internet. Allowing incoming NetBios connections from the internet is a big security risk, unless absolutely neccesary I would block all NetBios ports at the network perimeter.
Thanks so much for the information, but unfortunatly this is exactly what retina told me. I'm a little more curious on how exactly they are access it....
Greeeeaat tool. It is a favorite of mine. :)Quote:
The one I use is called enum.exe
Actually, there are several tools (Nessus being one of them) that can get around this if the value is set to 1. In the name of best practice, set the value to 2.Quote:
RestrictAnonymous:REG_DWORD:"1"
Also, here is a baseline reg file that I use on all servers. I, of course, lock it down as needed but nothing hits my network with anything less than the following settings. To use this, simply copy the contents to a txt file, rename the file with the .reg suffix and then right click it and hit MERGE. Reboot your server and run a security tool against the box. I assure you that the score will go up.
Windows Registry Editor Version 5.00
#This file reflects baseline security settings.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters]
"NullSessionPipes"=hex(7):00,00
"NullSessionShares"=hex(7):00,00
"RestrictNullSessAccess"=dword:00000001
"AutoShareServer"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"LMCompatibilityLevel"=dword:00000004
"RestrictAnonymous"=dword:00000002
"NoLMHash"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsNT\Printers]
"DisableWebPrinting"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]
"NtfsDisable8dot3NameCreation"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
"ProtectionMode"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Internet]
"Ports"=hex(7):31,00,31,00,30,00,30,00,2d,00,31,00,32,00,30,00,30,00,00,00,00,\
00
"PortsInternetAvailable"="Y"
"UseInternetPorts"="Y"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"SynAttackProtect"=dword:00000002
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"CachedLogonsCount"="0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000001
"LegalNoticeCaption"="LEGAL WARNING"
"LegalNoticeText"="WARNING: Unauthorized use of this computer is prohibited."
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems]
"Optional"=hex(7):00,00
"Os2"=hex(2):00,00
"Posix"=hex(2):00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment]
"Os2LibPath"=hex(2):00,00
#This disables WebDAV
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters]
"DisableWebDAV"=dword:00000001
Perhaps im completely off track but surely to exploit a NetBIOS null session you`ll need to be able to acess the NetBIOS ports? Now surely this is a major securuty risk and on a web server i`d be more worried about the fact these are accesible in the first place.
Call me paranoid... but are you asking us HOW TO HACK A WEB SERVER ? You have been given good information on how to PROTECT it.. BUTQuote:
I'm a network administrator at a company. We are currently having a problem with people downloading a valid list of usernames from our webserver. I ran a network security program called Retina, and it says they are going through Netbios. I'm wondering how they are doing it. I know you can use a program like Retina, but i wondering if there is a way they are doing it through just code on a webpage or some other way/program besides one such as Retina.
you want details on how exactly one would arry out the attack... hmmmmm ..Quote:
I'm a little more curious on how exactly they are access it....
I would prefer that you explain yourself better before we continue..
Cheers
Yeah, actually, the simple approach to all of this is to disable NetBIOS outright. This can be done from the advanced tab under TCP/IP properties.
Hmmmm, now undertak3r has made me paranoid. :)
hey, just because you are paranoid doesnt mean people arent following you :D :D :D ...BTW, where can you get enum? i googled for it and got a hit, but it was a batch renamer and a file lister.
slick
I'm interested in how they are doing it because finding out how to block it is only half the knowledge. How are you to further your knowledge if you can't find out how they are gonna hit you, and do it before they do, to find out how your server really holds up
Dunno Slick.. try my Google
http://www.google.com.au/search?hl=e...a=lr%3Dlang_en
Cheers
You already found out how they hit you, through a NetBIOS null session. Theres really no reason to even have to know how to perform an attack like this to 'further your knowledge,' because even if you do know how they do the attack you still are just going to disable NetBIOS since its the easiest and best solution to the problem.
Another reason therefore would be I have the ability to block programs being run on my server by name. provided the user can just rename it msword.exe, it at least logs it in my log files.
netbios threw webpages...admin my ass, NB doesn't run on port 80.
did you actually make this up or did you read it somewhere. maybe retina scanner is showing netbios being vulnerable but it dosnt tell you how a server has been hacked in the past so what do you think your trying to tell us... but if i wanted a list of users from a database id use sql injection...what kind of half ass would run a webserver without a firewall which would block NB connection from the internet even in its default configuration.
http://www.cgisecurity.com/lib/Manip..._Injection.pdf
http://www.cgisecurity.com/lib/SQLIn...WhitePaper.pdf
http://www.governmentsecurity.org/fo...showtopic=1525
enum:
http://razor.bindview.com/tools/index.shtml