Evaluate Weigh the pros and cons of technologies, products and projects you are considering.

Step 2: Use good information and good tools to get rolling

The multitude of processes and services on your servers are ripe for exploitation. This step-by-step guide from vulnerability testing expert Kevin Beaver provides specific steps for testing the security of your servers' configurations.

When it comes to finding and exploiting security vulnerabilities in Windows, you need two things. The first is knowledge of new security vulnerabilities issued via vendors' and researchers' bulletins. You can subscribe to numerous vulnerability lists including Microsoft's own Security Update Alerts as well as the VulnWatch Vulnerability Disclosure List. By knowing that certain Windows server-centric vulnerabilities exist, you'll know what to be on the lookout for.

Second, you need the right security tools to complement the knowledge factor. You cannot depend on them completely, but they do serve an important purpose in testing for vulnerabilities. Speaking of that, one interesting thing I'm finding of late is that many of the highly visible exploits integrated into tools such as Metasploit and CORE IMPACT often are not tested for by various freeware and commercial vulnerability scanners -- at least after the first several days of release. An example of this is the recent Windows Routing and Remote Access remote code execution vulnerability (MS06-025). Currently, it does not show up using several well-known vulnerability scanners but yet can be easily compromised using Metasploit as I'll demonstrate below.

This underscores the fact that up-to-date information is highly-beneficial and not all security tools are going to test for the latest and greatest exploits.

To start testing, you could look for a vulnerability as basic as a Windows null session. Figure 2 shows the results of a basic SuperScan null session scan of a Windows 2000 Server.

Figure 2

Notice that the enumeration was successful -- something that comes as a default "feature" in Windows 2000. Figure 3 shows how Qualys Inc.'s QualysGuard vulnerability scanner can root out missing patches and other issues from a server it knows nothing about otherwise.

Figure 3

Note the various issues with Windows server processes and services such as RPC and the TCP/IP stack -- a couple of which I find very often on even the most "currently patched" servers.

Hacking server processes and services

 Home: Introduction
 Step 1:  Home in on your target
 Step 2: Use good information and good tools to get rolling
 Step 3:  Drive your point home

Kevin Beaver (CISSP), is an information security consultant, expert witness, as well as a seminar leader and keynote speaker with Atlanta-based Principle Logic, LLC. Kevin can be reached at www.principlelogic.com.

Dig Deeper on Windows Server management

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.