2KKUU7ita

Figure 11-6:
Mapping
a null session
to a
vulnerable
Windows
system.
Chapter 11: Windows
Although later versions of Windows are much more secure than their predecessors,
don’t assume that all’s well in Windows-land. I can’t tell you how
many times I see supposedly secure Windows installations “tweaked” to
accommodate an application or other business need that happens to facilitate
exploitation.
Mapping
Follow these steps for each Windows computer to which you want to map a
null session:
1. Format the basic net command, like this:
net use \\host_name_or_IP_address\ipc$ “” “/user:”
The net command to map null sessions requires these parameters:
• net (the built-in Windows network command) followed by the use
command
• The IP address or hostname of the system to which you want to
map a null connection
• A blank password and username
The blanks are why it’s called a null connection.
2. Press Enter to make the connection.
Figure 11-6 shows an example of the complete command when mapping
a null session. After you map the null session, you should see the message
The command completed successfully.
To confirm that the sessions are mapped, enter this command at the command
prompt:
net use
As shown in Figure 11-6, you should see the mappings to the IPC$ share on
each computer to which you’re connected.
209