Ethical Hacker Community Forums

windows server 2k
PORT      STATE SERVICE            VERSION
7/tcp     open  echo
9/tcp     open  discard?
13/tcp    open  daytime            Microsoft Windows USA daytime
17/tcp    open  qotd               Windows qotd
19/tcp    open  chargen
21/tcp    open  tcpwrapped
25/tcp    open  smtp               Microsoft ESMTP 5.0.2195.6713
|  SMTP: Responded to EHLO command
|  ****** Hello [10.0.0.6]
|  AUTH GSSAPI NTLM LOGIN
|  AUTH=LOGIN
|  TURN
|  ATRN
|  SIZE 2097152
|  ETRN
|  PIPELINING
|  DSN
|  ENHANCEDSTATUSCODES
|  8bitmime
|  BINARYMIME
|  CHUNKING
|  VRFY
|  Responded to HELP command
|  This server supports the following commands:
|_ HELO EHLO STARTTLS RCPT DATA RSET MAIL QUIT HELP AUTH TURN ATRN ETRN BDAT VRFY
53/tcp    open  domain             Microsoft DNS
80/tcp    open  http               Microsoft IIS webserver 5.0
|_ HTML title:
135/tcp   open  msrpc              Microsoft Windows RPC
139/tcp   open  netbios-ssn
443/tcp   open  ssl                Microsoft IIS SSL
|  SSLv2: server still supports SSLv2
|     SSL2_RC4_128_WITH_MD5
|     SSL2_DES_192_EDE3_CBC_WITH_MD5
|     SSL2_RC2_CBC_128_CBC_WITH_MD5
|     SSL2_DES_64_CBC_WITH_MD5
|     SSL2_RC4_128_EXPORT40_WITH_MD5
|_    SSL2_RC2_CBC_128_CBC_WITH_MD5
445/tcp   open  microsoft-ds       Microsoft Windows 2000 microsoft-ds
1025/tcp  open  msrpc              Microsoft Windows RPC
1026/tcp  open  msrpc              Microsoft Windows RPC
1029/tcp  open  msrpc              Microsoft Windows RPC
3389/tcp  open  microsoft-rdp      Microsoft Terminal Service
6101/tcp  open  VeritasBackupExec?
6106/tcp  open  msrpc              Microsoft Windows RPC
10000/tcp open  backupexec         Veritas Backup Exec 9.0


Windows server 2003

PORT     STATE  SERVICE       VERSION
21/tcp   open   ftp?
25/tcp   open   smtp          Microsoft ESMTP 6.0.3790.3959
|  SMTP: Responded to EHLO command
|  **.*********.local Hello [10.0.0.15]
|  TURN
|  SIZE
|  ETRN
|  PIPELINING
|  DSN
|  ENHANCEDSTATUSCODES
|  8bitmime
|  BINARYMIME
|  CHUNKING
|  VRFY
|  X-EXPS GSSAPI NTLM LOGIN
|  X-EXPS=LOGIN
|  AUTH GSSAPI NTLM LOGIN
|  AUTH=LOGIN
|  X-LINK2STATE
|  XEXCH50
|  Responded to HELP command
|  This server supports the following commands:
|_ HELO EHLO STARTTLS RCPT DATA RSET MAIL QUIT HELP AUTH TURN ETRN BDAT VRFY
80/tcp   open   http          Microsoft IIS webserver 6.0
|_ HTML title: Site doesn't have a title.
443/tcp  closed https
1723/tcp open   pptp          Microsoft (Firmware: 3790)
3389/tcp open   microsoft-rdp Microsoft Terminal Service

Hi all, I am attempting to do some pen testing for the first time.

Care to elaborate? What are you testing? Your own system(s)?

A pretty standard thing to do after a port scan is a vulnerability scan. Try Nessus. You may want to look up some pen testing or ethical hacking methodologies before continuing. Search this forum for "methodology" to get a good start.

I would second BillV's questions and add another. Are these production servers? Even if you have full permission to test production servers, I would never touch them on my first ever attempt at a pen test. Try this out in a lab first. Try to mimic the OS, patch level and running services, etc. Then go through the methodology in your lab.

Hope this helps,
Don

Wow what a nice scan. You cant get in with that?

i'd be taking a look at the veritas services, no one ever updates that stuff :-P

i'd be taking a look at the veritas services, no one ever updates that stuff :-P

10000/tcp open  backupexec         Veritas Backup Exec 9.0

ok, i always thought that that was how people got into systems. well exploits and man in the middle, and cracking passwords...

How else could someone get into a system?

Ok so by client-side attacks your talking about social engineering, Trojans etc etc… the best way to protect against that is proper education of your staff? Oh and firewalls.

I’m more interested in protecting against people getting in without tricking staff to opening pages/emails…