2KKUU7ita

214
Part IV: Hacking Operating Systems
Checking Share Permissions
Windows shares are the available network drives that show up when users
browse the network in My Network Places. Windows shares are often misconfigured,
allowing more people to have access to them than they should. The
casual browser can exploit this security vulnerability, but a malicious insider
gaining unauthorized access to a Windows system can result in serious security
and compliance consequences, including the leakage of sensitive information
and even the corruption or deletion of critical files.
Windows defaults
The default share permission depends on the Windows system version.
Windows 2000/NT
When creating shares in Windows NT and Windows 2000, the group Everyone
is given Full Control access in the share by default for all files to
✓ Browse files
✓ Read files
✓ Write files
Anyone who maps to the IPC$ connection with a null session (as described
in the previous section, “Null Sessions”) is automatically made part of the
Everyone group. This means that remote hackers can automatically gain
Browse, Read, and Write access to a Windows NT or Windows 2000 server
after establishing a null session.
Windows XP and newer
In Windows XP and newer (Windows Server 2008 R2, Windows 7, and so on),
the Everyone group is given only Read access to shares. This is definitely an
improvement over the defaults in Windows 2000 and Windows NT. However,
you still might have situations in which you don’t want the Everyone group to
have Read access to a share.
Share permissions are different from file permissions. When creating shares,
you have to set both. In current versions of Windows, this helps create hoops
for casual users to jump through and discourage share creation, but it’s not
foolproof. Unless you have your Windows desktops completely locked down,
users can still share at will.