Network Security Hacking

NullZer0

Ok, so I got my friend to set up a network as a project.

I can login to the intranet page that he created using SQL injection. Fair enough, I cant seem to get anywhere.

I can dial into the server using remote desktop but I have been unable to add myself as an admin user using an SQL injection/dbo exploit.

Are there any other ways that I can get by the windows server 2003 login or even add myself as an administrator the the box?

Fremen

dooooooodgy.....

:rolleyes:

Martyr

yeah, sounds very dodgy alright

martin84

Another Network Project.

NutJob

iRock wrote:

Ok, so I got my friend to set up a network as a project.

I can login to the intranet page that he created using SQL injection. Fair enough, I cant seem to get anywhere.

I can dial into the server using remote desktop but I have been unable to add myself as an admin user using an SQL injection/dbo exploit.

Are there any other ways that I can get by the windows server 2003 login or even add myself as an administrator the the box?

Yes:D

r3nu4l

Rent the movies "Hackers" and "Wargames". Watch them with your friend and then social engineer the passwords from him. That's sure to work!

HashSlinging

and who is this friend you speak of.? rubs chin. :rolleyes:

aidan_walsh

r3nu4l wrote:

Rent the movies "Hackers" and "Wargames". Watch them with your friend and then social engineer the passwords from him. That's sure to work!

Also, rent Swordfish to learn how to do it at great speed.

Thomas_S_Hunterson

Beat the password out of your friend, problem solved.

Alternatively bribe someone who knows the password

Cake Fiend

To approach this project earnestly, you're going to have to learn to rollerblade.

Hack the planet!!

Black Swan

sean_keevey wrote:

Beat the password out of your friend, problem solved.

Alternatively bribe someone who knows the password

Oh, while you're at it, ask him for his credit card numbers, bank account numbers, equity account numbers, date of birth, and mum's name?

NullZer0

martin84 wrote:

Another Network Project.

Yes, another network project. Im just so dedicated to my studies.


So, no help?

Fremen

what do you think all the previous posts were?

I'd tell you more but I don't play well with others

Martyr

iRock wrote:

Yes, another network project. Im just so dedicated to my studies.


So, no help?

Some people might not want to discuss ways to break into a computer, even if they know how, or have done so in the past..i'll start anyway :P

correct me at any time..

If the SQL server is not running under the correct privileges to enable adding users to the administrators group, then you're going to need another exploit.

could be the case that the server is synchronised with other systems in a domain, so after you've added a user to the administrator group, it gets dropped back down to limited user soon afterwards.maybe you haven't added the user to administrators group,yet.

The VSC Volume Shadow Copy service will allow you to access any file on the system, so long as you're running with correct privileges of course.
if you want the SAM file from disk while the system is running, you can only access it through VSC or a RAW read of the disk.(NTBackup will work too, but only in GUI)

normally most people tell you to use bootup disk (NTFSDOS,linux,barpe..etc) thats ok if you have physical access and no administrator rights, but remotely, you'd use VSC, or try dumping from the registry by connecting to the SAM RPC service, or the task scheduler.

the SAM doesn't usually contain all username/hashes if a domain anyway.(don't forget Active Directory in domain)

there could be software running on the system that is vulnerable to some exploit.you'd have to search online.

if you've obtained the plaintext from cracking an admin account in the SAM, then you could get access that way.
Or if you've had no luck with cracking, you can try 'pass the hash' using a modified client (example SMB)

Even if the administrator chooses a password of 500 letters, it won't make much of a difference if an attacker gets the hash of it.

When authenticating with a remote system using NetBIOS (as example) the attacker would send the hash which would be compared with hash on the local system, if they're equal, you logon successfully.

kerberos can prevent this, but because its just a local system, LSASS will allow for it, AFAIK.

Capt'n Midnight

r3nu4l wrote:

Rent the movies "Hackers" and "Wargames". Watch them with your friend and then social engineer the passwords from him. That's sure to work!

no get sneakers instead
unless he's Russian, cos' they don't use prime numbers

NutJob

Disclamer:
I also cannot accept responsibility of any kind for any damages etc as a result of this information. It is provided on the grounds that it be used legally and responsibly.

Fremen wrote:

what do you think all the previous posts were?

I'd tell you more but I don't play well with others

Please do not do anything Illegal. The best advice i can give you is below



Get the agreement in writing with dates of when you can attack the server. Without it you have not a leg to stand on and having your ass arrested and house raided plus the expense of court which you will loose unless you have an agreement in writing.


If its legal start here

1. nmap the host (to see what you can see)
2. Get linux
3. Install Nessus
4 Get a tutorial for nessus
5. Install Nessusd
6. Get metasploit
7. Get a tutorial or two on Metasploit
8. Attack any holes found with nessus or your eyes

Plan B
1. Find web applications connecting to that server
2. If available Attack any applications connecting to that SQl server.


Plan C

1. Download THC-Hydra
2. Install THC-Hydra
3. Get a tutorial
4. Get a good wordlist
5. Download wireshark
6. Install Wireshark
7. Get a tutorial
8. Run Hydra against MS-SQL or any service exposed you can
**(Warning accounts can be automatically locked out hence wireshark to see whats going on)


Plan D
1. Learn more above is the very basics

See:
http://www.vulnerabilityassessment.co.uk/Penetration%20Test.html

Read:
Rss feeds attached are a good start.
(Sarpreader on windows isnt bad, liferea for linux)



Im going to report this post to a MOD to be sure. If they choose to remove it i have no problem with that.

ecksor

I have no problem with posting this information.

I do have one addition though; It's not enough to get agreement from someone that you have permission to attempt a penetration test, it's vital that you make absolutely sure that the person giving you the permission is actually in a position to give you that permission. For example, if a company hosts a site on a shared hosting server or co-locates their server then you may find that your agreement isn't worth the paper it is written on.