A BRIEF LESSON ON NETBIOS
NetBIOS stands for Network Basic Input Output System .It was originally developed by IBM and Sytek as an Application Programming Interface (API) for client software to access LAN resources. If you have experience of working on a LAN using Microsoft Windows Operating Systems (like Windows98 , Windows Me, Windows NT etc), you must have clicked on "Network Neighborhood" to access the computers attached to your network. After clicking on the icon you would have seen the names of the computer . Do you know what exactly happens when you click on Network Neighborhood? Your computer tries to get the names of the computers attached to the network with by issuing command to NetBIOS . NetBIOS gives the name of the computers that have been registered . In short NetBIOS gives the various information of the computers on a network . These Include-
Name of the computer
Username
Domain
Computer Name
and many others.
Like any other service it also works on a port . It has been assigned a port number 139.
THE NBTSTAT COMMAND
You can manually interact with the NetBIOS with the help of NBTSTAT command. To use this command click on the start button then select RUN... and type "command" without quotes to launch MS-DOS Command Prompt. Alternatively you may click on Start Button then go to Programs and then select Command Prompt. Once you are in Command Prompt you can exit by typing command EXIT . To launch Command Prompt in full screen mode press ALT+ENTER key combination .To get back to the original window again press ALT+ENTER key combination. If you have launched the command prompt you will get
c:\windows>
If you do not get windows displayed after c:\ don't worry just keep going , all required commands will work fine.
Now lets play with the NBTSTAT command.
If you want to get more help from MS-DOS about this command type NBTSTAT/? on the prompt i.e.
c:\windows>nbtstat/?
If you want to get the NetBIOS information of your computer type the following command
c:\windows>nbtstat -a 127.0.0.1
This command will list the NetBIOS information. A typical example
NetBIOS Remote Machine Name Table
Name Number Type Usage
================================================== ========================
workgroup 00 G Domain Name
my_computer 03 U Messenger Service
myusername 03 U Messenger Service
MAC Address = 00-02-44-14-23-E6
Please note that we have used our ip address to be 127.0.0.1 . This ip address is called as "Loop Back" ip address because this ip address always refers to the computer you are using.
This example is self explanatory . We need not go in details. We need to know about the Name and Number. The Name displays the Name of the NetBIOS and there is a corresponding hexagonal number . You may see some additional names in your case.
If you want to get the NetBIOS names of a remote computer, the command is
c:\windows>nbtstat -a ipaddress
Example - To get the NetBIOS names of a computer having ip address 203.195.136.156, we shall use the command
NOTE-203.195.136.156 may be a active ip address of someone's computer. I am using it only as an example. Please don't hack this computer.
c:\windows>nbtstat -a 203.195.136.156
WHAT YOU NEED TO HACK
All you need is a Windows based operating system like Windows 98 and Me (but I prefer Windows NT, 2000, XP) and an internet connection.
TYPES OF ATTACKS
We can launch two types of attack on the remote computer having NetBIOS.
1. Reading/Writing to a remote computer system
2. Denial of Service
Searching for a victim
You may manually search for the victims by first using the nbtstat -a ipaddress and then net view \\ipaddress . If at first you don't succeed step to next ip address until you find a suitable ip address. You may also use a port scanner .A port scanner is simply a software that can search for any block of ip address say 192.168.0.1 to 192.168.0.255 for one or more ports. "Orge" is a port scanner that gives NetBIOS names of the remote computer.
Cracking Share passwords
Sometimes when we use "net use k: \\ipaddress\sharename" we are asked for a password. There is a password cracker "PQWAK" . All you have to enter ip address and the share name and it will decrypt the password within seconds. Please note that this can crack only the passwords is the remote operating system is running on -
Windows 95
Windows 98
Windows Me
Using IPC$ to hack Windows NT,2000,XP
Now you must be thinking of something that can crack share passwords on NT based operating systems like Windows NT and Windows 2000.
IPC$ is there to help us. It is not at all a password cracker . It is simply a string that tells the remote operating system to give guest access that is give access without asking for password.
We hackers use IPC$ in this way
c:\windows>net use k: \\123.123.123.123\ipc$ "" /user:""
You may replace k letter by any other letter. If you replace it by "b" (type without quotes) a new drive will be created by a drive letter b.
Please note that you won't be able to get access to victim's shared drives but you you can gather valuable information like names of all the usernames, users that have never logged, and other such information. One such tool that uses the ipc$ method is "Internet Periscope". Another tool is "enum" - its my favorite toot however it is run on command promt.
Penetrating in to the victim's computer
Now that you have access to a remote computer you may be interested in viewing his secret emails, download hismp3 songs , and more...
But if you think like a hard core hacker you would like to play some dirty tricks like you may wish to install a key logger or install a back door entry Trojan like netbus and backorifice or delete or copy some files. All these tasks involves writing to victim's hard disk . For this you need to have write access permission
Lets Hack - Part 2 Denial of service attack
This type of attacks are meant to be launched by some computer techies because this type of attack involves using Linux Operating System and compiling C language files. To exploit these vulnerabilities you have to copy exploit code from sites like neworder,securityfocus etc and comiple them.
The two most common vulnerabilities found in NetBIOS are
Vulnerability 1
Vulnerability 2
Another vulnerability that has been foud recently is that one can launch a DoS attack against winodws NT,2000,XP,.NET system.
enjoy your hacking.........tricks can work on some more stuffs which are not given here........
No comments:
Post a Comment