full-disclosure - [lists] Terminal Server vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <9E97F0997FB84D42B221B9FB203EFA277B5890@dc1ms2.msad.brookshires.net>
From: toddtowles at brookshires.com (Todd Towles)
Subject: [lists] Terminal Server vulnerabilities

I agree, renamed the Admin account and create a fake Admin account, put
very good logging on it. Because any attempts on this account would be
attacks.

> -----Original Message-----
> From: full-disclosure-bounces@...ts.netsys.com 
> [mailto:full-disclosure-bounces@...ts.netsys.com] On Behalf 
> Of Steve Tornio
> Sent: Tuesday, January 25, 2005 3:29 PM
> To: full-disclosure@...ts.netsys.com
> Subject: Re: [lists] [Full-Disclosure] Terminal Server vulnerabilities
> 
> 
> On Jan 25, 2005, at 2:38 PM, Curt Purdy wrote:
> 
> > Daniel Sichel wrote:
> > <snip>
> >> Naturally  I
> >> don't like this answer because of horror stories I have 
> heard about 
> >> Terminal server. They claim there are no unfixed 
> vulnerabilities to 
> >> Terminal Server on Windows Server 2000 Service Pack 4.
> >
> > The problem with terminal server is not any vulnerablities 
> that can be 
> > exploited, but the fact that administrator can be bruteforced (6 
> > attempts followed by reconnect) and that it is screaming 
> its existence 
> > on port 3889.
> > If you use it, definitely change the port in the registry.
> 
> Of course, one of the very first things you should do on a 
> Windows box is rename the administrator account, so this kind 
> of blind brute-forcing is not possible.
> 
> Also, the problem you describe can be exacerbated in that 
> administrator can be brute-forced without creating a log 
> entry, by attempting 5 logons and disconnecting before 
> Windows disconnects and logs after the sixth failure.  This 
> was covered in a talk at Black Hat 2003, when Ryan Russell 
> and Tim Mullens released TSGrinder.  I don't know if they 
> continued work on it.
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>