Greetings, There is other consideration like AD authentication, delegated settings in AD for computer systems, currently logged on user and of course the option for sniffing the network for picking up other password which may prove valuable in compromising other systems.
Don't need win.ini and autoexec.bat when you could put stuff in the startup folder. Enabling IPSsec (built in to W2K) could prevent the sniffing and regular refresh of the server policies would deter the access to system. I say if the server compromised was the ROOT Certificate server, THAT WOULD MAKE THE DAY. Cheers Gill -----Original Message----- From: Cheryl Goh [mailto:[EMAIL PROTECTED]] Sent: Friday, June 21, 2002 5:37 PM To: Sumit Dhar Cc: [EMAIL PROTECTED] Subject: Re: Network Security Related Query Hi Sumit, This would depend on what you have read/write access to. For example if let's say I had read/write access to a non-system folder in the c drive, the best that I could hope to do is perhaps upload a trojan or some remote control app, renaming it to something less obvious. I will not be able to execute anything. If somehow I have access to the win.ini or autoexec.bat files I could load in an entry to automatically execute my prog when the pc is rebooted. The fact that a remote user across the internet has access to another company's windows shares means that ports 135-139 are not filtered at the firewall or border router. If this is the case there are a lot of things that can be done to fully compromise the system. This would depend on the state of the windows machine as in whether it has been securely configured. Since the ports 135-139 are not blocked, it is highly unlikely that the windows box is secure due to the fact that if the admin can actually let these ports through then he/she obviously is not very aware of the implications. All in all to answer your question, system compromise is possible depending on the circumstances. e.g what folders are shared, how the windows boxes are configured, whether they are PDC's or user desktops. There isn't quite a simple yes or no but a very likely chance of system compromise. Cheryl Goh ----- Original Message ----- From: "Sumit Dhar" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, June 19, 2002 11:25 AM Subject: Network Security Related Query > Hello All, > > I was wondering... If I have read/write access to a windows machine on > some company's network, could I compromise the entire network's security > in some way because of this access?? > > Sumit Dhar [http://dhar.homelinux.com/dhar/] > Manager [Research and Product Development] > SLMsoft.com > > -- > pub 1024D/12F93276 2002-05-23 Sumit Dhar <[EMAIL PROTECTED]> > Key fingerprint = EC26 546C 53D1 A549 6763 AB29 310C 6462 12F9 3276 > > >
