精华公布栏

发信人: PowerStation.bbs@bbs.sjtu.edu.cn (Warez Killer), 信区: cnhacker
标  题: WindowsNT的25个漏洞 (8)
发信站: 饮水思源站 (Sun Apr  6 03:00:47 1997)
转信站: Lilac!ustcnews!ustcnews!sjtunews!sjtubbs
出  处: bbs.sjtu.edu.cn

(20)NetBEUI/NBT
3.5x, 4.0

By default NT has ports 137, 138 , and 139 open. In fact all MS windows
boxes do. These ports are used for such things as file and print sharing
among windows machines. A long time ago Microsoft decided that they
would use a nonroutable protical by the name of NetBEUI. More reciently
they have decided that for internet traffic they should encapsulate thier
NetBEUI inside TCP packets. Well this really isnt the best idea. NetBEUI
is a rather unsecure protical, and the way in which NT handles it doesn't
help it's situation. Here are a few things you should be aware of:

旳nyone can get a list of open shares even with no password 昗indows
NT apparently has a bug whereby users can erase the entire NT server
disk in the default NT configuration 昑here is no encryption of data , so
all the usual spoofing attacks work 昑here are ways to trip the clients into
doing plain text password authentications (Yum yum ;)) 昑here is no failed
authentication logging on windows, so a dictionary attack can run all week
and there won't be so much as a blip in the logs

All of these are exploitable over TCP/IP .

(21)Samba DIR..\
3.5x

Windows NT 3.5x has a little problem (ok well lots of problems) with the
Samba package commonly used by UNIX users to connect to windows
shares. This particular one will give the aformentioned windows servers
the oh so beautiful blue screen of death. This is only exploitable if one
can connect to a share on the box. The exploit is as follows:

After connecting to a share via the Samba package type

"DIR ..\"

Thats it.... Blue screen of death....<tear>

It has been reported that this litle cutie causes a buffer overflow within SRV.SYS .

(22)RPC
3.5x, 4.0

Now this is a little Remote Procedure Call Microsoft does'nt want you to
know about. It's a rather evil one that could be used by any little child who
feels like being an ass(This is why I didn't release it). I've had it for awhile
but seeing as a few others have now announced its existence, I don't feel
so guilty in putting it up. RPC's are listened for on port 135 by Windows
NT. This is the port that we will be attacking. The end result will be colse
to 100% utilization of the target NT box's CPU . Thus crippiling it.

The exploit is as follows
� Telnet to an NT box on port 135
� Type approximatly 10 or more characters followed by a <CR>
� Quit Telnet

--
※ 来源:·饮水思源站 bbs.sjtu.edu.cn·[FROM: gos.oz.cc.utah.]