25 March 2008 | 19,399 views

Hacking Windows NT Through IIS & FTP

Check For Vulnerabilities with Acunetix

This is another selection from the Old Skool Philes, I like these as they tend to generate some good discussion and they are a good introduction to newcomers to hacking on the mindset and workflow of getting access to a box. The exact methods may not work, but we aren’t here to train script kiddies, we just want to make you think.

Johnny Hacker has a Windows NT Server at home. Why? Because he knows if he’s going to hack NT he’s best using the same type of computer…it gives him all the necessary tools. He has installed RAS and has a dial-up connection to the Internet. One morning, around 2:00am he dials into the Internet…his IP address is dynamically assigned to him. He opens up a Command Prompt window and gets down to work. He knows www.company.com’s web server is running IIS. How? Because he once did a search on “batch fil es as CGI” using Excites search engine. That phrase is in Chapter 8 of Internet Information Server’s on-line help….and unfortunately it’s been indexed by Excite’s spider…now Johnny has a list of around 600 web servers running IIS.

He ftps to www.company.com. He isn’t even sure yet if the server is running the ftp service. He knows if he gets a connection refused message it wont be…he’s in luck though…the following appears on the screen:

This connection message tells him something extremely important : The NetBIOS name of the server : SATURN. From this he can deduce the name of the anonymous internet account that is used by NT to allow people to anonymously u se the WWW, FTP and Gopher services on the machine. If the default account hasn’t been changed, and he knows that it is very rare if it has been changed, the anonymous internet account will be called IUSR_SATURN. This information will be needed later if he’s to gain Administrator access to the machine. He enters “anonymous” as the user and the following appears:

Johnny often tries the “guest” account before using “anonymous” as the user. A fresh install of NT has the “guest” account disabled but some admins enable this account….and the funny thing is they usually put a weak password on it such as ‘guest’ or no password at all. If he manages to gain access to the ftp service with this account he has a valid NT user account….everything that the “guest” account has access to…so does Johnny, and sometimes that can be almost everything. He knows he can access their site now…but there is still a long way to go yet….even at this point he still might not get access. At this point he doesn’t even supply a password…he just presses enter and gets a message stating that the Anonymous user is logged in.

First off he types “cd /c” because some admins will make the the root of the drive a virtual ftp directory and leave the default alias name : “/c”. Next he sees whether he can actually “put” any files onto the site ie. is the write permission enabled for this f tp site. He’s in luck. Next he types “dir” to see what he has access to. He chuckles to himself when he sees a directory called “CGI-BIN”. Obviously the Webmaster of the NT machine has put this here with the rest of the WWW site so he can remotely make changes to it. Johnny knows that the CGI-BIN has the “Execute” permission so if he can manage to put any program in here he can run it from his web browser. He hopes that the Webmaster hasn’t, using NTFS file-level security, cut off write access to the anonymous internet account to this directory…even though he knows there are sometimes ways round this. He changes to the CGI-BIN directory and then changes the type to I by using the command “binary”. Then he types “put cmd.exe”. He’s in luck..he gets the following response :

Next he puts getadmin.exe and gasys.dll into the same directory. With these three files in place he doesn’t even gracefully “close” the ftp session; he just closes the Command Prompt window. With a smile on his face he leans back and lights a smoke, savouring the moment…he knows he has them…. After crunching the cigarette out in an overflowing ashtray he connects to AOL. He does this because if logging is enabled on the NT machine the IP address of AOL’s proxy server will be left and not his own…not that it really matters because soon he’ll edit the logfile and wipe all traces of his presence. Opening up the web browser he enters the following URL:

http://www.company.com/cgi-bin/getadmin.exe?IUSR_SATURN

After about a fifteen second wait the following appears on his web browser:

The headers it did return are:

He has just made the anonymous internet account a local administrator and consequently using this account he can do pretty much what he wants to. Firstly though, he has to create an account for himself that he can use to connect to the NT server using NT Explorer and most of the Administrative tools. He can’t use the IUSR_SATURN account because he doesn’t know the randomly generated password. To create an account he enters the following URL:

cmd.exe?/c%20c:\winnt\system32\net.exe%20user%20cnn%20news%20/add

He has just created an account called “cnn” with the password “news”. To make the account a local administrator he enters the following URL:

http://www.company.com/cgi-bin/getadmin.exe?cnn

It has taken him less than ten minutes to do all of this. He disconnects from AOL and clicks on start, goes upto find and does a search for the computer www.company.com. After about a minute the computer is found, next he right clicks on the “computer” and then clicks on Explore. NT Explorer opens and after a little wait Johnny is prompted for a user-name and password. He enters “cnn” and “news”. Moments later he is connected. Admin rights for the computer www.company.com are appended to his own security access token…now he can do anything. Using User Manager for Domains he can retrieve all the account information; he can connect to the Internet Service Manager; he can view Server Manager…first though, using NT Explorer he maps a drive to the hidden system share C$. He changes to the Winnt\system32\logfiles directory and opens up the logfile for that day. He deletes all of the log entries pertaining to his “visit” and saves it. If he gets any message about sharing violations all he has to do is change the date on the computer with the following URL:

http://www.company.com/cgi-bin/cmd.exe?/c%20date%2002/02/98

Next, using the Registry Editor he connects to the registry on the remote computer. Then using L0phtcrack he dumps the SAM (the Security Accounts Manager – holds account info) on the NT server and begins cracking all the passwords on the machine. Using the Task Manager he sets the priority to Low because L0phtcrack is fairly processor intensive (NB L0phtcrack ver 2.0 sets the priority to Low anyway) and there is still a few thing he must do to hide the fact that that some-one has gained entry. He deletes cmd.exe, getadmin.exe and gasys.dll from the cgi-bin, then he checks the security event log for the remote NT server using Event Viewer to see if he’s left any traces there.

Finally using User Manager for Domains he removes admin rights from the IUSR_SATURN account and deletes the cnn account he created a few moments earlier. He doesn’t need this account anymore….L0phtcrack will be able to brute force all the accounts. Next time he connects to this machine it will be using the Administrator account. He breaks his connection to the Internet and sets L0phtcrack’s priority to High, leaves it running and heads to bed…Looking at his alarm clock : it’s just passed 2:30am….Sighing to himself, he mumbles, “Sheesh, I’m getting slow!” and falls asleep with a grin on his face.

The original filename was ntremote.txt – Author Unknown



Recent in Old Skool Philes:
- Hacking Windows NT Through IIS & FTP
- Writing Worms for Fun or Profit
- Web Based E-mail (Hotmail Yahoo Gmail) Hack/Hacking with JavaScript

Related Posts:
- Hacker Files, Tools & Software Repository – leetupload.com
- SearchDiggity – GUI Front-End For GoogleDiggity & BingDiggity
- Binging (BETA) – Footprinting & Discovery Tool (Google Hacking)

Most Read in Old Skool Philes:
- Web Based E-mail (Hotmail Yahoo Gmail) Hack/Hacking with JavaScript - 308,215 views
- Remote Network Penetration via NetBios Hack/Hacking - 226,011 views
- How to get Ops and takeover a channel on IRC Hack Hacking - 173,148 views

Low-cost VPS Hosting

13 Responses to “Hacking Windows NT Through IIS & FTP”

  1. ZaD MoFo 25 March 2008 at 5:55 am Permalink

    He did not need to count lambs after this one.

    “Mary had a little lamb, her fleet was white as snow.
    And everywhere Mary went, Johnny was sure to go…”

    A standard install.
    Minimal configuration to have the job done.
    One’s system duplicata as as playground.
    Feel being at home.

    I enjoyed this story a lot. I am sure many had a smile or ther face.

    DARKNET: How about the story of the used Hard Disk brought in a flea market.
    Title: Persistence of magnetism.

  2. James C 25 March 2008 at 8:33 pm Permalink

    I enjoy these stories too. Have to say I would do things a bit differently.

  3. Pantagruel 25 March 2008 at 9:16 pm Permalink

    Thoroughly enjoyed this one. Indeed very old skool and sure reminds of the days that ‘hacking’ a server came down to pure luck of running into a badly kept box. a lazy admin and a floppy full of tools.

  4. zupakomputer 26 March 2008 at 1:23 pm Permalink

    Coincidently I was searching up on NT and reading about it the very day / night before of this article. Hope you weren’t spying on me!

  5. Darknet 27 March 2008 at 4:17 am Permalink

    zupakcomputer…of course I’m watching you 0_0

  6. AZ 27 March 2008 at 3:47 pm Permalink

    Great, would like to read more such stories.

  7. zupakomputer 27 March 2008 at 6:00 pm Permalink

    lol…..good thing I don’t do anything interesting then. Unless you count that blackops project I run from a hidden-reality-share with a spare astral body.

    Can’t help but notice the folks that win the posting prize don’t tend to come back! o_O

    : I’m sure it’s because they’re too engrossed in their new tools.

  8. Darknet 28 March 2008 at 2:25 am Permalink

    They don’t come back, because there is no prizes…so I have to ‘take care’ of them wahah!

  9. zupakomputer 28 March 2008 at 10:38 am Permalink

    I’m sure you mean ‘take care’ of them in a Mary Poppins way, and not in an Al Pacino Robert De Niro sort of way.

  10. James C 28 March 2008 at 7:03 pm Permalink

    Darknet take care of them by imprisoning them in the CUBE (http://en.wikipedia.org/wiki/Cube_%28film%29)

  11. Pantagruel 31 March 2008 at 9:56 am Permalink

    @James C

    Better start watching the cube trilogy and be able to find the way out of that maze ;)

  12. zupakomputer 31 March 2008 at 3:32 pm Permalink

    The Cube = the cyberpunk version of Hellraiser, with Saw traps O_O

    In the first film I think they find out they should stay (should have stayed) in the same place, and it resets after a while……

    I liked all the background info and puzzle-solving stuff in the films, but it’s kinda excruciating watching people wander around the same place bickering with one another.

  13. fever 8 April 2008 at 7:31 pm Permalink

    much enjoyment from this story got I, said the master Jedi.