2KKUU7ita

210
Part IV: Hacking Operating Systems
Figure 11-7:
net view
displays
drive shares
on a remote
Windows
host.
Gleaning information
With a null session connection, you can use other utilities to gather critical
Windows information remotely. Dozens of tools can gather this type of
information.
You — like a hacker — can take the output of these enumeration programs
and attempt (as an unauthorized user) to
✓ Crack the passwords of the users found. (See Chapter 7 for more on
password cracking.)
✓ Map drives to the network shares.
You can use the following applications for system enumeration against server
versions of Windows prior to Server 2003 as well as Windows XP.
net view
The net view command (see Figure 11-7) shows shares that the Windows
host has available. You can use the output of this program to see information
that the server is advertising to the world and what can be done with it,
including the following:
✓ Share information that a hacker can use to attack your systems, such as
mapping drives and cracking share passwords.
✓ Share permissions that might need to be removed, such as the permission
for the Everyone group, to at least see the share on older Windows
2000–based systems.
Configuration and user information
Winfo (www.ntsecurity.nu/toolbox/winfo) and DumpSec (www.system
tools.com/somarsoft/index.html) can gather useful information about
users and configurations, such as
✓ Windows domain to which the system belongs
✓ Security policy settings