13 - Análise On-Line Windows
Autor: Andre River | Publicado: 2011-10-13T15:35:00-03:00




Neste poste estão os procedimentos utilizados pra realizar a análise online. Esta analise foi realizada com os software openVAS e Greenbone.

Ambos os softwares mencionados estão disponíveis na distribuição backtrack. O processo de de configuração e um pouco demorado mas não apresentou maiores problemas.



Nesta imagem apresentado está o menu para acesso ao openvas siga de cima para baixo, e depois execute a opção check, caso seja mostrado que a configuração está correta pode iniciar os scans.














Na tela abaixo segue a tela obtida após o scan executado no honeypot.





Abaixo o relatório&nbsp;extraído pelo openvas:


I Summary
=========

This document reports on the results of an automatic security scan.
The report first summarises the results found.
Then, for each host, the report describes every issue found.
Please consider the advice given in each description, in order to rectify
the issue.

Overrides are on. &nbsp;When a result has an override, this report uses the
threat of the override.

Notes are included in the report.

This report might not show details of all issues that were found.
It only lists hosts that produced issues.
Issues with the threat level "Low" are not shown.
Issues with the threat level "Log" are not shown.
Issues with the threat level "Debug" are not shown.
Issues with the threat level "False Positive" are not shown.

This report contains all 2 results selected by the
filtering described above. &nbsp;Before filtering there were 28 results.

Scan started: Mon Nov &nbsp;7 22:02:46 2011
Scan ended: &nbsp; Mon Nov &nbsp;7 22:10:03 2011

Host Summary
************

Host &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;High &nbsp;Medium &nbsp;Low &nbsp;Log &nbsp;False Positive
192.168.100.10 &nbsp; &nbsp; 1 &nbsp; &nbsp; &nbsp; 1 &nbsp; &nbsp;0 &nbsp; &nbsp;0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0
Total: 1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1 &nbsp; &nbsp; &nbsp; 1 &nbsp; &nbsp;0 &nbsp; &nbsp;0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0


II Results per Host
===================

Host 192.168.100.10
*******************

Scanning of this host started at: Mon Nov &nbsp;7 22:02:47 2011
Number of results: 2

Port Summary for Host 192.168.100.10
------------------------------------

Service (Port) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Threat Level
microsoft-ds (445/tcp) &nbsp;High
netbios-ns (137/udp) &nbsp; &nbsp;Medium

Security Issues for Host 192.168.100.10
---------------------------------------

Issue
-----
NVT: &nbsp; &nbsp;Microsoft Windows SMB Server NTLM Multiple Vulnerabilities (971468)
OID: &nbsp; &nbsp;1.3.6.1.4.1.25623.1.0.902269
Threat: High (CVSS: 10.0)
Port: &nbsp; microsoft-ds (445/tcp)

Description:
&nbsp; Overview: This host has critical security update missing according to
&nbsp; Microsoft Bulletin MS10-012.
&nbsp; Vulnerability Insight:
&nbsp; - An input validation error exists while processing SMB requests and can
&nbsp; &nbsp; be exploited to cause a buffer overflow via a specially crafted SMB packet.
&nbsp; - An error exists in the SMB implementation while parsing SMB packets during
&nbsp; &nbsp; the Negotiate phase causing memory corruption via a specially crafted SMB
&nbsp; &nbsp; packet.
&nbsp; - NULL pointer dereference error exists in SMB while verifying the 'share'
&nbsp; &nbsp; and 'servername' fields in SMB packets causing denial of service.
&nbsp; - A lack of cryptographic entropy when the SMB server generates challenges
&nbsp; &nbsp; during SMB NTLM authentication and can be exploited to bypass the
&nbsp; &nbsp; authentication mechanism.
&nbsp; Impact:
&nbsp; Successful exploitation will let the remote attackers to execute arbitrary
&nbsp; code or cause a denial of service or bypass the authentication mechanism
&nbsp; via brute force technique.
&nbsp; Impact Level: System/Application
&nbsp; Affected Software/OS:
&nbsp; Microsoft Windows 7
&nbsp; Microsoft Windows 2000 Service Pack and prior
&nbsp; Microsoft Windows XP Service Pack 3 and prior
&nbsp; Microsoft Windows Vista Service Pack 2 and prior
&nbsp; Microsoft Windows Server 2003 Service Pack 2 and prior
&nbsp; Microsoft Windows Server 2008 Service Pack 2 and prior
&nbsp; Fix:
&nbsp; Run Windows Update and update the listed hotfixes or download and
&nbsp; update mentioned hotfixes in the advisory from the below link,
&nbsp; http://www.microsoft.com/technet/security/bulletin/ms10-012.mspx
&nbsp; References:
&nbsp; http://secunia.com/advisories/38510/
&nbsp; http://support.microsoft.com/kb/971468
&nbsp; http://www.vupen.com/english/advisories/2010/0345
&nbsp; http://www.microsoft.com/technet/security/bulletin/ms10-012.mspx
CVE : CVE-2010-0020, CVE-2010-0021, CVE-2010-0022, CVE-2010-0231


Issue
-----
NVT: &nbsp; &nbsp;Using NetBIOS to retrieve information from a Windows host
OID: &nbsp; &nbsp;1.3.6.1.4.1.25623.1.0.10150
Threat: Medium
Port: &nbsp; netbios-ns (137/udp)

Description:
The following 4 NetBIOS names have been gathered :
&nbsp;WSRV &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;= This is the computer name registered for workstation services!
&nbsp;by a WINS client.
&nbsp;ABS &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = Workgroup / Domain name
&nbsp;WSRV &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;= Computer name
&nbsp;ABS &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = Workgroup / Domain name (part of the Browser elections)
The remote host has the following MAC address on its adapter :
&nbsp; &nbsp;00:0c:29:9a:20:3b
If you do not want to allow everyone to find the NetBios name
of your computer, you should filter incoming traffic to this port.
Risk factor : Medium
CVE : CVE-1999-0621


Esta tela apresenta o resultado do comando nmap utilizado para verificar possíveis portas abertas. Esta portas podem indicar um conexão disponível implementada pelo invasor.






Um forma fácil e rápida de verificar usuários no sistemas windows é em Gerenciamento do computador Users.