OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Ian Lyte (ianlytehotmail.com)
Date: Tue Oct 30 2001 - 17:39:30 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    Running NAT.EXE on a machine my local network gives me the following results
    [obvious bits changed]

    [*]--- Reading usernames from user.txt
    [*]--- Reading passwords from bigpass.txt

    [*]--- Checking host: xxx.xxx.xxx.xxx
    [*]--- Obtaining list of remote NetBIOS names

    [*]--- Attempting to connect with name: *
    [*]--- Unable to connect

    [*]--- Attempting to connect with name: *SMBSERVER
    [*]--- CONNECTED with name: *SMBSERVER
    [*]--- Attempting to connect with protocol: MICROSOFT NETWORKS 1.03
    [*]--- Server time is Tue Oct 30 14:30:36 2001
    [*]--- Timezone is UTC+0.0
    [*]--- Remote server wants us to encrypt, telling it not to

    [*]--- Attempting to connect with name: *SMBSERVER
    [*]--- CONNECTED with name: *SMBSERVER
    [*]--- Attempting to establish session
    [*]--- Was not able to establish session with no password
    [*]--- Attempting to connect with Username: `ADMINISTRATOR' Password: `0'

    <---SNIP--->

    [*]--- Attempting to connect with Username: `ADMINISTRATOR' Password:
    `password'
    [*]--- CONNECTED: Username: `ADMINISTRATOR' Password: `password'

    [*]--- Obtained server information:

    Server=[xxxxxxx] User=[] Workgroup=[xxxxxxx] Domain=[]

    [*]--- Attempting to access share: \\*SMBSERVER\ <file://\\*SMBSERVER\>
    [*]--- Unable to access

    [*]--- Attempting to access share: \\*SMBSERVER\ADMIN$
    <file://\\*SMBSERVER\ADMIN$>
    [*]--- WARNING: Able to access share: \\*SMBSERVER\ADMIN$
    <file://\\*SMBSERVER\ADMIN$>
    [*]--- Checking write access in: \\*SMBSERVER\ADMIN$
    <file://\\*SMBSERVER\ADMIN$>
    [*]--- WARNING: Directory is writeable: \\*SMBSERVER\ADMIN$
    <file://\\*SMBSERVER\ADMIN$>
    [*]--- Attempting to exercise .. bug on: \\*SMBSERVER\ADMIN$
    <file://\\*SMBSERVER\ADMIN$>

    [*]--- Attempting to access share: \\*SMBSERVER\C$ <file://\\*SMBSERVER\C$>
    [*]--- WARNING: Able to access share: \\*SMBSERVER\C$
    <file://\\*SMBSERVER\C$>
    [*]--- Checking write access in: \\*SMBSERVER\C$ <file://\\*SMBSERVER\C$>
    [*]--- WARNING: Directory is writeable: \\*SMBSERVER\C$
    <file://\\*SMBSERVER\C$>
    [*]--- Attempting to exercise .. bug on: \\*SMBSERVER\C$
    <file://\\*SMBSERVER\C$>

    [*]--- Attempting to access share: \\*SMBSERVER\D$ <file://\\*SMBSERVER\D$>
    [*]--- WARNING: Able to access share: \\*SMBSERVER\D$
    <file://\\*SMBSERVER\D$>
    [*]--- Checking write access in: \\*SMBSERVER\D$ <file://\\*SMBSERVER\D$>
    [*]--- WARNING: Directory is writeable: \\*SMBSERVER\D$
    <file://\\*SMBSERVER\D$>
    [*]--- Attempting to exercise .. bug on: \\*SMBSERVER\D$
    <file://\\*SMBSERVER\D$>

    [*]--- Attempting to access share: \\*SMBSERVER\ROOT
    <file://\\*SMBSERVER\ROOT>
    [*]--- Unable to access

    [*]--- Attempting to access share: \\*SMBSERVER\WINNT$
    <file://\\*SMBSERVER\WINNT$>
    [*]--- Unable to access

    Now from here I thought it would just be a case of

    NET USE Z: xxx.xxx.xxx.xxx\c$ /user:administrator password

    to map the C$ to a local z:

    However every time I try that it gives me a

    System error 1326 has occurred.
    Logon Failure: unknown user name or bad password.

    Now I have gone to the machine and know that the user:pass combo is correct.

    So, what am I doing wrong? I've searched the archives to no avail and I
    notice on Google groups that a lot of people have asked the same question
    but not received an answer. So I am turning to you guys ;)

    Ian

    _________________________________________________________________
    Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
    Service. For more information on SecurityFocus' SIA service which
    automatically alerts you to the latest security vulnerabilities please see:
    https://alerts.securityfocus.com/