Computer Vulnerability help

[Voltage Spike]

What you write makes it appear as though you have not researched the problem or tools you can use very well.

Since I'm afraid this comment might discourage the original poster, I'd like to say that I think Ozone is actually doing quite well for an individual just getting into computer security. TheCotMan took Ozone to task for his use phrasing concerning ports, but I think it is rather clear that Ozone understands that a service doesn't necessarily have to run a specific port and went so far as to identify one of the applications on an open port.

Ozone has demonstrated a willingness to learn, wants to do things himself rather than use existing tools when he thinks it will aid his understanding, and is apparently setting up test systems outside of class so that he can examine an attacked computer in a controlled environment. He isn't asking for you to do his work for him, but he is looking for a nudge in the right direction at a point in his learning where he is still stumbling around.

Cut him some slack, TheCotMan. After all, you must remember what the level of teaching was like when you were in college.

PS: It sounds like Ozone is in an interesting class. I wish something like it were available when I was an high school/undergraduate student.

[TheCotMan]

The Book that we are using for the class is “Guide to network Defense and countermeasures”. This i find is a not bad book...

[/QUOTE]

What you write makes it appear as though you have not researched the problem or tools you can use very well.

You write about finding what service a port is using, but such estimates are actuallty provided to you with one of your tools and in your reply.

Another point:
Many first generation "script kiddies" actually only know how to use one exploit, and then they search for machine that are vulnerable-- their work is so simple, they can be replaced with worms that do the same thing. They don't actually target a specific machine, but instead look for door with cheap locks. What is even funnier, is many of the first generation "script kiddies" don't even know what to do with a box they "root" or "admin" except maybe install a pre-packaged rootkit/irc-relay/file-server-service(ftp, irc-dcc, etc.)

Second generation "script kiddies" may know several exploits, and a little about getting around a system, while 3rd generation and beyond may actually be able to understand some of the code involved, modify it in some way.

The only other new tool I see you have mentioned is google, but you do not appear to be using it very well; you have not found an exploit yet even after 15 hours between posts.

This does not make sense:

In the mind set of a “script kiddie” i would want to find out what each port means:

This is one example to point out where dyn4mic's statement appears to be true.
A port means nothing; it runs a service or it does not. If it is running a service, is is either the default service for that port or it is not. It probably also has a version, and an application name associated with it. This is what first generation script kiddies look for.

The terms you use, and how you use them does not suggest you really understand where you are going, or that you have a foundation necessary for this project. How much of your book have you actually read?

Your lack of preparation shows me that you don't really know where you are going. I suggest you speak with your professor during office hours and tell him/her what you have, and see if you are on the right track.

Something else that causes me to not want to help you, is that you showed no progress in working on this problem between your first post and this last one. That is 15 hours!

[dYn4mic]

Are you sure you took the prerequisite? It seems like you don't know what your talking about or your all mixed up.


PS.. its Ethereal, not eatheral (ether like ethernet)

[Ozone]

So far, everything points to "act like a script kiddie." So? What would be your next step? Imagine yourself as a script kiddie. What would you do next?
(There are many directions you can take at this point.)

Thank you for the help and the not too helpful suggestions. Let me start at the top.

Arp poisoning of the network to intercept from another destination seems kind of pointless. This is a box has no one logging into it, and no type of pseudo-clients authenticating against any of its services. I monitored it traffic with Eatheral.

I am going to make my own buffer overflow, or die trying. I will have some assistance in making it.

The Book that we are using for the class is “Guide to network Defense and countermeasures”. This i find is a not bad book, but these project are something that the teacher thought would be more fun than what the book had. So they have been making there own assignment. Which i find is awesome.

In the mind set of a “script kiddie” i would want to find out what each port means:

dpsvr2003.mtolympus.local [134.39.10.240] 1088 (?) open
dpsvr2003.mtolympus.local [134.39.10.240] 1038 (?) open
dpsvr2003.mtolympus.local [134.39.10.240] 1028 (?) open
dpsvr2003.mtolympus.local [134.39.10.240] 1025 (?) open
dpsvr2003.mtolympus.local [ 134.39.10.240] 636 (ldaps) open
dpsvr2003.mtolympus.local [134.39.10.240] 593 (?) open
dpsvr2003.mtolympus.local [134.39.10.240] 464 (kpasswd) open
dpsvr2003.mtolympus.local [134.39.10.240] 445 (microsoft-ds) open
dpsvr2003.mtolympus.local [134.39.10.240] 389 (ldap) open
dpsvr2003.mtolympus.local [134.39.10.240] 135 (?) open
dpsvr2003.mtolympus.local [134.39.10.240] 88 (kerberos) open
dpsvr2003.mtolympus.local [134.39.10.240] 53 (domain) open

Looking at this list that i got from using “nc -v -w 5 -z 134.39.10.240 1-1204” i find that its apart of the windows server family. Then I want to Google ports from 646 down to find exploits. I can also us putty to see what they're running.

Run putty and telnet port 593 and I came up with “ncacn_http/1.0”. Then Google this and check it out.

The reason why i went for the 646 and down was because of the high ports will probably just be open, but i will check anyway. I also want to not make to much noise on this computer. Thinking that it might be keeping a log. So be discrete.

After doing the research on these ports, and the programs that run on them. I want to then find the programs that would best fit my intentions. To gain access to information that the server holds.

I'm going to try out nessus tomorrow on another machine to make sure i understand how it works. So that i don't screw my self over, and so that i don't make a lot of noise in the logs. Then if that doesn't work. Then I will just move on to another program that would fit this matter.

[TheCotMan]

On the chance that you may be someone that people I know may encounter in the real world, I want to avoid giving away answers. I really dislike encountering people in the Real World who aren't able to find solutions on their own.
Many colleges have rules on how much assistance can be granted without it being considered cheating; so I'll try not to be too helpful.

we have been going over arp poisoning

OK. And how would you be able to use this with any of the services? Are pseudo-clients actually authenticating against services on this server during any of your attempts?

buffer overflowing

Are you expected to write your own, or will you be playing the role of a "script-kiddie"?

netcat, nmap

These are good tools. Some "scripts" are written with the assumption these are installed, but if you do not understand these scripts, you may end up screwing yourself as a result of them actually being trojans as many are.

It really sounds like you are expected to find pre-written exploits and use them. I do not see any tools listed for more advanced things like "writing your own exploits."

and whatever else is in that book.

I don't know what is in that book. Without specifics, I can't do much; I am not going to just give you any answers. You are in this class to demonstrate your ability to find solutions. Research and collaboration are part of this, but collaboration is possible with your peers. Work in the real world is much like your project-- but all the time. New issues are created, and you will need to always be learning about what is new.
(And you can't always keep hiring consultants for each issue.)

This is kind of homework as in looking for exploits, but all of this is conducted in a controlled environment.
The peruse of this project is to show the processes of pen testing computers, for personal experience, and to give a presentation of your findings. This is to the other class mates and the teachers for our grade.

So far, everything points to "act like a script kiddie." So? What would be your next step? Imagine yourself as a script kiddie. What would you do next?
(There are many directions you can take at this point.)

[Ozone]

We are assigned one computer for the use of breaking in on a controlled network. Then 3 computers with different levels of exploits one is getting harder and harder. I am working on the hardest one. For tools we are recommenced tools to use, but what ever works. The system has Linux and windows installed. Right now all i have done is use netcat to find the ports, and researching the one's that would help me the most to reach my goal.

As for th lecture we have been going over arp poisoning, buffer overflowing, netcat, nmap, and whatever else is in that book. This is kind of homework as in looking for exploits, but all of this is conducted in a controlled environment.
The peruse of this project is to show the processes of pen testing computers, for personal experience, and to give a presentation of your findings. This is to the other class mates and the teachers for our grade.

[TheCotMan]

Here is the website for my course http://jacobsonk.pageout.net/page.dy...urse_id=101618

I do not see a schedule, but I do find a lot of broken links.
Course Content shows a calendar, but clicking on days provide an error of "Bad Request."

The only "developed" links on that site appear to be the "Home" and Web links section, and even these leave something to be desired.

okay We are working out of windows and linux. We have been working with variouse tools, from this book "Guide to Network Degense and countermeasures". This wasn't the book that he wanted, but oh well. So asked us to form groups and chose what you want to do. So I joined the pen testing group, and we have been going at it. All i am looking for is some good suggestions.

First, it looks like a lower divison, undergraduate course, so the professor is probably not expecting you to build your own exploits.
From the Web links section, you have a single link for Pen Testing with only 4 things listed on it:
Four stages of Pen Testing
1. planning
2. discovery
3. attack
4. reporting

So, again, what tools have you been provided for this task? What was the content of the lectures before this task was assigned to you? Is this a homework assignment? What is the stated purpose of this assignment/project?

[Ozone]

Yea, my advice.. Study harder.

Anyway, do you have a website for your course or are we just supposed to trust you?

Here is the website for my course http://jacobsonk.pageout.net/page.dy...urse_id=101618

okay We are working out of windows and linux. We have been working with variouse tools, from this book "Guide to Network Degense and countermeasures". This wasn't the book that he wanted, but oh well. So asked us to form groups and chose what you want to do. So I joined the pen testing group, and we have been going at it. All i am looking for is some good suggestions.

[TheCotMan]

I am a college student that is taking a network security course. In my class we are pen testing computers in a controlled environment.

Learning is good. Generally in most college classes, you are given tools to start solving a problem, then an assignment to demonstrate your knowledge of those tools.

have no idea what operating system what I am trying to penetrate, but using netcat to Identify the open ports I have come up that it’s a windows 2000, o2003 server.

google search, keywords "OS Fingerprinting"

Here are my results of the scan of netcat:
[portscan chopped form IP address in what appears to be ctc.edu space]
Then I used putty in telnet and entered in ip address and port 593. Then came up with ncacn_http/1.0 and then did a Google search and came up with this vulnerability http://www.eeye.com/html/Research/Ad...D20030910.html

So my questions are: what is the best way to get into this computer using this vulnerability? What are some other ways to get in this computer, and any words of advice?

You should be able to tell us at this point. What tools have you been given in this class? What are the topics that have been covered so far? If this is a lab, what was the lab lecture about?

I don't know many professors who say, "Welcome to class. Break into this server," unless there is a point to the process, such as to demonstrate the students should think about where to start, estimate the skillset of the students, demonstrate use of tools covered in class/lecture, etc.

If your professor has no reason to offer you this task, then you may want to consider another professor or school.

I am a college student that is taking a network security course. In my class we are pen testing computers in a controlled environment. I have no idea what operating system what I am trying to penetrate, but using netcat to Identify the open ports I have come up that it’s a windows 2000, o2003 server. Here are my results of the scan of netcat:

<snip>

So my questions are: what is the best way to get into this computer using this vulnerability? What are some other ways to get in this computer, and any words of advice?

Yea, my advice.. Study harder.

Anyway, do you have a website for your course or are we just supposed to trust you?

[Ozone]

I am a college student that is taking a network security course. In my class we are pen testing computers in a controlled environment. I have no idea what operating system what I am trying to penetrate, but using netcat to Identify the open ports I have come up that it’s a windows 2000, o2003 server. Here are my results of the scan of netcat:

root@l19msftxps14 hping2-rc3]# nc -v -w 5 -z 134.39.10.240 1-1204
dpsvr2003.mtolympus.local [134.39.10.240] 1088 (?) open
dpsvr2003.mtolympus.local [134.39.10.240] 1038 (?) open
dpsvr2003.mtolympus.local [134.39.10.240] 1028 (?) open
dpsvr2003.mtolympus.local [134.39.10.240] 1025 (?) open
dpsvr2003.mtolympus.local [ 134.39.10.240] 636 (ldaps) open
dpsvr2003.mtolympus.local [134.39.10.240] 593 (?) open
dpsvr2003.mtolympus.local [134.39.10.240] 464 (kpasswd) open
dpsvr2003.mtolympus.local [134.39.10.240] 445 (microsoft-ds) open
dpsvr2003.mtolympus.local [134.39.10.240] 389 (ldap) open
dpsvr2003.mtolympus.local [134.39.10.240] 135 (?) open
dpsvr2003.mtolympus.local [134.39.10.240] 88 (kerberos) open
dpsvr2003.mtolympus.local [134.39.10.240] 53 (domain) open

Then I used putty in telnet and entered in ip address and port 593. Then came up with ncacn_http/1.0 and then did a Google search and came up with this vulnerability http://www.eeye.com/html/Research/A...AD20030910.html

So my questions are: what is the best way to get into this computer using this vulnerability? What are some other ways to get in this computer, and any words of advice?