November 2019

S M T W T F S
      12
34 5 678 9
10111213141516
17181920212223
24252627282930

Navigation

Style Credit

Expand Cut Tags

No cut tags

Маленькие хитрости для начинающих хакеров

dil: (Default)
[personal profile] dil
Saturday, March 17th, 2007 10:03 am
и продолжающих системных администраторов.

Знаете ли вы, что в windows snmp-агент с настройками по умолчанию умеет выдавать много разной интересной информации?
Настолько много, что потенциальному взломщику больше, в общем-то, и собирать даже ничего не придется - оно все само скажет.


Ну, версию системы и имя машины (OID 1.3.6.1.2.1.1.1) это все выдают, тут особого ума не нужно

Сетевые интерфейсы вместе с названиями, настройками, мак-адресами и прочей статистикой (OID 1.3.6.1.2.1.2)

Таблицу маршрутизации и текущее состояние всех сокетов (очень удобно для спуфинга)

Но вдобавок еще и список созданных на машине пользователей (OID 1.3.6.1.4.1.77.1.2.25.1.1)

Список запущенных программ (OID 1.3.6.1.2.1.25.4.2.1.2) и сервисов (OID 1.3.6.1.4.1.77.1.2.3.1.1)

Расшаренные ресурсы (OID 1.3.6.1.4.1.77.1.2.27.1.1)

И (фанфары!) список установленного софта (OID 1.3.6.1.2.1.25.6.3.1.2).

Наглядный пример (не полный, только для иллюстрации) от одного долбившегося ко мне дятла:

SNMPv2-MIB::sysDescr.0 = STRING: Hardware: x86 Family 15 Model 2 Stepping 9 AT/AT COMPATIBLE - Software: Windows 2000 Version 5.1 (Build 2600 Uniprocessor Free)
SNMPv2-MIB::sysObjectID.0 = OID: SNMPv2-SMI::enterprises.311.1.1.3.1.1
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (507310) 1:24:33.10
SNMPv2-MIB::sysName.0 = STRING: DECLAN-ZUPPL8EK
SNMPv2-MIB::sysServices.0 = INTEGER: 76

IF-MIB::ifNumber.0 = INTEGER: 2
IF-MIB::ifIndex.1 = INTEGER: 1
IF-MIB::ifIndex.65539 = INTEGER: 65539
IF-MIB::ifDescr.1 = STRING: MS TCP Loopback interface
IF-MIB::ifDescr.65539 = STRING: Broadcom 440x 10/100 Integrated Controller
IF-MIB::ifType.1 = INTEGER: softwareLoopback(24)
IF-MIB::ifType.65539 = INTEGER: ethernetCsmacd(6)
IF-MIB::ifMtu.1 = INTEGER: 1520
IF-MIB::ifMtu.65539 = INTEGER: 1500
IF-MIB::ifSpeed.1 = Gauge32: 10000000
IF-MIB::ifSpeed.65539 = Gauge32: 100000000
IF-MIB::ifPhysAddress.1 = STRING:
IF-MIB::ifPhysAddress.65539 = STRING: 0:f:1f:57:60:19

SNMPv2-SMI::enterprises.77.1.2.25.1.1.5.71.117.101.115.116 = STRING: "Guest"
SNMPv2-SMI::enterprises.77.1.2.25.1.1.8.100.101.99.111.99.111.111.108 = STRING: "decocool"
SNMPv2-SMI::enterprises.77.1.2.25.1.1.13.65.100.109.105.110.105.115.116.114.97.116.111.114 = STRING: "Administrator"
SNMPv2-SMI::enterprises.77.1.2.25.1.1.13.72.101.108.112.65.115.115.105.115.116.97.110.116 = STRING: "HelpAssistant"
SNMPv2-SMI::enterprises.77.1.2.25.1.1.16.83.85.80.80.79.82.84.95.51.56.56.57.52.53.97.48 = STRING: "SUPPORT_388945a0"

HOST-RESOURCES-MIB::hrSWRunName.1 = STRING: "System Idle Process"
HOST-RESOURCES-MIB::hrSWRunName.4 = STRING: "System"
HOST-RESOURCES-MIB::hrSWRunName.140 = STRING: "snmp.exe"
HOST-RESOURCES-MIB::hrSWRunName.176 = STRING: "svchost.exe"
HOST-RESOURCES-MIB::hrSWRunName.208 = STRING: "wdfmgr.exe"
HOST-RESOURCES-MIB::hrSWRunName.280 = STRING: "Sygate.exe"
HOST-RESOURCES-MIB::hrSWRunName.372 = STRING: "vmmon322.exe"
HOST-RESOURCES-MIB::hrSWRunName.388 = STRING: "smss.exe"
HOST-RESOURCES-MIB::hrSWRunName.436 = STRING: "csrss.exe"
HOST-RESOURCES-MIB::hrSWRunName.460 = STRING: "winlogon.exe"
HOST-RESOURCES-MIB::hrSWRunName.484 = STRING: "outlook.exe"
HOST-RESOURCES-MIB::hrSWRunName.508 = STRING: "services.exe"
HOST-RESOURCES-MIB::hrSWRunName.520 = STRING: "lsass.exe"
HOST-RESOURCES-MIB::hrSWRunName.524 = STRING: "Update.exe"
HOST-RESOURCES-MIB::hrSWRunName.636 = STRING: "dlbkbmon.exe"
HOST-RESOURCES-MIB::hrSWRunName.640 = STRING: "smscrew.exe"
HOST-RESOURCES-MIB::hrSWRunName.684 = STRING: "hkcmd.exe"
HOST-RESOURCES-MIB::hrSWRunName.692 = STRING: "svchost.exe"
HOST-RESOURCES-MIB::hrSWRunName.1132 = STRING: "ccSetMgr.exe"
HOST-RESOURCES-MIB::hrSWRunName.1156 = STRING: "ccEvtMgr.exe"
HOST-RESOURCES-MIB::hrSWRunName.1232 = STRING: "ccProxy.exe"
HOST-RESOURCES-MIB::hrSWRunName.1580 = STRING: "explorer.exe"
HOST-RESOURCES-MIB::hrSWRunName.3088 = STRING: "iTunesHelper.exe"
HOST-RESOURCES-MIB::hrSWRunName.3300 = STRING: "acroup32.exe"
HOST-RESOURCES-MIB::hrSWRunName.3480 = STRING: "iPodService.exe"
HOST-RESOURCES-MIB::hrSWRunName.3656 = STRING: "msmsgs.exe"

SNMPv2-SMI::enterprises.77.1.2.3.1.1.6.83.101.114.118.101.114 = STRING: "Server"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.6.84.104.101.109.101.115 = STRING: "Themes"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.9.69.118.101.110.116.32.76.111.103 = STRING: "Event Log"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.9.83.65.80.32.65.103.101.110.116 = STRING: "SAP Agent"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.9.84.101.108.101.112.104.111.110.121 = STRING: "Telephony"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.9.87.101.98.67.108.105.101.110.116 = STRING: "WebClient"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.10.68.78.83.32.67.108.105.101.110.116 = STRING: "DNS Client"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.11.68.72.67.80.32.67.108.105.101.110.116 = STRING: "DHCP Client"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.11.87.111.114.107.115.116.97.116.105.111.110 = STRING: "Workstation"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.12.82.73.80.32.76.105.115.116.101.110.101.114 = STRING: "RIP Listener"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.12.83.78.77.80.32.83.101.114.118.105.99.101 = STRING: "SNMP Service"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.12.87.105.110.100.111.119.115.32.84.105.109.101 = STRING: "Windows Time"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.12.105.80.111.100.32.83.101.114.118.105.99.101 = STRING: "iPod Service"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.13.76.101.120.66.99.101.32.83.101.114.118.101.114 = STRING: "LexBce Server"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.13.80.108.117.103.32.97.110.100.32.80.108.97.121 = STRING: "Plug and Play"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.13.80.114.105.110.116.32.83.112.111.111.108.101.114 = STRING: "Print Spooler"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.13.87.105.110.100.111.119.115.32.65.117.100.105.111 = STRING: "Windows Audio"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.14.73.80.83.69.67.32.83.101.114.118.105.99.101.115 = STRING: "IPSEC Services"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.14.84.97.115.107.32.83.99.104.101.100.117.108.101.114 = STRING: "Task Scheduler"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.15.83.101.99.111.110.100.97.114.121.32.76.111.103.111.110 = STRING: "Secondary Logon"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.16.67.111.109.112.117.116.101.114.32.66.114.111.119.115.101.114 = STRING: "Computer Browser"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.16.72.101.108.112.32.97.110.100.32.83.117.112.112.111.114.116 = STRING: "Help and Support"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.16.73.110.100.101.120.105.110.103.32.83.101.114.118.105.99.101 = STRING: "Indexing Service"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.16.83.121.109.97.110.116.101.99.32.67.111.114.101.32.76.67 = STRING: "Symantec Core LC"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.17.67.79.77.43.32.69.118.101.110.116.32.83.121.115.116.101.109 = STRING: "COM+ Event System"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.17.80.114.111.116.101.99.116.101.100.32.83.116.111.114.97.103.101 = STRING: "Protected Storage"
SNMPv2-SMI::enterprises.77.1.2.3.1.1.17.84.101.114.109.105.110.97.108.32.83.101.114.118.105.99.101.115 = STRING: "Terminal Services"
SNMPv2-SMI::enterprises.77.1.2.27.1.1.10.83.104.97.114.101.100.68.111.99.115 = STRING: "SharedDocs"

HOST-RESOURCES-MIB::hrSWInstalledName.1 = STRING: "Ad-Aware SE Personal"
HOST-RESOURCES-MIB::hrSWInstalledName.2 = STRING: "Adobe Shockwave Player"
HOST-RESOURCES-MIB::hrSWInstalledName.3 = STRING: "Adobe Download Manager 2.0 (Remove Only)"
HOST-RESOURCES-MIB::hrSWInstalledName.4 = STRING: "BitLord 1.1"
HOST-RESOURCES-MIB::hrSWInstalledName.5 = STRING: "Dell AIO Printer A920"
HOST-RESOURCES-MIB::hrSWInstalledName.6 = STRING: "DeluxeCommunications"
HOST-RESOURCES-MIB::hrSWInstalledName.7 = STRING: "DivX Content Uploader"
HOST-RESOURCES-MIB::hrSWInstalledName.8 = STRING: "Google Video Player"
HOST-RESOURCES-MIB::hrSWInstalledName.9 = STRING: "Broadcom 440x 10/100 Integrated Controller"
HOST-RESOURCES-MIB::hrSWInstalledName.10 = STRING: "Intel(R) 537EP V9x DF PCI Modem"
HOST-RESOURCES-MIB::hrSWInstalledName.11 = STRING: "Internet Explorer Security Plugin 2006"
HOST-RESOURCES-MIB::hrSWInstalledName.12 = STRING: "Internet Security Add-On"
HOST-RESOURCES-MIB::hrSWInstalledName.13 = STRING: "IpWins"
HOST-RESOURCES-MIB::hrSWInstalledName.14 = STRING: "Windows Installer 3.1 (KB893803)"
HOST-RESOURCES-MIB::hrSWInstalledName.15 = STRING: "Windows Installer 3.1 (KB893803)"
HOST-RESOURCES-MIB::hrSWInstalledName.16 = STRING: "MediaGateway"
HOST-RESOURCES-MIB::hrSWInstalledName.17 = STRING: "Microsoft .NET Framework (English) v1.0.3705"
HOST-RESOURCES-MIB::hrSWInstalledName.18 = STRING: "mIRC"
HOST-RESOURCES-MIB::hrSWInstalledName.19 = STRING: "Mozilla Firefox (2.0.0.2)"
HOST-RESOURCES-MIB::hrSWInstalledName.20 = STRING: "MSN Music Assistant"
HOST-RESOURCES-MIB::hrSWInstalledName.21 = STRING: "Nero PhotoShow Express"
HOST-RESOURCES-MIB::hrSWInstalledName.22 = STRING: "Nero Suite"
HOST-RESOURCES-MIB::hrSWInstalledName.23 = STRING: "Outerinfo"
HOST-RESOURCES-MIB::hrSWInstalledName.24 = STRING: "Public Messenger ver 2.03"
HOST-RESOURCES-MIB::hrSWInstalledName.25 = STRING: "RealPlayer"
HOST-RESOURCES-MIB::hrSWInstalledName.26 = STRING: "Adobe Flash Player 9 ActiveX"
HOST-RESOURCES-MIB::hrSWInstalledName.27 = STRING: "Spybot - Search & Destroy 1.4"
HOST-RESOURCES-MIB::hrSWInstalledName.28 = STRING: "Norton Internet Security 2006 (Symantec Corporation)"
HOST-RESOURCES-MIB::hrSWInstalledName.29 = STRING: "Windows Media Format Runtime"
HOST-RESOURCES-MIB::hrSWInstalledName.30 = STRING: "XviD 1.1 final uninstall"
HOST-RESOURCES-MIB::hrSWInstalledName.31 = STRING: "OIN"
HOST-RESOURCES-MIB::hrSWInstalledName.32 = STRING: "LightScribe 1.4.31.1"
HOST-RESOURCES-MIB::hrSWInstalledName.33 = STRING: "ccCommon"
HOST-RESOURCES-MIB::hrSWInstalledName.34 = STRING: "Norton Internet Security"
HOST-RESOURCES-MIB::hrSWInstalledName.35 = STRING: "AutoUpdate"
HOST-RESOURCES-MIB::hrSWInstalledName.36 = STRING: "SymNet"
HOST-RESOURCES-MIB::hrSWInstalledName.37 = STRING: "CC_ccProxyExt"
HOST-RESOURCES-MIB::hrSWInstalledName.38 = STRING: "ccPxyCore"
HOST-RESOURCES-MIB::hrSWInstalledName.39 = STRING: "WebFldrs XP"
HOST-RESOURCES-MIB::hrSWInstalledName.40 = STRING: "Norton AntiSpam"
HOST-RESOURCES-MIB::hrSWInstalledName.41 = STRING: "Skype Plugin Manager"
HOST-RESOURCES-MIB::hrSWInstalledName.42 = STRING: "iTunes"
HOST-RESOURCES-MIB::hrSWInstalledName.43 = STRING: "Norton Internet Security"
HOST-RESOURCES-MIB::hrSWInstalledName.44 = STRING: "Adobe╝ Photoshop╝ Album Starter Edition 3.0"
HOST-RESOURCES-MIB::hrSWInstalledName.45 = STRING: "QuickTime"
HOST-RESOURCES-MIB::hrSWInstalledName.46 = STRING: "Broadcom 440x 10/100 Integrated Controller"
HOST-RESOURCES-MIB::hrSWInstalledName.47 = STRING: "Norton AntiSpam"
HOST-RESOURCES-MIB::hrSWInstalledName.48 = STRING: "SPBBC"
HOST-RESOURCES-MIB::hrSWInstalledName.49 = STRING: "DivX Codec"
HOST-RESOURCES-MIB::hrSWInstalledName.50 = STRING: "Norton Protection Center"
HOST-RESOURCES-MIB::hrSWInstalledName.51 = STRING: "Intel(R) Extreme Graphics Driver"
HOST-RESOURCES-MIB::hrSWInstalledName.52 = STRING: "DivX Player"
HOST-RESOURCES-MIB::hrSWInstalledName.53 = STRING: "Sonic RecordNow!"
HOST-RESOURCES-MIB::hrSWInstalledName.54 = STRING: "Norton Internet Security"
HOST-RESOURCES-MIB::hrSWInstalledName.55 = STRING: "Adobe Reader 7.0.8"
HOST-RESOURCES-MIB::hrSWInstalledName.56 = STRING: "DivX Converter"
HOST-RESOURCES-MIB::hrSWInstalledName.57 = STRING: "Microsoft .NET Framework (English)"
HOST-RESOURCES-MIB::hrSWInstalledName.58 = STRING: "DivX Web Player"
HOST-RESOURCES-MIB::hrSWInstalledName.59 = STRING: "MSRedist"
HOST-RESOURCES-MIB::hrSWInstalledName.60 = STRING: "Sony Ericsson PC Suite 1.20.173"
HOST-RESOURCES-MIB::hrSWInstalledName.61 = STRING: "ABBYY FineReader 5.0 Sprint"
HOST-RESOURCES-MIB::hrSWInstalledName.62 = STRING: "Dell ResourceCD"
HOST-RESOURCES-MIB::hrSWInstalledName.63 = STRING: "Norton Internet Security"
HOST-RESOURCES-MIB::hrSWInstalledName.64 = STRING: "Norton Internet Security"
HOST-RESOURCES-MIB::hrSWInstalledName.65 = STRING: "Norton WMI Update"
HOST-RESOURCES-MIB::hrSWInstalledName.66 = STRING: "SoundMAX"
HOST-RESOURCES-MIB::hrSWInstalledName.67 = STRING: "FaxTools"
HOST-RESOURCES-MIB::hrSWInstalledName.68 = STRING: "Norton WMI Update"


Community для чтения, как несложно догадаться, по умолчанию называется public.
Справедливости ради надо заметить, что по умолчанию snmp-агент выключен. А кто его включает, не подумавшки, тот сам себе злобный буратино.
Tags:

Reply

This account has disabled anonymous posting.
If you don't have an account you can create one now.
HTML doesn't work in the subject.
More info about formatting
 
Notice: This account is set to log the IP addresses of everyone who comments.
Links will be displayed as unclickable URLs to help prevent spam.