The Ethical Hacker Network - Pen Testing Windows

Latest Additions

Who's Online

EH-Net > Ethical Hacking Discussions and Related Certifications > Network Pen Testing (Moderator: don) > Pen Testing Windows

Pages: 1 [2] Go Down

« previous next »

	Author	Topic: Pen Testing Windows (Read 10933 times)
0 Members and 1 Guest are viewing this topic.

cd1zz

Recruiters
Hero Member

Offline

Posts: 561

Re: Pen Testing Windows

« Reply #15 on: December 12, 2011, 08:03:40 AM »

It's heavy on AD but there are other areas of focus as well.

http://www.microsoft.com/learning/en/us/certification/mcitp.aspx#tab2


	Logged

OSCE | OSCP | GXPN | OSWP | CISSP
http://www.pwnag3.com
http://www.networkadminsecrets.com

Newbie

Offline

Posts: 29

Re: Pen Testing Windows

« Reply #16 on: December 12, 2011, 03:31:42 PM »

cd1zz pointed you to some very good directions; for a real world scenario I will add searching for shares and trying to access them - you will be amazed how many misconfigurations exist.
For ldap: after you enumerate the juicy stuff, you can try again a dictionary attack on the user names discovered, even if the account lock-out is in place you might get lucky and guess a password with a dictionary attack.


	Logged

Security+, OSCP, CISM, CISSP

millwalll

Guest

Re: Pen Testing Windows

« Reply #17 on: December 13, 2011, 03:40:06 AM »

Cool I will try look into all these things and let you know how i get on.


	Logged

24772433

Newbie

Offline

Posts: 33

Re: Pen Testing Windows

« Reply #18 on: December 18, 2011, 06:22:20 PM »

If you want to tinker with AD for free Microsoft have quite a few pre-configured VHDs for Microsoft Virtual Server.

http://technet.microsoft.com/en-us/bb738372

I've used these in the past, mainly the Exchange servers for evaluation and testing. With the standalone 2008/2003 servers you can easily create an AD environment just by running the command DCPROMO from RUN. A simple wizard will configure AD on your server.

Steve.