Besides... along with finding the open ports, could so the smb_nt* stuff to check the registry
Anyone had the smb_nt_* registry stuff work on win2k workstations? or XP workstations? I only have access to XP 'home' right now and it won't let remote access (does show some strange accounts that XP account/user manager doesn't see) also, XP seems to want to 'phone home' (doing ntp on windowstime.microsoft.com) -- Michael Scheidell Secnap Network Security, LLC [EMAIL PROTECTED] 1+(561) 368-9561 See updated IT Security News at http://www.fdma.com/ ----- Original Message ----- From: "John Lampe" <[EMAIL PROTECTED]> To: "Michael Scheidell" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Thursday, December 27, 2001 10:51 AM Subject: Re: anyone working on a UpnP detector plugin? > I can find UpnP via NASL script...It gets thorny if you want to serve up > the overflow from port 1900...plus, the details of the overflow have not yet > been released. > > > John Lampe > https://f00dikator.hn.org/ > > > "In Germany, they first came for the communists, and I didn't speak up > because I wasn't a communist. Then they came for the > Jews, and I didn't speak up because I wasn't a Jew. Then they came for > the trade unionists, and I didn't speak up because I > wasn't a trade unionist. Then they came for the Catholics and I didn't > speak up because I wasn't a Catholic. Then they came for me - and by > that time there was nobody left to speak up." > > --Martin Niemvller > > ----- Original Message ----- > From: "Michael Scheidell" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Thursday, December 27, 2001 8:07 PM > Subject: anyone working on a UpnP detector plugin? > > > > Before I start on one: is anyone working on a UpnP detector plugin? > > Best I understand, there is a TCPIP XML (web server) on port 1900 and a > UDP > > port open on port 5000. > > > > doing just a generic 'misc/useless services' family? or checking to see if > > you can 'gain root remotely'? > > -- > > Michael Scheidell > > Secnap Network Security, LLC > > [EMAIL PROTECTED] 1+(561) 368-9561 > > See updated IT Security News at http://www.fdma.com/ > > > > >
