Print Sharing

Exploiting File and Print Sharing, by:

Ghost_Rider (Ghost_Rider9@hotmail.com)

R a v e N (barakirs@netvision.net.il)

Date of Release: 2/4/2000

http://blacksun.box.sk

Thanks to Oggy, a totally kewl and helpful guy that helped us release this

tutorial faster.

-------------

Introduction

-------------

Remember that I won't go into much detail, because it could start getting

too complicated to explain to newbies. This is a newbies guide after all. If

you want more detailed information about file sharing search the web, or

read some good NT networks administration books.

Windows has an option called file and print sharing. You can use this

option in order to "share" drive and printers, which means giving access to

files and printers to other people - people on your own network, specific

IPs or even the whole world. When you turn this option on, you leave an open

port (port number 139) that accepts connections and understand the "NetBIOS

protocol", a set of commands (a "language") used to access remote file

and print sharing servers, so that other computers can access the files or

printers you decided to share.

Now sometimes in a small company LAN this could be extremely useful. For

example, instead of having a separate

printer for each computer, there's just

one central printer in a computer that allows file and print sharing. But if

you are using file sharing in your home computer (We've seen many people

that have this option turned on and don't even know what it means! Poor

souls) that is connected to the Internet, that could be quite dangerous because

anyone who knows your IP can access your files or printers you're sharing.

If you don't know if file sharing is active in your computer just go to the

control panel and select the Network icon. Now you should see a box where you

can see all the network software that you have installed, such as TCP/IP

(Transfer Control Protocol / Internet Protocol. This is the protocol that is

used to transfer data packets over the Internet. A protocol is like a human

language - if two computers understand it, they can communicate) and probably a

dial-up adapter (so you could transfer TCP/IP packets over a PPP connection.

PPP, or Point to Point Protocol is the protocol used in dial-up connections),

check if you have a line called File and Printer Sharing.

If you have this then you have sharing activated, to turn it off just uncheck

the "I want to be able to give others access to my files" and do the same to

the other. Let's return to the ports thing. Remember port 139? The File Sharing

Port is port 139 and it's called NetBIOS Session Service port. When you have

this option enabled you also have 2 other ports open but they use the UDP

protocol instead of the TCP protocol. These ports are 137 (Name Service) and

138 (Datagram Service). Now if you know anything about DoS attacks (known to

many as nukes) port 139 should sound familiar... There's a kind of DoS (stands

for Denial of Service) attack called the OOB nuke (OOB stands for Out Of Band)

or "winnuke" that sends an OOB packet to port 139 and makes Windows lose

connection and drop the user to "blue screen mode". If you wish to know more

about DoS attacks, I suggest that you wait for the DoS attacks tutorial (at the

time this tutorial was written, the DoS attacks tutorial didn't exist yet.

However, by the time you read it it might already be available, so you can try

and get it from http://blacksun.box.sk).

Okay, enough said, let's get on with it.

----------- Getting In -----------

I'm going to explain two ways of breaking into a Windows box that has file

sharing enabled. Just to see how unsafe Windows is, the programs you'll need

come with Windows. isn't that ironic? Okay, of course they come with Windows!

Would you actually expect Microsoft to release an OS that supports sharing

without the tools to access shares?

Now, of course, you can hack file and print sharing through Unix as well.

We'll get to that in the end. Right now we're dealing with Windows here.

Both ways will have equal starts but then in one of the ways you'll keep

typing commands, and in the other way you'll use a GUI (for the ppl who

don't know GUI stands for Graphical User Interface) software. The programs

that you need are called Nbtstat.exe and Net.exe you can find it in the