From: Erik Pace Birkholz (erik@specialopssecurity.com)
Date: Thu Jun 09 2005 - 04:06:12 EDT
Hugo,
Based on the limited info you have provided, here is my advice.
Have you done UDP port scans? If you haven't done so, scan to determine
what UDP ports are open. Depending on what you find this could be
helpful. For example, if SNMP is available with a default or guessable
community name it will provide usernames among other goodies.
Re: obtaining the SQL version; since the OS is Win3k the SQL server will
likely be SQL 2000 with SP3 or later. If you really want to find out try
SQLVer (www.sqlsecurity.com) as Chip already mentioned and try SQLRecon
(www.SpecialOpsSecurity.com -click on LABS).
With that said don't give up on the SQL "SA" brute force attacks. There
is no account lock out for SA so rock and roll. SQLDict.exe works pretty
well if you have a big dictionary file. Another option is ForceSQL.exe
because it brute forces an account (sa) based on a user specified
character set (charset.txt) up to a user specified max password length.
You also mentioned DNS: 53. Not sure if you are referring to UDP or TCP?
If it is TCP then you should try a zone transfer.
Also don't forget full (1-65535) TCP port scans and source port scans
(SRC=20,53,88,80,etc...)
Finally use tracerouting, hping2, tcpdump, etc to determine if the
blocking ACLs are on the host or a network device. Something is
facilitating the firewalling that is hiding juicy MS specific ports like
TCP 135 and 445. Is it ICF, IPSec, a personal firewall, network
firewall, perimeter router or what? Once you know this it will help
direct your attempts to subvert that protection and get exposure to more
ports on the target.
Let us know how it goes!
Good luck,
Erik Pace Birkholz
www.SpecialOpsSecurity.com
-----Original Message-----
From: Hugo Vinicius Garcia Razera [mailto:hviniciusg@gmail.com]
Sent: Tuesday, June 07, 2005 4:01 PM
To: pen-test@securityfocus.com
Subject: pen-test on a windows 2003 server box whit MS-SQL and Terminal
Services
Hi every one, I'm doing a pen test on a client, and have found that he
have a windows 2003 server box on one segment of his public addresses
this is his dns/web/mail server:
- mssql :1433
- terminal services :3389
- iis 6 :80
- smtp :25
- pop3 :110
- dns : 53
- ftp : filtered
ports opened, i logged on the terminal services port whit the winxp
remote desktop utility and it connects perfectly.
i tried a dictionari atack on mssql server whit the "sa" account and
others user names i collected.
Hydra from THC was the tool, but no succes on this atack.
also tried the tsgrinder for terminal services , but no success.
well here come some questions:
- What others Usernames should i try for sql and terminal services?
i tried whit "sa" for sql and "Administrator" for TS
- Any one knows how could i identify what version of sql server is
running.
- What other services of this host can be exploited?
any comments, ideas, suggestions would be greatly appreciated.
Hugo Vinicius Garcia Razera
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:23 EDT