Hi nessus community,
Recently I ran a nessus against a W2k Active Directory in native mode and noticed that
- Domain Accounts with empty passwords or
- Domain Accounts with password=username
were not found, even if I provided nessus with a valid Admin account.
To identify the problem I first tried a scan against a W2k Svr without AD and
aforementioned accounts were found. Then I activated the AD, ran the same scan again
and the accounts were not found.
Please see the attached file for my detailed test process.
Question:
(1) Am I doing something wrong trying to get AD-Accounts with easy-to-guess passwords?
(2) Is there an option to check for AD Accounts with empty passwords or
password=username?
Kind regards,
tobias
______________________________________________________________________________
Horoskop, Comics, VIPs, Wetter, Sport und Lotto im WEB.DE Screensaver1.2
Kostenlos downloaden: http://screensaver.web.de/?mc=021110
2003-11-21 - tobias
can nessus find users with empty passwords or pw=usrname ?
Basic Configuration:
====================
- Windows Server: PIII 800, 256 MB RAM
- Nessus 2.0.7, Knoppix 3.3 on HP6100 PIII 1000, 512MB RAM
- local users on Windows Server:
username password
-------- --------
test test
test2
- Nessus-Config:
(1) Tab "Plugins" -> "Disable All Plugins"
(2) Tab "Plugins" -> Plugin-Selection "Windows" checked
(3) Tab "Scan-Options" -> "Safe Checks" unchecked
(4) Tab "Plugins" -> "Enable dependencies at runtime" checked
Test 1
======
- Windows 2000 Engl. SP1 (no AD)
Result
------
test was identified as having no password set
test2 was identified as having test2 as password
Test 2
======
- Windows 2000 Engl. SP1
- Active Directory installed as AD Root Server in Native Mode
- two new Domain users added:
username password
-------- --------
nopasswd
pwequal pwequal
Result
------
- no accounts were identified having weak passwords
Test 3
======
same settings as in Test 2 but with:
Tab "Prefs." -> SMB account = "Administrator"
-> SMB password = <valid-admin-passwd>
Result
------
- no accounts were identified having weak passwords
Test 4
======
same settings as in Test 3 but with:
Tab "Prefs." -> "Brute force SMB" checked
Result
------
- no accounts were identified having weak passwords
_______________________________________________
Nessus mailing list
[EMAIL PROTECTED]
http://mail.nessus.org/mailman/listinfo/nessus
