Posts

Showing posts from July, 2012

Access Based Enumeration in Windows Server 2008

Image
ABE filters shared folders visible to a user based on that individual user’s access rights, preventing the display of folders or other shared resources that the user does not have rights to access.   End users see only what files and folders they need for their responsibilities rather than spending time looking through lists of inaccessible folders and files. Administrators can be more productive because they do not have to help less-skilled users navigate through dense shared folders. Administrative inefficiencies can consume resources as surely as technical problems, and minimizing time-consuming problems help make any IT organization more productive.   ABE was introduced in Windows Server 2003 SP1 as an additional install, once installed you could manage ABE through a GUI, cmd-line tool or using the API's. we  have ABE in Windows Server 2008 and we have a GUI where you can enable this. Let me explain to you how you do it: 1. Open the "S...

DNS Changer Malware

Image
It has been observed that a malware called as DNS Changer Trojan which changes the DNS server entries in the computer systems and ADSL /VoIP router (home gateway devices) is widely propagating. The malware initially infects the Windows or Apple computers and subsequently gain access to routers connected to those systems to exploit weakness like default factory configurations, easily guessable passwords etc. Once exploited or accessed, changes the DNS settings in the said computers and devices and make them point to rouge foreign DNS servers. In a typical attack scenario, the unwitting users are enticed to download malware (similar to Trojan:BAT/Dnschanger.B ) which subsequently, tampers the Windows network settings (entry of DNS in the host file, adding a proxy in the browser settings) in the host computer and scans for the connected DSL devices and tries to login directly to the Admin interface to change the DNS settings in the routers.  By achieving this,...

How to Disconnect shared drives through Command Prompt

 Imagine that you browse through and connect to a share, entering your username and password to gain access. The problem is that you stay connected, and there’s no visible way to disconnect yourself. If you try and shut down the other PC, you’ll receive a message that users are still connected. So let’s disconnect! Open up a command prompt, and then type in the following: net use This will give you a list of the connected drives, including the ones that aren’t actually mapped to a drive letter. To disconnect one of the connections, you can use the following command: net use /delete \\server\sharename For example, in this instance we’d disconnect like so: net use /delete \\192.168.10.100\root$ Now when you run the “net use” command again, you’ll see that you’ve been properly disconnected. If you wanted to actually connect to a share without mapping a drive letter, you can do the following: net use /user:Username \\server\sharename Password You could then just ...