EH-Net

Ethical Hacking Discussions and Related Certifications => Programming => Topic started by: KH3 on June 22, 2008, 03:51:27 AM



Title: NT 4
Post by: KH3 on June 22, 2008, 03:51:27 AM
Hi there, I am new to programming but are learning some perl and python.

I need to write a small script (pref. Python) that can detect old windows NT 4 boxes in a mixed large windows network. Result should just be a name or a IP if it is a NT4 box. The script should be able to run without user account.

Any ideas of what to detect verify on in relation to the possibilities in python/perl?

Thanks


Title: Re: NT 4
Post by: shakuni on June 22, 2008, 05:38:03 AM
Code:
>>> import sys
 >>> sys.getwindowsversion()
(5, 1, 2600, 2, 'Service Pack 2')
 >>> import platform as  pl
 >>> pl.platform()
'Windows-XP-5.1.2600-SP2'
 >>> pl.system()
'Windows'
 >>> pl.release()
'XP'
 >>> pl.version()
'5.1.2600'

You got the concept, now convert it into script.


Title: Re: NT 4
Post by: KH3 on June 23, 2008, 01:21:05 AM
Thank that look easy and thumbs up for the quick reply ;O)


Title: Re: NT 4
Post by: KH3 on June 23, 2008, 03:17:40 PM
Bonus question!

Will that work from network with a socket or only on the local machine?


Title: Re: NT 4
Post by: shakuni on June 26, 2008, 04:21:25 AM
Try yourself and see!


Title: Re: NT 4
Post by: apollo on June 27, 2008, 12:14:09 PM
If you have any host that is on the domain, and you are only looking for hosts that are in your domain that are NT based, you can do this:

 dsquery * "<YOUR BASE DN>" -scope subtree -filter "(operatingSystem=Windows NT*)"

if you are not on a machine which is part of the domain, if you have a valid user account inside the domain

ldapsearch -H ldap://<any domain controller> -b "<your base ou>" -D "<fully qualified DN of a user in AD>" -W  -x  "(OperatingSystem=Windows NT*)"

You could run this on say a linux box against your ad structure, just having a user in the domain and this should get you what you want


If you are talking about walking into a network blind and finding out if there are NT boxes on the network, nmap is your friend