by wrting a custom msgina.dll file - google around and you will find it - pretty messy to write though unless u are a vc++ or asm programmer -aditya -----Original Message----- From: Harlan Carvey [mailto:keydet89at_private] Sent: Monday, July 14, 2003 1:29 AM To: incidentsat_private Subject: RE: possible compromised host Tim, Could you elaborate with regards to how the password verification for the Administrator account could be bypassed? Thanks, Harlan --- Tim Harris <timharat_private> wrote: > Do they actually exist as separate accounts > (unlikely) or has password > checking for this account somehow been bypassed > (more likely)? > > You might also want to try some other accounts to > see if perhaps password > checking has been globally disabled. > > -----Original Message----- > From: LiNERROR [mailto:linerrorat_private] > Sent: Thursday, July 10, 2003 11:57 PM > To: incidentsat_private > Subject: possible compromised host > > > open running an audit on one of my networks Retina > discovered a system with > what appeared to be multiple administrator accounts. > snip --- > Accounts: User: Administrator Pass: rotartsinimdA - > Account password > reverse of account > Accounts: User: Administrator Pass: Administrator - > Account password same > as account > Accounts: User: Administrator Pass: - Account with > no password > snip --- > However the system shows no evidence of these > accounts in the user > manager... BUT they EXIST! > i can connect to the system using my specified > Account and password... AND > the three above. > > I've never seen this before and was wondering if > anyone knew anything than > might help me figureout how badly this system has > been compromised... > > > > ---------------------------------------------------------------------------- > Attend the Black Hat Briefings & Training, July 28 - > 31 in Las Vegas, the > world's premier technical IT security event! 10 > tracks, 15 training > sessions, > 1,800 delegates from 30 nations including all of the > top experts, from CSO's > to > "underground" security specialists. See for > yourself what the buzz is > about! > Early-bird registration ends July 3. This event > will sell out. > www.blackhat.com > ---------------------------------------------------------------------------- > > > ---------------------------------------------------------------------------- > Attend the Black Hat Briefings & Training, July 28 - > 31 in Las Vegas, the > world's premier technical IT security event! 10 > tracks, 15 training sessions, > 1,800 delegates from 30 nations including all of the > top experts, from CSO's to > "underground" security specialists. See for > yourself what the buzz is about! > Early-bird registration ends July 3. This event > will sell out. www.blackhat.com > ---------------------------------------------------------------------------- > __________________________________ Do you Yahoo!? SBC Yahoo! DSL - Now only $29.95 per month! http://sbc.yahoo.com ---------------------------------------------------------------------------- Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the world's premier technical IT security event! 10 tracks, 15 training sessions, 1,800 delegates from 30 nations including all of the top experts, from CSO's to "underground" security specialists. See for yourself what the buzz is about! Early-bird registration ends July 3. This event will sell out. www.blackhat.com ---------------------------------------------------------------------------- ________________________________________________________________________ Delivered using the Free Personal Edition of Mailtraq (www.mailtraq.com) ---------------------------------------------------------------------------- Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the world's premier technical IT security event! 10 tracks, 15 training sessions, 1,800 delegates from 30 nations including all of the top experts, from CSO's to "underground" security specialists. See for yourself what the buzz is about! Early-bird registration ends July 3. This event will sell out. www.blackhat.com ----------------------------------------------------------------------------
This archive was generated by hypermail 2b30 : Tue Jul 15 2003 - 10:59:08 PDT