Windows general security

• Protocols providing information: CIFS/SMB and NetBIOS, through TCP port 139, and another SMB port, 445.

• Banner enumeration is not the main issue. (UDP 137),

• Null session command: net use \\19x.16x.11x.xx\IPC$ “” /u:””

  • countermeasures:
    • filter out NetBIOS related TCP, UDP ports 135-139 (firewall).
    • disable NetBIOS over TCP/IP see ShieldsUp! page on binding.
    • restrict anonymous using the Local Security Policy applet. More here. GetAcct bypasses these actions.

• Good source of system and hacking tools: Resource kits XP and 7. Some tools were re-written by hackers.

Previous slide

Next slide

Back to first slide

View graphic version