Log in to a remote host with null session?

Hello everyone, I'm at work right now and hope i can get an answer before the end of the day!
Anyway, I'll give you a very short story, a machine was hitting a honeypot of mine. I scanned it with nessus (quite vulnerable) ftp server running...and many other ports...Nessus said that port 445 was open to null sessions. THe nessus plugin is 10394 if you want more info on that. What i want to know is how can i connect with a null session? I was using Net use g: \\host\"" and hten password "" but that doesn't work. Am I even on the right track?
Thank you,
Thekit

Here's some info that my help you out, look into using the Enum tool it lists:

http://www.brown.edu/Facilities/CIS/...tbiosnull.html

if the machine that was attacking your honey pot is very vulnerable it's probably owned and also home to many worms. not many try to break-in from their own computer.

if you also break in you can count yourself amoung the low life that has gone before you.

Thank you very much IronGeek, I'll look into it.. TO Tedob1: Did you even read my post? I work for a company, there machine is infected. I AM ALLOWED connect to there machine. You should read posts twice before you type.
Thekit

you should read your posts before you submit them...you said "a machine" was hitting your honey pot. no where do you claim ownership of anything except the honey pot....but my appologies!


Net use g: \\host\<sharename> and the password if required

you must include the name of the share you want to map to. you just cant map to a computer with net use. C$ and IPC$ are good to try

Quote:

---

a machine was hitting a honeypot of mine. I scanned it with nessus (quite vulnerable) ftp server running...and many other ports...Nessus said that port 445 was open to null sessions.

---

Quote:

---

I work for a company, there machine is infected. I AM ALLOWED connect to there machine.

---

I have to ask.... probably a dumb question though.....

Er.... What are you doing playing with a honeypot when you have owned machines on your system? It seems to me that your prioritization strategy tends towards the "fun" rather than the effective. Had you set up a proper IDS which would give more broad ranging and long term benefit to your employer you would have discovered this anyway.

Secondly, and much more importantly with regard to your professional ability/attitude is that fact that connecting to the box that has "issues" directly in the fashion you intend would be utterly the wrong thing to do. You need to begin a forensic examination of the box not try to play with it.

Now, of course, I'm giving you the benefit of the doubt here when you say that you are an employee of the company that owns the box and have permission to take any action on or against the box. Should I be wrong I would find myself utterly in agreement with Tedob's statement re: low life.

Please..... Be legit and do it right..... Otherwise you are playing at being an admin......

TIGERSHARK, have you nothing better to do?
Your trying to tell me my priorities are wrong????
I setup the honey pot 3 weeks ago, It has been incredibly effective. I've found many, many computers that have been infected with viruses and such.
Do you know what position i have at my work? no you don't. so i have no idea how you can assume to tell me that I could simply setup an IDS. You also have no idea how our networks are setup, how many machines there are.

You then go on to tell me how I should deal with the infected machine. The machine is going to be taken and formated likely, but that isn't up to me anyway. All i wanted to know is how to go about connecting with null sessions. I had every right to do it, and i wanted to learn how to do it. You have no idea what the security policy is at the place that i work, so you really shouldn't speak at all.

3rd you go on about giving me the benefit of the doubt that i work where i work? I could just say the same thing to you, Well you might be a hacker so maybe you should stop going on anti-online completely. It's absurd either way!

All i wanted was to learn something, too many people waste time assuming that everybody around them is a hacker or something.

I have to thank IronGeek again for an informative paper on null sessions

Quote:

---

Do you know what position i have at my work? no you don't. so i have no idea how you can assume to tell me that I could simply setup an IDS. You also have no idea how our networks are setup, how many machines there are.

---

So tell me..... You can set up a honeypot but you can't set up an IDS? Doesn't make much sense to me when you consider the fact that if you don't know how to properly deal with a honeypot you can become part of the problem whereas setting up an IDS _properly_ would never make you part of the problem..... Is that a Duh? I dunno.... I think you get the point!

Quote:

---

The machine is going to be taken and formated likely, but that isn't up to me anyway.

---

Then why are you messing with it..... You aren't the decision maker.... thus, it isn't yours to mess with, thus, quit messing with things you don't have control over, (and apparently understanding of).

Formatting the box is fixing the symptom.... It's dumb.... It's like getting 1 mpg out of your car and simply filling the gas tank every 18 miles.... you fix the symptom... not the problem!!!!!

Quote:

---

You have no idea what the security policy is at the place that i work, so you really shouldn't speak at all.

---

You started the thread.... You gave little information... and now you bitch at me..... Yep, you're cool...... Numbnutz.......

Quote:

---

3rd you go on about giving me the benefit of the doubt that i work where i work? I could just say the same thing to you, Well you might be a hacker so maybe you should stop going on anti-online completely. It's absurd either way!

---

I have a posting record here that extends for a couple of years.... In fact, if you looked carefully through all my posting record you could probably give me my SSN.... You have come in and asked a question in a way that leaves things "questionable"....

What you wanted to learn would be harmful..... I was trying to tell you that despite the questionable information you provided.... Your choice.... You wanted to do something that could be potentially, (no.... definitely), harmful to your employer... I was trying to help.....

If you want further assistance I will be happy to help..... Just don't give me **** for:-

1. trying
2. Being suspicious..... I do security for a living.... and it's based on distrust.... Learn it!!!!

thekit ! you are a looser!

thekid... you are gonna get banned...

have a little respect for the seniors on AO

i've gotten banned before (way before) for the same kind of disrespectful **** you are doing right now. pls don't mouth off to Tiger he is one of the smartest ppl on AO and he knows better. also don't give us "a story" . noone (rational) here is going to tell you step by step how to expliot a null session. (which by the way is ooooolllddddddddd)... so read and learn and don't try to get over on ppl who know better.

Amun Ra its not really a matter of having respect for seniors but the whole AO community. IRT you dont go cold into a group of people that dont know you, ask a stupid question in a redicules way and start arguing with anyone that doesn't say what you want to hear, you'd be luck to walk away without getting the crap kicked out of you. sane people go into a group, hang back for a bit and observe how people relate to one another and whats considered good conduct or bad. its no differant here or anywhere for that matter!

Actually, I can understand why this guy got pissed. He asked a question in a (somewhat) legitimate manner and explained his intentions once more in a reply to Tedob. Instead of getting the answer he's looking for, he gets a sermon. If someone asks a question purporting to be legitimate and we give him an answer, IMHO, it's not our concern what he does with the information. If you do want to give him advice, give it to him along with some information. He's more likely to heed your advice if he thinks that you know what you're talking about. Or if you don't like it, simply don't reply.
This isn't directed at any particular member, least of all TS, because I happen to have a lot of respect for that old fart ;).
OK, as for thekit, check out these two links to understand more about null sessions and how to enable/disable them. Out of respect for TS's wishes, I will not directly be telling you how to "hack" a computer using null sessions. However, the information is out there for you to find.

http://www.lokbox.net/help/html/Secu...ullSession.htm
http://support.microsoft.com/default...NoWebContent=1
http://www.winnetmag.com/Article/Art...272/15272.html

Cheers,
cgkanchi

cgkanchi ...your wrong!

his first post reads: someones hitting my honeypot and i want to break into them. he was only concerned with null sessions because nessus told him he could break in that way. i told him if someone is attacking him they more than likely dont own the machine hes seeing. i then let him know in no uncertain terms he'd be an ass-hole to break into that machine (still thinking him to be a responsible person who would never think of breaking into the machine of someone that meant him no harm). if you concider that anything less than good advice with the info that was given...well we all have opinions. personally i think any responsibe person perceiving what he was suggesting would advise against it.

he then comes back changing his story telling me i cant read what he didn't write and still trying to give the impression (poorly i might add) that this is still somehow his responsibility (which it turns out it isn't). TS chastised him for being so reckless and gave him good advise. harshly but well deserved for someone in a position of responsibility doing such foolish things.

your right in stating we are not responsible for what he does with information we give him and if he had siad: "ive got a few machines on my network that are about to be re-formatted and id like to use them to see for myself how they can be hacked..." at the beginning he would have gotten the answers he was looking for instead of looking like an SE or administrative retard.

Quote:

---

What i want to know is how can i connect with a null session

---

Quote:

---

I was using Net use g: \\host\"" and hten password "" but that doesn't work. Am I even on the right track?

---

Quote:

---

The machine is going to be taken and formated likely, but that isn't up to me anyway

---

Quote:

---

Do you know what position i have at my work?

---

You gotta be the janitor or something, right???!???

WOW He got 4 reds!!! What a lucky guy, eh? I think it's cool to see people with 4 reds... It's more interesting than 3!!!