ntsec.html

黑客培训教程

  a grave)</font><br>
  <b>&lt;QX-Mat&gt;</b> Handy to track down what the school admin did wrong<br>
  <b>&lt;QX-Mat&gt;</b> ;)<br>
  <b>&lt;Cypher&gt;</b> QX-Mat, there are many log analyzers out there<br>
  <font color="#ff0000">*** blindman`s_vision has joined #bsrf</font><br>
  <b>&lt;Cypher&gt;</b> getting one would usually be a good idea<br>
  <font color="#ff0000">*** snider has joined #bsrf</font><br>
  <b>&lt;DigitalFallout&gt;</b> Hey all<br>
  <b>&lt;ZipIt&gt;</b> What types of information do you (personally) audit...<br>
  <b>&lt;Rockin_lad&gt;</b> me<br>
  <b>&lt;Rockin_lad&gt;</b> but I think I'll ask it later , it may ne out of subject<br>
  <b>&lt;QX-Mat&gt;</b> regex will meet your needs though<br>
  <b>&lt;Cypher&gt;</b> hey blindman`s_vision, wb snider<br>
  <b>&lt;Cypher&gt;</b> hey DF<br>
  <font color="#ff0000">*** sanke has joined #bsrf</font><br>
  <b>&lt;snider&gt;</b> stupid servers<br>
  <b>&lt;blindman`s_vision&gt;</b> hey Cypher<br>
  <b>&lt;snider&gt;</b> lecture still on?<br>
  <b>&lt;QX-Mat&gt;</b> go....<br>
  <b>&lt;Cypher&gt;</b> ZipIt, usually i audit logon attemps (failure/success)<br>
  <b>&lt;Cypher&gt;</b> permittion changes<br>
  <b>&lt;QX-Mat&gt;</b> We're all ears<br>
  <font color="#ff0000">*** Olaf has quit IRC (Ping timeout)</font><br>
  <b>&lt;Cypher&gt;</b> etc.<br>
  <b>&lt;DigitalFallout&gt;</b> Can anybosy read the board?<br>
  <b>&lt;Cypher&gt;</b> snider, yes<br>
  <b>&lt;Cypher&gt;</b> lets continue<br>
  <b>&lt;Cypher&gt;</b> NTFS is the flag file system of Microsoft, so it would be a pity
  not to use it (they tried so hard :))<br>
  <b>&lt;Cypher&gt;</b> if you're using NT =&gt; use NT File System<br>
  <b>&lt;TTT&gt;</b> no, DF<br>
  <b>&lt;Cypher&gt;</b> especially if you're running a server<br>
  <b>&lt;Cypher&gt;</b> i think i don't need to explain the pros and cons of NTFS, right?<br>
  <b>&lt;Cypher&gt;</b> or should i?<br>
  <b>&lt;ZipIt&gt;</b> spare us<br>
  <b>&lt;m0ded&gt;</b> do it<br>
  <b>&lt;_quato_&gt;</b> nope<br>
  <b>&lt;ZipIt&gt;</b> !<br>
  <b>&lt;DigitalFallout&gt;</b> GO for it<br>
  <b>&lt;sanke&gt;</b> yes<br>
  <b>&lt;blindman`s_vision&gt;</b> do it<br>
  <b>&lt;Cypher&gt;</b> NO - 2 | YES - 4<br>
  <b>&lt;Cypher&gt;</b> ok ok :)<br>
  <b>&lt;m0ded&gt;</b> yes do it ;p<br>
  <b>&lt;ZipIt&gt;</b> damn<br>
  <b>&lt;Cypher&gt;</b> NTFS .vs. FAT<br>
  <b>&lt;DigitalFallout&gt;</b> God bless demoracy<br>
  <b>&lt;Cypher&gt;</b> ZipIt, that's the request :)<br>
  <b>&lt;Cypher&gt;</b> hehe<br>
  <b>&lt;_quato_&gt;</b> ya right<br>
  <b>&lt;ZipIt&gt;</b> Make it so... :(<br>
  <b>&lt;Cypher&gt;</b> the biggest advantage of NTFS is its permittions control<br>
  <font color="#ff0000">*** Rockin_lad has quit IRC (Ping timeout)</font><br>
  <b>&lt;_caps&gt;</b> what does NTFS .vs. FAT has to do with a lecture about security
  :&gt;<br>
  <b>&lt;Cypher&gt;</b> which is the most important part of the permittion management
  in a multi-user system (obviously)<br>
  <b>&lt;ZipIt&gt;</b> caps - &quot;permission control&quot;<br>
  <b>&lt;Cypher&gt;</b> _caps, of course (the part i'm talking about). besides i'll be
  happy to tell about any other subject u ask :) (if i know it)<br>
  <b>&lt;Cypher&gt;</b> permission!<br>
  <b>&lt;Cypher&gt;</b> damn, why noone corrected me?<br>
  <font color="#ff0000">*** Sub has quit IRC (Quit: ...)</font><br>
  <b>&lt;m0ded&gt;</b> heh<br>
  <b>&lt;Cypher&gt;</b> i kept saying &quot;permittion &quot; shame on me!<br>
  <b>&lt;_caps&gt;</b> uhm, okay.. go on :&gt; i'm not much informed on this topic.<br>
  <b>&lt;_caps&gt;</b> heh, your forgiven<br>
  <b>&lt;ZipIt&gt;</b> Cos were all nice... and besides it's piss funny!<br>
  <b>&lt;Cypher&gt;</b> anyhow, set the permissions for the directories and assign proper
  rights to your users<br>
  <b>&lt;Cypher&gt;</b> and NTFS gives u that<br>
  <b>&lt;Cypher&gt;</b> also, NTFS 5.0 (in win2k) has a Quota control<br>
  <b>&lt;Cypher&gt;</b> letting u set space quotas for users on the disk<br>
  <b>&lt;_quato_&gt;</b> Quota control????<br>
  <b>&lt;Cypher&gt;</b> also, a useful feature - use it<br>
  <b>&lt;ZipIt&gt;</b> User directory space<br>
  <b>&lt;Cypher&gt;</b> _quato_, yes, u could limit users in disk space<br>
  <font color="#ff0000">*** Raven has joined #bsrf</font><br>
  <font color="#ff0000">*** ChanServ sets mode: +oa Raven Raven</font><br>
  <b>&lt;m0ded&gt;</b> hey Raven<br>
  <b>&lt;Raven&gt;</b> hey ho<br>
  <b>&lt;Raven&gt;</b> sorry i'm late<br>
  <b>&lt;DigitalFallout&gt;</b> Hello<br>
  <b>&lt;Cypher&gt;</b> heya Raven<br>
  <b>&lt;dr3x&gt;</b> my school needs that...somebody downloaded 3 gigs of mp3s and i
  couldnt save my english report<br>
  <b>&lt;Raven&gt;</b> just here to moderate<br>
  <b>&lt;_quato_&gt;</b> hail raven<br>
  <b>&lt;dr3x&gt;</b> Hi Raven<br>
  <b>&lt;Raven&gt;</b> (it rhymes)<br>
  <b>&lt;Slayer&gt;</b> hi Raven<br>
  <b>&lt;Cypher&gt;</b> Raven, we are having lecture+questions structure<br>
  <b>&lt;ZipIt&gt;</b> here we go again... another page full of hi's... damn yr popular
  ;))<br>
  <b>&lt;Cypher&gt;</b> so u could +m on the lecture and -m on the questions, if u want<br>
  <b>&lt;m0ded&gt;</b> yeah good idea<br>
  <font color="#ff0000">*** Raven sets mode: +o Cypher</font><br>
  <font color="#ff0000">*** ChanServ sets mode: -o Cypher</font><br>
  <b>&lt;QX-Mat&gt;</b> Has it worked yet?<br>
  <b>&lt;Raven&gt;</b> hmm, secureops<br>
  <b>&lt;Raven&gt;</b> gimme a sec<br>
  <b>&lt;Cypher&gt;</b> k<br>
  <b>&lt;QX-Mat&gt;</b> Now?<br>
  <font color="#ff0000">*** Raven sets mode: +o Cypher</font><br>
  <b>&lt;QX-Mat&gt;</b> Nope<br>
  <b>&lt;Raven&gt;</b> good<br>
  <b>&lt;m0ded&gt;</b> +m<br>
  <b>&lt;QX-Mat&gt;</b> ooh<br>
  <b>&lt;Raven&gt;</b> did you start yet?<br>
  <b>&lt;Cypher&gt;</b> Raven, an hour ago :)<br>
  <b>&lt;m0ded&gt;</b> yeah<br>
  <b>&lt;Raven&gt;</b> oops<br>
  <b>&lt;Raven&gt;</b> :-)<br>
  <b>&lt;Raven&gt;</b> are you in a break now or something?<br>
  <b>&lt;ZipIt&gt;</b> zzzz<br>
  <b>&lt;Rockin_lad&gt;</b> yeah I was late too<br>
  <b>&lt;m0ded&gt;</b> set mode +m and lets continue..<br>
  <b>&lt;Raven&gt;</b> or am i interrupting you?<br>
  <b>&lt;_quato_&gt;</b> back to NTFS ...<br>
  <b>&lt;Rockin_lad&gt;</b> damn oh damn analog dialups<br>
  <b>&lt;Rockin_lad&gt;</b> okay NTFS <br>
  <b>&lt;dr3x&gt;</b> yeah, on with the lecture<br>
  <b>&lt;Cypher&gt;</b> k, lets move on then<br>
  <b>&lt;Cypher&gt;</b> question time :)<br>
  <b>&lt;Cypher&gt;</b> (was)<br>
  <b>&lt;Cypher&gt;</b> _quato_ do u have any NTFS questions? i was thinking of moving
  next<br>
  <b>&lt;Cypher&gt;</b> another step to basic NT security is Audits<br>
  <b>&lt;Cypher&gt;</b> try to break into your own system!<br>
  <b>&lt;Raven&gt;</b> absolutely<br>
  <b>&lt;Rockin_lad&gt;</b> how ?<br>
  <b>&lt;_quato_&gt;</b> no questions....<br>
  <b>&lt;Cypher&gt;</b> it will: 1. make u a better person ;-) and 2. make your system
  a better system ;-)<br>
  <b>&lt;_quato_&gt;</b> how secure is NTFS<br>
  <b>&lt;_quato_&gt;</b> ??<br>
  <b>&lt;snider&gt;</b> <b>&lt;_quato_&gt;</b> no questions....<br>
  <b>&lt;Cypher&gt;</b> quato, pretty secure<br>
  <b>&lt;_quato_&gt;</b> encryption??<br>
  <b>&lt;Raven&gt;</b> the problem is that security holes arise from software itself<br>
  <b>&lt;Raven&gt;</b> and not the file system<br>
  <b>&lt;Raven&gt;</b> (usually)<br>
  <b>&lt;Cypher&gt;</b> _much_more_ then all the other microsoft file systems<br>
  <b>&lt;Cypher&gt;</b> quato, of course<br>
  <b>&lt;_quato_&gt;</b> w2k - Kerberos <br>
  <b>&lt;Cypher&gt;</b> encryption, compression, permissions, the whole pack<br>
  <b>&lt;Cypher&gt;</b> Raven, yep... that's one of the probs<br>
  <font color="#ff0000">*** Noon_Ghunna has joined #bsrf</font><br>
  <b>&lt;Cypher&gt;</b> quato, also (but that's in win2k)<br>
  <b>&lt;Raven&gt;</b> and we all know that microsoft isn't exactly security concious<br>
  <b>&lt;QX-Mat&gt;</b> zzz<br>
  <b>&lt;Cypher&gt;</b> Raven, Ce La Vi ;-)<br>
  <b>&lt;Cypher&gt;</b> so, i was talking, Audits<br>
  <b>&lt;Raven&gt;</b> they never do proper beta testing<br>
  <b>&lt;Raven&gt;</b> :-)<br>
  <b>&lt;DigitalFallout&gt;</b> Gee where have I heard that before.....<br>
  <b>&lt;_caps&gt;</b> well, thing about microsoft products is that evntually you can't
  secure something even if you want to :P<br>
  <b>&lt;Cypher&gt;</b> there are great third-party software to test your shields<br>
  <b>&lt;Cypher&gt;</b> the Security Scanners<br>
  <b>&lt;Samcon&gt;</b> this is really strange cuse bill gates is a (retired?) hacker<br>
  <b>&lt;Rockin_lad&gt;</b> Red Button is one of those <br>
  <b>&lt;_caps&gt;</b> hacker? billy? ;&gt;<br>
  <b>&lt;m0ded&gt;</b> he was<br>
  <b>&lt;Cypher&gt;</b> Red button is to establish null sessions, no?<br>
  <b>&lt;Samcon&gt;</b> sure, they kicked him out of his university for that<br>
  <b>&lt;Cypher&gt;</b> eEye Retina (port scanner, but a good one), the ISS Internet
  Scanner, the ISS RealSecure, WebTrends Sec Scanner, and more....<br>
  <b>&lt;Rockin_lad&gt;</b> I dont know , I tried it , didnt work :)<br>
  <b>&lt;Samcon&gt;</b> i think it was harvard<br>
  <b>&lt;Slayer&gt;</b> i think its for getting admin<br>
  <b>&lt;Cypher&gt;</b> Rockin_lad, u cannot always establish null sessions (then it
  would be just too easy)<br>
  <b>&lt;Slayer&gt;</b> dont know if it works<br>
  <b>&lt;Rockin_lad&gt;</b> oh<br>
  <font color="#ff0000">*** FrEEkY has quit IRC (Ping timeout)</font><br>
  <font color="#ff0000">*** Samcon is now known as Samcon_watchin_flubber</font><br>
  <b>&lt;Cypher&gt;</b> so, in conclusion, we had a NetBIOS intro, the IPC share and
  Null Session, and the steps to secure NT station - questions?<br>
  <b>&lt;DigitalFallout&gt;</b> (I was late) Did you cover local security?<br>
  <b>&lt;Cypher&gt;</b> someone asked about passwords (the SAM, enryption, etc) - should
  i explain on it?<br>
  <b>&lt;m0ded&gt;</b> yeah<br>
  <b>&lt;QX-Mat&gt;</b> Terry Parchett invented paged memory on his BBC clone<br>
  <b>&lt;Rockin_lad&gt;</b> oh yes<br>
  <b>&lt;Rockin_lad&gt;</b> plz<br>
  <b>&lt;QX-Mat&gt;</b> he was a hacker too<br>
  <b>&lt;Cypher&gt;</b> DF, local security? securing a machine from the admin? ;-))<br>
  <b>&lt;DigitalFallout&gt;</b> :) No from people with access to the server<br>
  <b>&lt;Cypher&gt;</b> DF, yes<br>
  <b>&lt;Cypher&gt;</b> we discussed permissions<br>
  <b>&lt;Cypher&gt;</b> NT uses an assymetric encryption algorithm (so does UNIX, btw)
  to encrypt the passwords<br>
  <b>&lt;DigitalFallout&gt;</b> Ok<br>
  <b>&lt;Rockin_lad&gt;</b> what I really was woundering about , is how to break into
  NT senmail version ?<br>
  <b>&lt;m0ded&gt;</b> witch is?<br>
  <b>&lt;DigitalFallout&gt;</b> I'l review the log when it is posted<br>
  <font color="#ff0000">*** Raven has quit IRC (Quit: Cypher, you're on your own now. Good luck. :-))</font><br>
  <b>&lt;Cypher&gt;</b> and it stores the hash (the encrypted password) in the SAM<br>
  <b>&lt;QX-Mat&gt;</b> Unix's is unirotational<br>
  <b>&lt;Cypher&gt;</b> SAM = part of the registry<br>
  <b>&lt;Rockin_lad&gt;</b> or otherwise what soever<br>
  <b>&lt;Cypher&gt;</b> and, despite &quot;roomors&quot;, the password cannot be decrypted<br>
  <b>&lt;Cypher&gt;</b> it can only be cracked<br>
  <b>&lt;Rockin_lad&gt;</b> used to store information about users<br>
  <b>&lt;Rockin_lad&gt;</b> and domains<br>
  <b>&lt;Rockin_lad&gt;</b> oh<br>
  <b>&lt;Rockin_lad&gt;</b> brute force ?<br>
  <b>&lt;Cypher&gt;</b> there are two common methods:<br>
  <b>&lt;Cypher&gt;</b> 1. Dictionary Attack<br>
  <b>&lt;Cypher&gt;</b> meaning, to get a word, encrypt it, and compare to the hash<br>
  <b>&lt;Cypher&gt;</b> same =&gt; this is the password, not =&gt; move to next word
  in the dictionary<br>
  <b>&lt;Cypher&gt;</b> and number 2 is Brute Forcing<br>
  <b>&lt;Rockin_lad&gt;</b> wont that take alot of time ?<br>
  <b>&lt;Cypher&gt;</b> which just generates those words<br>
  <b>&lt;Rockin_lad&gt;</b> But brut ferce is very stupid <br>
  <b>&lt;Cypher&gt;</b> yep, it'll probably take time<br>
  <b>&lt;Cypher&gt;</b> yep again<br>
  <b>&lt;Slayer&gt;</b> sometimes its the only way<br>
  <b>&lt;Rockin_lad&gt;</b> there must be an interior bug<br>
  <b>&lt;Cypher&gt;</b> that's why its is necessary to gather information first, so u
  won't have to brute force it<br>
  <b>&lt;Cypher&gt;</b> sometimes, u could social engeneer it out of the admin/user ;-)<br>
  <b>&lt;Cypher&gt;</b> Rockin_lad, in assymetric algorithms?<br>
  <b>&lt;DigitalFallout&gt;</b> That is a VERRY hard thing to do<br>
  <b>&lt;Rockin_lad&gt;</b> so , can I have question now ?<br>
  <b>&lt;Cypher&gt;</b> nope. its pure mathematics, no bugs there :-))<br>
  <b>&lt;Cypher&gt;</b> shoot<br>