1. Kennesaw State University
How To Hack Windows
Brent Williams
MCSE, CNE, A+, N+, XP-MCP
Kennesaw State University
(Atlanta, Georgia)

2. Agenda Why Talk About Hacking? Hacking Scenarios
Utilities, Techniques, and Ideas
Preventive Methods
New Threats

3. Hackers Know… They Look for Targets of Opportunity
Most System Administrators are Self-Taught
Most Don’t Know of Basic Security Issues in Windows
Many Systems are Left Vulnerable

4. Think Like a Hacker (or script-kiddie, if you prefer!)

5. Hacking Steps Casing the Establishment
Public Sources
Social Engineering
Network Hacking (Attack a Server)
Information Retrieval
System Damage
System Hacking (Attack a PC)

6. NETWORK ATTACK

7. Footprinting: Target Acquisition
Visit Their Web Site
Open Source Search – People
( )
Sam Spade
Nslookup
Tracert
Visual Route

13. Scanning Ping sweeps Look for Ping Ultrascan Superscan
WS_Ping (Ipswitch)
Look for
Port 80
Port 139 and 445
Port 21

15. Protect and Check Firewall Software Shields Up? www.zonealarm.com
Shields Up?

16. Decide How to “Break in”
Use a Web Browser and Exploit a Weakness
Buffer overflow (plant Netcat)
Unchecked Data
Attach
Use a Null Connection
Net Use \\ip\ipc$ “” /u:””
Look for Shares
\\ip address or \\server name

17. Example: Windows Enumeration (What You Want)
Identify Valid User Accounts
Identify Group Membership
Find Poorly Protected Shares
Tools…
Winfingerprint
Superscan
Dumpsec

18. Example: Windows Enumeration (Windows Can be Vary Easy!)
Get the User IDs, Groups, etc.
DumpACL – - Wow!
LDAP query – Dump Accounts and Groups on a 2000 Server
Tool is on the Windows 2000 Server CD!

20. Example: Get a Password
Brute Force Attack
More Elegant Tools
L0PHTCRACK
LC3/LC4

21. Easy Hacks Shares Most users don’t know how to use NTFS
Default permission in NT/2000 is EVERYONE has FULL CONTROL
Changed in XP to EVERYONE has READ

22. Protecting Windows Servers
Get and Run the MS Baseline Security Analyzer
Use Policies
Latest Service Packs and patches
Weekly or automatic
Firewall Software
Learn how to use NTFS permissions

23. Wireless Hacking Wireless LANs are everywhere
Business, Schools, Homes
By Default, they are Open!
Easy to Find – Netstumbler
Warchalking
Protection is limited
WEP: Wired Equivalent Privacy – can be hacked - airsnort
New Protection Methods
802.1x

24. WORKSTATION ATTACK

25. Basic Windows 95/98 PWL file Document Passwords Keystroke Logging
Your Admin Password is All-Over-the-Place!
Easily copied to a floppy
Document Passwords
Keystroke Logging

26. Workstation Attack Prevention
Firewall – especially on cable or DSL
Limit Shares - Use Passwords
Make Document Passwords LONG
Be aware of PWL files

27. Windows XP Professional Attacks
More secure out of the box
Use Policies
Know how to use NTFS
Limit Shares
Don’t turn on IIS
Use the built in firewall (or other)

28. SpyWare New threat Visit to Web Site Installs SpyWare
Used to Mine Personal Info
Destabilizes PC
Get SpyBot

29. Vendors and Politicians Fail Us
Why do and Web Clients allow software to install (without a prompt)?
Why not put network access in a “sandbox”?
Why are web sites allowed present misleading “User Agreements”
What will we do about HTML?

30. Web Sites for Tools www.2600.com www.hackersclub.net

31. Summary Get Some Training! Hacking Tools are
Plentiful
Simple to Use
Evolving
You Must Expect Attacks on All Systems
Do the Basics – That Stops 99% of Attacks!

32. This Presentation Available
Visit
See Our Course Schedule at

33. Add N-stealth Pest Patrol Nessus Retina Check Web Sites
Check Edtech2000 server
Install LC3/LC4 on laptop
Keystroke Logger detection