If users are using pserver mechanism, CVS password is usually kept in using an insecure reverseble-encryption algo. This password can be retrived if you can get a copy of .cvspass file from any of the users. Usually in NFS environment, I've noticed that its easy to get to this info. But if you are using WinCVS you can probably retrieve it from the desktop too. I'd also try to enumerate userlist by other mechanims first. NIS/NISPLUS and ldap if used would be very easy to enumerate depending on how its setup. rkt -----Original Message----- From: Bugsy [mailto:bugsy9999at_private] Sent: Sunday, May 18, 2003 7:17 AM To: pen-testat_private Subject: Pen testing a CVS server Hi, Im pentesting a server, which is running CVSpserver. I have gone through the CVS documentation and read other posts on securityfocus mailing lists. I am listing below what I have done so far, and would like to know if there is anything else that can be done with this. First, trying to login to the pserver with the command: cvs -d :pserver:rootat_private:/wrong/cvs/root login yields the information, of whether the repository is correct or not. Enumerating this, I have found the correct repository. Enumerating usernames: cvs -d :pserver:luserat_private:/wrong/cvs/root login Tells me whether luser exists on the server or not. I get luser: no such user if its a non-existent username. Checking passwords cvs -d :pserver:rootat_private:/wrong/cvs/root login Tells me if i got the root password right or not. Is there anything else that can be done. More specifically, is there some way to find out the version of the CVS server, without being able to login. Also, now that CVS server is that popular, shouldn't they build in basic security measures such as giving the same failure message whether the username, password or repository is wrong? -Bugsy __________________________________ Do you Yahoo!? The New Yahoo! Search - Faster. Easier. Bingo. http://search.yahoo.com --------------------------------------------------------------------------- *** Wireless LAN Policies for Security & Management - NEW White Paper *** Just like wired networks, wireless LANs require network security policies that are enforced to protect WLANs from known vulnerabilities and threats. Learn to design, implement and enforce WLAN security policies to lockdown enterprise WLANs. To get your FREE white paper visit us at: http://www.securityfocus.com/AirDefense-pen-test ---------------------------------------------------------------------------- ----+---- This email message (and any attached document) contains information from Ingenuity Systems Inc. which may be considered confidential by Ingenuity, or which may be privileged or otherwise exempt from disclosure under law, and is for the sole use of the individual or entity to whom it is addressed. Any other dissemination, distribution or copying of this message is strictly prohibited. If you receive this message in error, please notify me and destroy the attached message (and all attached documents) immediately. --------------------------------------------------------------------------- *** Wireless LAN Policies for Security & Management - NEW White Paper *** Just like wired networks, wireless LANs require network security policies that are enforced to protect WLANs from known vulnerabilities and threats. Learn to design, implement and enforce WLAN security policies to lockdown enterprise WLANs. To get your FREE white paper visit us at: http://www.securityfocus.com/AirDefense-pen-test ----------------------------------------------------------------------------
This archive was generated by hypermail 2b30 : Tue May 20 2003 - 08:56:40 PDT