2KKUU7ita

Chapter 11: Windows
Windows XP SP2 and later versions, as well as Windows Server 2003 SP1 and
later versions, have a new “undocumented feature” that can (and will)
severely limit your network scanning speeds: Only ten half-open TCP connections
can be made at a time. If you think your system might be affected by this,
check out the Event ID 4226 Patcher tool (www.lvllord.de) for a hack to run
on the Windows TCP/IP stack that will allow you to adjust the TCP half-open
connections setting to a more realistic number. The default is to change it to
50, which seems to work well.
Be forewarned that Microsoft doesn’t support this hack. Having said that, I
haven’t had any trouble with this hack at all. Disabling the Windows Firewall
(or other third-party firewall) can help speed things up, too. If possible, test
on a dedicated system or virtual machine, because doing so minimizes any
impact your test results may have on the other work you do on your computer.
Gathering Information about Your
Windows Vulnerabilities
When you assess Windows vulnerabilities, start by scanning your computers
to see what the bad guys can see.
The exploits in this chapter were run against Windows from inside a firewall.
Unless I point out otherwise, all the tests in this chapter can be run against all
versions of the Windows OS. The attacks in this chapter are significant enough
to warrant testing for, regardless of your current setup. Your results might
vary from mine depending on the specific version of Windows, patch levels,
and other system hardening you’ve done.
System scanning
A few straightforward processes can identify weaknesses in Windows systems.
Testing
Start gathering information about your Windows systems by running an initial
port scan:
1. Run basic scans to find which ports are open on each Windows system:
Scan for TCP ports with a port scanning tool, such as NetScanTools Pro.
The NetScanTools Pro results in Figure 11-1 show several potentially
vulnerable ports open on a Windows 7 system, including those for DNS
(UDP port 53); the ever-popular — and easily hacked — NetBIOS (port
139); and SQL Server (UDP 1434).
203