HACKING LESSON 12

A Basic Approach - Attacking a Remote Computer

In this lesson we will try to explain the following topics------

1).Basic commands through which the hackers get into your system.

2).The necessary tools used for this purpose.

3).Some tips and tricks.

4).A little description about Trojans, etc…

We will also try to explain how to catch someone who is trying to get into your system…..

Let us first start with the commands…..

1).NETBIOS - NetBIOS (Network Basic Input/Output System) is a program that allows applications on different computers to communicate within a local area network (LAN).

NetBIOS provides two communication modes: session or datagram. Session mode lets two computers establish a connection for a "conversation," allows larger messages to be handled, and provides error detection and recovery. Datagram mode is "connectionless" (each message is sent independently), messages must be smaller, and the application is responsible for error detection and recovery.

2).NBTSTAT - Nbtstat is designed to help troubleshoot NetBIOS name resolution problems. When a network is functioning normally, NetBIOS over TCP/IP (NetBT) resolves NetBIOS names to IP addresses.

The nbtstat command removes and corrects preloaded entries using a number of case-sensitive switches. The nbtstat - a <name> command performs a NetBIOS adapter status command on the computer name specified by < name> . The adapter status command returns the local NetBIOS name table for that computer as well as the MAC address of the adapter card. The nbtstat -A < IP address > command performs the same function using a target IP address rather than a name.

3).NET VIEW - The NET VIEW command displays a list of computers in the specified workgroup, or shared resources available on the specified computer.

4).NET USE - Connects a computer to or disconnects a computer from a shared resource, or displays information about computer connections.

5).NETSTAT - Netstat provides statistics for the following:

• Proto - The name of the protocol ((TCP or UDP).

• Local Address - The IP address of the local computer and the port number being used. The name of the local computer that corresponds to the IP address and the name of the port is shown unless the -n parameter is specified. If the port is not yet established, the port number is shown as an asterisk (*).

• Foreign Address - The IP address and port number of the remote computer to which the socket is connected. The names that corresponds to the IP address and the port are shown unless the -n parameter is specified. If the port is not yet established, the port number is shown as an asterisk (*).

• State - Indicates the state of a TCP connection. The possible states are as follows: CLOSE_WAIT, CLOSED, ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, LAST_ACK, LISTEN, SYN_RECEIVED, SYN_SEND, and TIME_WAIT.

For all these commands you need to have the IP address of the target computer. Also, you can try all these commands on your own IP address.

Let’s see how NBTSTAT works---

Open command prompt and type NBTSTAT /?, this will show the help for using this command (Note: /? Applies for all other commands also)

If I have the ip address xxx.xxx.xx.x

nbtstat –A xxx.xxx.xx.x

This will give the NetBIOS Remote Machine Name Table.

In front of every name you will see some numbers written like this <20>, <03>….These numbers tells the status of the remote computer. <20> signifies that the target computer’s file and printer sharing is on.

Once we have this information the next step is to use the command net view……..

Net view \\xxx.xxx.xx.x

This will give the name of shared resources, like My Documents, Temp folder, etc…

The final command required now is Net Use. This command will connect you to the target computers shared resources i.e. my documents, temp folder, etc.

This process is called the NETBIOS attack.