HOW to detect ipc share? - HeapOverflow Computer Security Community & Forums : Heap Overflow.com

HeapOverflow Computer Security Community & Forums : Heap Overflow.com

		HeapOverflow Computer Security Community & Forums : Heap Overflow.com > Computer Security: Discussions > Hacking
HOW to detect ipc share?

Mark Forums Read

Notices

Welcome to you visitor! This community is mainly dedicated to the computer and security, if you're looking for DFind scanner or others exploits codes you will find them into the Projects section, feel free to start Blogging and remember to always keep an eye and start talking about security Advisories & public Exploits.

Hacking Discuss the art of hacking, your experiences, etc...

HOW to detect ipc share?

This is a discussion on "HOW to detect ipc share?" within the Hacking part of the Computer Security: Discussions section; Hi, i have seen that DFind is able to detecte ipc null session. But how do you manage to detect that? You scan the port 139 but after what? Do you have any doc on this subject or a sample ...

Reply

Page 1 of 2

1

#1 (permalink)

Old

29-07-05

frozon is offline

Junior Member

Join Date: Jul 2005

Posts: 2

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 5

frozon is on a distinguished road

Default

HOW to detect ipc share?

Hi,
i have seen that DFind is able to detecte ipc null session.
But how do you manage to detect that?
You scan the port 139 but after what?

Do you have any doc on this subject or a sample code please.

Thx

Reply With Quote

Sponsor

Advertiser

#2 (permalink)

Old

29-07-05

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 7 Times in 7 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

http://msdn.microsoft.com/library/defau ... ction2.asp

in DFind:

Code:

if (strcmp(vvv0,"-ipc")==0)
{
	ok2++;
	int rc;
	LPSTR hostipc[30];
	NETRESOURCE server2;
	shutdown(s,0);
	char *target = inet_ntoa(server.sin_addr);
	sprintf((char *)hostipc,"\\\\%s\\ipc$",target);
	server2.lpLocalName = NULL;
	server2.lpProvider = NULL;
	server2.dwType = RESOURCETYPE_ANY;
	server2.lpRemoteName=(char *)hostipc;
	rc = WNetAddConnection2(&server2, "", "", 0);
	if (rc != 0)
	{
		WNetCancelConnection2(server2.lpRemoteName, 0, TRUE);
		mthread--;closesocket(s);return nice;
	}
	ok++;
	fprintf(fplog,"%s:%d\n",inet_ntoa(server.sin_addr),ntohs(server.sin_port));fflush(fplog);
	if (bose==1){printf("%s:%d                    \n", inet_ntoa(server.sin_addr), ntohs(server.sin_port));}
	WNetCancelConnection2(server2.lpRemoteName, 0, TRUE);
	mthread--;closesocket(s);return nice0;
}

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

#3 (permalink)

Old

29-07-05

frozon is offline

Junior Member

Join Date: Jul 2005

Posts: 2

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 5

frozon is on a distinguished road

Default

thanks a lot man i'll give a loock

Reply With Quote

#4 (permalink)

Old

29-07-05

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 7 Times in 7 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

else you can still get all these sdk useful docs on a CD for free, then it depends with what are you coding on windows:

http://www.qmedia.ca/launch/psdk.htm

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

#5 (permalink)

Old

01-08-05

Divx_dude is offline

Junior Member

Join Date: Jul 2005

Posts: 5

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 6

Divx_dude is on a distinguished road

Default

what i'lm saying can be not right , but i think a netbios emuration tool can do the trick

Reply With Quote

#6 (permalink)

Old

02-08-05

class101 is offline

Administrator

Join Date: May 2005

Location: France

Age: 27

Posts: 592

Blog Entries: 3

Thanks: 18

Thanked 7 Times in 7 Posts

Rep Power: 10

class101 has disabled reputation

Send a message via MSN to class101

Default

he means for example how is coded this netbios enumeration tool and not requesting for a tool ...

__________________
Security community webmaster
100% Free Directory
100% Cool milw0rm javascript

Reply With Quote

#7 (permalink)

Old

04-08-05

Divx_dude is offline

Junior Member

Join Date: Jul 2005

Posts: 5

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 6

Divx_dude is on a distinguished road

Default

ok then i miss understood it

Reply With Quote

#8 (permalink)

Old

24-10-05

ziguywarez ziguywarez is offline

ziguywarez is offline

Junior Member

Join Date: Jun 2005

Posts: 2

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 5

ziguywarez is on a distinguished road

Default

thanks for the information

Reply With Quote

#9 (permalink)

Old

26-10-05

Yog-Sotho is offline

Member

Join Date: Jul 2005

Location: Italy

Posts: 62

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 17

Yog-Sotho is on a distinguished road

Default

Batch power strikes again!

Here's a quick link to a batch file which I found on the Net and which I revised lately. It should do the purpose of gathering infos on shared resources. Read the readmefile before using it. Make it better if you like and send me your copy for evaluation of your work. Tnx!

Peace

Yog

http://rapidshare.de/files/6787849/Sharefind.zip.html

PS
Class101 can you allow me to upload files, please? It would be faster and easier. I think you trust me... am I wrong? Tnx anyway.

Reply With Quote

#10 (permalink)

Old

27-10-05

Oxydrine is offline

Junior Member

Join Date: Oct 2005

Location: De l'autre coté

Posts: 14

Thanks: 0

Thanked 0 Times in 0 Posts

Rep Power: 7

Oxydrine is on a distinguished road

Default

simply 1 cmd on shell :

net share it gives sharing

like this :

Nom partage Ressource Remarque

---------------------------------------------------------
IPC$ IPC distant
D$ D:\ Partage par
print$ C:\WINDOWS\System32\spool\drivers
Pilotes d'im
ADMIN$ C:\WINDOWS Administrati
C$ C:\ Partage par
E$ E:\ Partage par
SharedDocs C:\DOCUMENTS AND SETTINGS\ALL USERS\DOCUMENT

Imprimante USB(Canon MPC190) Mis en f Canon MPC190
La commande s'est terminée correctement.

C:\Documents and Settings\Administrateur\Bureau>

Reply With Quote

Sponsor

Advertiser

Reply

Page 1 of 2

1

Tags
detect, ipc, share

« help | How to analysis a malformed office file? »

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is On HTML code is Off Trackbacks are On Pingbacks are On Refbacks are On

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
KML share 1.1 (region.php layer) Remote File Disclosure Vulnerability	Heap	Public	0	30-11-07 03:17

heapoverflow.com - SEOmeter SEO tools

Locations of visitors to this page

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72