tap chi security 365 so 7

8/6/2019 Tap Chi Security 365 So 7

1/28

Cho cc bn, trong s 6 ca T p Ch Security365chng ti cp n ch Foot Printing, mt

trong nhng bi hc cbn ca qu trnh tr thnh 1Ethical Hacker. Ti p theo chng ta s cng tm hiuv Enumeration thuc Module 4 ca phin bn CEH

v7. Trong s ny chng ta s tham kho thm cc th thut my tnh nhm nng cao san ton v bo mt thng tin c nhn hay cc th thut my tnh cn quan tm khc.

Lu : Ch Enumeration chng ti c s dng mt ti liu su tm ca bn V ThanhVn thuc nhm IT Cowboy, do thy bi vit ca cc bn kh y v rt hay, kmtheo l mt s bi ging ca trng ban bin tp Tp Ch Security365 l ng NguynTrn Tng Vinh v cc video demo cng c CEH thuc ch Enumeration c coverli bi anh Trn Ngc Bng Web Master Security365.VN

download cc s cng b ca Tp Ch Security365 cc bn hy truy cp link sau :

Hoc download trc tip tmediafire theo link sau :

S1 - http://www.mediafire.com/file/urjrq4bahu5xhoy/Tap_Chi_Security365_So_1.pdf

S2 - http://www.mediafire.com/file/b53vg3nnf5nnnpr/Tap_Chi_Security365_So_2.pdf

S3 - http://www.mediafire.com/file/0sk47esjomuqqrh/Tap_Chi_Security365_So_3.pdf

S4 - http://www.mediafire.com/file/cfce7micptsghc5/Tap_Chi_Security365_So_4.pdf

S5 - http://www.mediafire.com/file/cm1922ij21v151w/Tap_Chi_Security365_So_5.pdf

S 6 - http://www.mediafire.com/file/ppomkv279d2cs62/Tap_Chi_Security365_So_6.pdf
http://www.mediafire.com/file/urjrq4bahu5xhoy/Tap_Chi_Security365_So_1.pdfhttp://www.mediafire.com/file/b53vg3nnf5nnnpr/Tap_Chi_Security365_So_2.pdfhttp://www.mediafire.com/file/0sk47esjomuqqrh/Tap_Chi_Security365_So_3.pdfhttp://www.mediafire.com/file/cfce7micptsghc5/Tap_Chi_Security365_So_4.pdfhttp://www.mediafire.com/file/cfce7micptsghc5/Tap_Chi_Security365_So_4.pdfhttp://www.mediafire.com/file/cm1922ij21v151w/Tap_Chi_Security365_So_5.pdfhttp://www.mediafire.com/file/cm1922ij21v151w/Tap_Chi_Security365_So_5.pdfhttp://www.mediafire.com/file/ppomkv279d2cs62/Tap_Chi_Security365_So_6.pdfhttp://www.mediafire.com/file/ppomkv279d2cs62/Tap_Chi_Security365_So_6.pdfhttp://www.mediafire.com/file/cm1922ij21v151w/Tap_Chi_Security365_So_5.pdfhttp://www.mediafire.com/file/cfce7micptsghc5/Tap_Chi_Security365_So_4.pdfhttp://www.mediafire.com/file/0sk47esjomuqqrh/Tap_Chi_Security365_So_3.pdfhttp://www.mediafire.com/file/b53vg3nnf5nnnpr/Tap_Chi_Security365_So_2.pdfhttp://www.mediafire.com/file/urjrq4bahu5xhoy/Tap_Chi_Security365_So_1.pdf


2/28

Trang video hng dnhttp://www.security365.vn/index.php?option=com_content&view=section&id=5&Itemid

=54

Trang Ch Tp Ch Security365 http://www.securitu365.vn !
http://www.security365.vn/index.php?option=com_content&view=section&id=5&Itemid=54http://www.security365.vn/index.php?option=com_content&view=section&id=5&Itemid=54http://www.securitu365.vn/http://www.securitu365.vn/http://www.security365.vn/index.php?option=com_content&view=section&id=5&Itemid=54http://www.security365.vn/index.php?option=com_content&view=section&id=5&Itemid=54


3/28


4/28

Bo Mt Gmail , Bt Kh Xm Phm !

Bi g

i cho PCWORLD VN

Bt k ai cng c s dng email, qua ri thi m khi c hi email ca bn l gc ngi cn tr li l ti qun nhV, trong s cc email m chng ta s dng c 1 email chnh, tm gi l primarymail dng khai bo cc thng tin ti khon quan trng nh ti khon ngn hng,ti khon webhosting hay email dng phc hi password cho nhng ti khonemail khcV vy, a chemail chnh ny nn s dng v thit lp sao cho an ton ti a, cth gi l khng th ph vc c ch bo mt ca n. thc hin iu nyhin nay Gmail cung cp cho chng ta mt c ch bo mt 2 lp kh hu ch lngoi mt khu ng nhp cc bn cn phi nhp vo mt m s xc nhn c giqua in thoi di ng, v ph vc c ch bo mt ny mt hacker kh niting trong gii blackhat phi tht ln l kh nh ln tri, vy vic cu hnh nc kh nh vy khng ? Tht may mn l ng dng n li rt d dng. Cc bn hyxem hnh minh ha khi ti ng nhp vo hp th ca mnh sau khi nhp vopassword s xut hin 1 mn hnh nhp m xc nhn, m s ny sc gi ngay

tc th sau khi chng ta vt qua lp bo mt u tin


5/28


6/28


7/28

Reset Password Tt C H Thng Windows

Trong nhiu tnh hung bn qun mt mt khu ng nhp my tnh ca mnh, vyphi lm sao c th ly li quyn qun tr m khng phi ci t li my tnh cngcc ng dng khc. Hy s dng cng c reset password mnh m nht hin nay lActive Change Password bn c th reset password cho ti khon qun tr ca tt ccc h iu hnh Windows t Windows 2000, XP, Vista cho n Windows 7,Windows Server 2003 /2008.

Bc 1 -u tin, cc bn hy download cng c Active Change Password ti y :htt // di fi /? hbf44h b 7
http://www.mediafire.com/?egcwhbf44howbs7http://www.mediafire.com/?egcwhbf44howbs7http://www.mediafire.com/?egcwhbf44howbs7


8/28

Bc 5 Khi ng li my tnh v ng nhp ti khon c reset passwordtrng. Qu trnh ng nhp hon tt.


9/28


10/28

CHNG 6: EnumerationT/G V Thanh Vn

Enumeration (Lit k) l bc tip theo trong qu trnh tm kim thng tin ca t chc,xy ra sau khi scanning v l qu trnh tp h p v phn tch tn ngi dng, tnmy,ti nguyn chia s v cc dch v. N cng chng truy vn hoc kt ni ti mctiu c c nhng thng tin hp l hn.

Enumeration L G?Enumeration (lit k) c thc nh ngha l qu trinh trch xut nhng thng tin cc trong phn scan ra thnh mt h thng c trt t. Nhng thng tin c trch xutbao gm nhng th c lin quan n mc tiu cn tn cng, nh tn ngi dng (username), tn my tnh (host name), dch v (service), ti nguyn chia s (share).Nhng k thut lit k c iu khin t mi trng bn trong.

Enumeration bao gm c cngon kt ni n h thng v trc tip rt trch ra ccthng tin.

Mc ch ca k thut lit k l xc nh ti khon ngi dng v ti khon h thng ckh nng s dng vo vic hack mt mc tiu. Khng cn thit phi tm mt ti khonqun tr v chng ta c th tng ti khon ny ln n mc c c quyn nht cho phptruy cp vo nhiu ti khon hn cp trc y.

Cc k thut c s dng trong lit k c th k ra nh:

K thut Win2k Enumeration : dng trch xut thng tin ti khon ngi dng (username).


11/28

Null Session, hay c gi l IPC$ trn my ch nn tng Windows, l mt dng kt ninc danh ti mt mng chia s cho php ngi dng trong mng truy cp t do.

Tn cng Null Session xut hin k t khi Windows 2000 c s dng rng ri. Tuynhin, hnh thc tn cng ny khng c cc qun tr vin h thng ch khi p dngcc bin php bo mt mng. iu ny c th dn n kt cc khn lng v tin tc c ths dng hnh thc tn cng ny ly mi thng tin hu dng cn thit ginh quyntruy cp t xa vo h thng. Mc d khng cn mi m, nhng tn cng Null Session vnph bin v nguy him nh nhng nm trc y. Xt v mt kha cnh no , mc dkh nng bo mt ca cc h thng hin i khng phi qu yu nhng khi thc hin cc

cuc th nghim xm nhp trn my tnh Windows th kt qu cho thy Null Session vnl mt trong nhng hnh thc cn lu .

Phng thc hot ng ca Null Session

Mt phin truy cp t xa c to lp khi ngi dng ng nhp t xa vo mt my tnhs dng mt tn ngi dng v mt khu c quyn truy cp vo ti nguyn h thng.

Tin trnh ng nhp ny c thc hin qua giao thc SMB (Server Message Block) vdch v Windows Server. Nhng kt ni ny hon ton h p php khi nhng thng tinng nhp chnh xc c s dng.

Mt Null Session xy ra khi ngi dng thc hin kt ni ti mt h thng Windows mkhng s dng tn ngi dng hay mt khu. Hnh thc kt ni ny khng th thc hintrn bt k hnh thc chia s Windows thng thng no, tuy nhin li c th thc hintrn chia s qun tr IPC (Interprocess Communication). Chia s IPC c cc tin trnh

ca Windows s dng (vi tn ngi dng l SYSTEM) giao tip vi cc tin trnhkhc qua mng ny. Chia s IPC chc giao thc SMB s dng.

Chia s khng yu cu thng tin ng nhp IPC thng c s dng cho nhng chng


12/28

Hnh : Kt ni tht bi vo mt mng chia s s dng lnh NET.

Khi s dng lnh NET, chng ta c th thay i tn chia s kt ni ti chia s qun trIPC$. Khi kt qu s kh quan hn.

Hnh : Kt ni Null Session thnh cng vi lnh NET.

Lc ny, chng ta thit lp mt kt ni Null Session ti my tnh nn nhn. Tuy nhin,chng ta vn cha c quyn truy cp qun tr trn my tnh ny do cha th bt uduyt tm cng hay ly mt khu. Cn nhrng, chia s IPC c s dng giao tip

gia cc tin trnh, do quyn truy cp ca chng ta s b gii hn xung quyn truycp ca tn ngi dng SYSTEM. Chng ta c th s dng lnh NET ly nhiu thngtin hn t my tnh mc tiu, tuy nhin c nhiu cng c tng ha s thc hin cccng vic rc ri ny.


13/28

cao hn, tuy nhin Windows XP v Windows Server 2003 vn l nhng hiu hnhc a chung nht. C mt s phng php khc m chng ta c th thc hin chn

Null Session.

Chn Null Session trong RegistryKh nng tng thch ca nhng phn mm h p php cng vi thc t rng hu htdoanh nhip phi gn b vi cc hiu hnh c tht cht ngn sch l hai l do chnhkhin my trm v my ch Windows 2000 vn tn ti. Nu vn s dng Windows 2000,chng ta ch cn thc hin mt thay i nh trong Registry l c th chn kh nng ly

thng tin s dng Null Session.Khi truy c p vo Regedit v duyt tm ti keyHKLM/System/CurrentControlSet/Control/LSA/RestrictAnonymous, chng ta c th cuhnh 3 ty chn bao gm:0 Ci t mc nh. Truy cp Null Session khng gii hn.1 Khng nhng loi b Null Session m cn chn hin th tn ngi dng v cc chias.2 Loi b mi gi tr ti Null Session bng cch chn mi truy cp.

Nh chng ta thy, Null Session khng th b loi b hon ton, tuy nhin, kh nng truycp ca n s b gii hn nu la chn ty chn ci t l 2. Cn thn trng khi cu hnhty chn ny trn my ch Windows 2000 v c th lm hng Clustering.rn Windows XP v Windows Server 2003, chng ta c th thc hin tc v tng ttrong ba Registry Key:HKLM\System\CurrentControlSet\Control\Lsa\RestrictAnonymousHKLM\System\CurrentControlSet\Control\Lsa\RestrictAnonymousSAMHKLM\System\CurrentControlSet\Control\Lsa\EveryoneIncludesAnonymousKha cc port truy cpNu khng th thc hin cc thay i trong cc Registry Key c nhc n trn, th


14/28

Session, mt trong nhng bin php hu hiu nht l pht hin ra tn cng NullSession mt cch sm nht c th trin khai nhng bin php khc phc kp thi nh

khi thc hin mt s kin bo mt mng thng thng.Nu ang s dng Snort, mt IDS/IPS (H thng pht hin v chn xm nhp mng) phbin nht hin nay trong mi trng sn xut, th rule sau y s pht hin thng k NullSession:alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:NETBIOS NT NULLsession; flow:to_server.establshed;content: |00 00 00 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 4E 00 54 00 2000 31 00 33 00 38 00 31|; classtype:attempted-recon;)

Rule ny s khng ngn chn cc kt ni Null Session, tuy nhin n s thng bo khiNull Session xy ra.Nng cp hiu hnhGii php cui cng nh cp trn l nng cp hiu hnh. Null Session ch ddng thc hin vi hiu hnh i c trc nm 2000. Cn sau nh Windows XP,Windows 2003 th vic ny c Microsoft tch hp trong sn phm. Do , nng cphiu hnh lm chng ta yn tm hn.

K thut lit k SNMP (Simple Network ManagementProtocol)Tm hiu v SNMPSNMP l giao thc qun l mng n gin, dch t cm t Simple NetworkManagement Protocol. Th no l giao thc qun l mng n gin ? Giao thc l mttp hp cc th tc m cc bn tham gia cn tun theo c th giao tip c vi nhau.

Trong lnh vc thng tin, mt giao thc quy nh cu trc, nh dng (format) ca dngd liu trao i vi nhau v quy nh trnh t, th tc trao i dng d liu . Numt bn tham gia gi d liu khng ng nh dng hoc khng theo trnh t th cc bnkhc s khng hiu hoc t chi trao i thng tin. SNMP l mt giao thc, do n c


15/28

Network element l cc thit b, my tnh, hoc phn mm tng thch SNMP v cqun l bi network management station. Nh vy element bao gm device, host v

application.

Hnh : M hnh minh ha cc thnh phn ca SNMPMt management station c th qun l nhiu element, mt element cng c thcqun l bi nhiu management sation. Vy nu mt element c qun l bi 2 stationth iu g s xy ra ? Nu station ly thng tin t element th c 2 station s c thng tinging nhau. Nu 2 station tc ng n cng mt element th element sp ng c 2 tcng theo th t ci no n trc.Ngoi ra cn c khi nim SNMP agent. SNMP agent l mt tin trnh (process) chytrn network element, c nhim v cung cp thng tin ca element cho station, nhstation c th qun l c element. Chnh xc hn l application chy trn station vagent chy trn element mi l 2 tin trnh SNMP trc tip lin h vi nhau.Cc v d minh ha sau y s lm r hn cc khi nim ny: dng mt my ch (station) qun l cc my con (element) chy HH Windowsthng qua SNMP th bn phi : ci t mt phn mm qun l SNMP (application) trnmy ch, bt SNMP service (agent) trn my con. dng mt my ch (station) gim st lu lng ca mt router (element) th bn phi


16/28

kin trc chung m cc giao thc qun l trn TCP/IP nn tun theo, trong c SNMP.MIB c th hin thnh 1 file (MIB file), v c th biu din thnh 1 cy (MIB tree).

MIB c thc chun ha hoc t to.Mt manager c th qun l c mt device ch khi ng dng SNMP manager v ngdng SNMP agent ng h trmt MIB. Cc ng dng ny cng c th h trcng lcnhiu MIB.Cc phng thc ca SNMPGiao thc SNMP c 5 phng thc hot ng, tng ng vi 5 loi bn tin nh sau:

SNMP Enumeration ?K thut SNMP Enumeration l qu trnh s dng SNMP lit k cc ti khon ngidng trn mt h thng mc tiu. Hu ht tt c cc thit b h tng mng, nhrouter,switch v bao gm c h thng Windows, cha ng mt SNMP agent qun lh thng hoc thit b. Cc trm qun l SNMP gi yu cu ti cc agent v agent tr lili.Cc yu cu v cc s tr li c gi n cc bin truy cp cu hnh bi phn mmagent. Cc trm qun l c th lun gi cc yu cu thit lp gi tr cho cc bin nhtnh. Cc trm qun l nhn gi Trap t agent bit mt vi iu quan trng va xy ratrn phn mm agent nh c s khi ng li hay mt li giao din.SNMP h i d d t h h SNMP t t t l


17/28

i ph vi k thut lit k SNMPCch n gin nht ngn chn k thut lit k SNMP l gb ht cc SNMP agenthoc tt dch v SNMP. Nu khng c chn tt SNMP, hy thay i tn mc nh readv read/write community. Thc thi bo mt trong Group Policy thm iu kin ngnnga kt ni ngi dng nc danh.Active Directory EnumerationActive Directory (AD) l g ?Active Directory l mt csd liu ca cc ti nguyn trn mng (cn gi l i tng)cng nh cc thng tin lin quan n cc i tng . Tuy vy, Active Directory khngphi l mt khi nim mi bi Novell s dng dch v th mc (directory service)trong nhiu nm ri.Mc d Windows NT 4.0 l mt hiu hnh mng kh tt, nhng hiu hnh ny likhng thch hp trong cc h thng mng tm cx nghip. i vi cc h thng mngnh, cng c Network Neighborhood kh tin dng, nhng khi dng trong h thng mngln, vic duyt v tm kim trn mng s l mt c mng (v cng t hn nu bn khngbit chnh xc tn ca my in hoc Server l g). Hn na, c th qun l c hthng mng ln nh vy, bn thng phi phn chia thnh nhiu domain v thit lp cc

mi quan h u quyn thch hp. Active Directory gii quyt c cc vn nh vy vcung cp mt mc ng dng mi cho mi trng x nghip. Lc ny, dch v th mctrong mi domain c th lu tr hn mi triu i tng, phc v mi triungi dng trong mi domain.

Chc nng ca Active DirectoryLu gi mt danh sch tp trung cc tn ti khon ngi dng, mt khu tng ng vcc ti khon my tnh.Cung cp mt Serverng vai tr chng thc (authentication server) hoc Server qun lng nh p (logon Server), Server ny cn gi l domain controller (my iu khinvng).Duy tr mt bng hng dn hoc mt bng ch mc (index) gip cc my tnh trong


18/28

cng khc. V d nh bn mun d tm mt khu ca user th hy nhmt quy tc, userthng t mt khu l nhng g c lin quan n mnh nh ngy sinh, sin thoi, s

nh, s xeHacking ToolSid2user v User2sid l hai cng c dng dng lnh gip bn lit k cc thng tin c linn user.GetAcct l chng trnh dng ha, cho php bn tm kim thng tin user trn hiuhnh Win NT v 2000LDAP EnumerationLDAP (Lightweight Directory Access Protocol) l giao thc truy cp danh sch th mc

ca AD hoc nhng dch v directory khc. Th mc c cu trc, cp , nh dng cth. Di y l vi cng c dng lit k da vo giao thc LDAP.Hacking ToolJxplorer: Ngoi chc nng lit k th mc, cng c ny cn h trchng thc qua SSL,thm ch l vic thm, xa, sa thng tin th mc.Softerra LDAPP Browser, LDAPMiner l hai cng c khc c chc nng tng t.NTP EnumerationNTP (Network Time Protocol) l giao thc c thit kng b ha thi gian giacc server. Giao thc hot ng port 123, UDP truyn ti d liu. lit k thngtin c lin quan n NTP Server, bn c th dng cc lnh nh ntpdata, ntptracer, ntpdc,ntpqSMTP EnumerationSMTP (Simple Mail Transport Protocol) l giao thc hot ng port 25TCP gi mailln POP3 hoc IMAP server nhng server nhn mail. lit k thng tin SMTP serverbn c th dng lnh telnet n server.Hacking ToolSMTPscan l cng c cho php chng ta tm kim nhng thng tin c lin quan nSMTP Server. Chng trnh hot ng bng cch gi mt gi tin gin server v ctin nhn tr v bit nhng thng tin ca server.


19/28

Trnh by c nhng thng no c th lit k t h thng. Nhng thng bao gm tinguyn mng chia s, user, group v nhng ng dng.

L gii Null Session l g? V nhng k tn cng da trn null session. Kt ni n hthng bng password trng l Null Session. Hacker kt ni n h thng ch thc thinhng ng dng.Cc cng c hack dng lit k. C th chia hai loi. Loi dng NetBios, loi dngSNMP nh SNMP Until, Enum.

Li ca Security365 : Trong bi vit ny cc bn cn ch n cc cng nh hng biNull Session, v cch ng cng cng nh cc nh hng ca vic ng cng ny.

thun tin cho vic ng v mcng chng ti c vit 2 script l Block NullSession vEnable Null Session m cc bn c th download t chuyn mc Tool ca trang ch tpch www.security365.vnCc cng c khc ca Module ny cc bn hy download v t kho lu tr qua linkmediafire c cung cp trong phn gii thiu, sau y l mt s video hng dn cch sdng cc cng c ny.
http://www.security365.vn/http://www.security365.vn/http://www.security365.vn/


20/28


21/28


22/28


23/28


24/28

Lu : Security365 khng th tch hp tt c cc video Module 4 vo tp ch v s lm dunglng qua ln, v vy cc bn c th tham kho y cc video demo thuc ch ny ca Cehv7 ti mc Video CEH v7 tihttp://www.security365.vn/index.php?option=com_content&view=section&id=8&Itemid=112

Tip theo l cc hng dn v ly tin tng, tng quan v GFI NSS, funny hack game bngtamper data

(Security365) Hng Dn c Tin Tng RSS

Hin nay Security365 cung cp hn 500 demo / hng dn ca CEH v7, Security+, Web vtrn 1000 u sch + tool hay thuc cc ch qun tr h thng, bo mt thng tin, an tonmy tnh. Danh sch ny s thng xuyn cp nht hng ngy, hng tun c bit l cc videohng dn v vy cc bn c thsdng chng trnh c RSS nhFeedReader, hay cc trnh

duyt Firefox / Opera cp nht thng xuyn cc bi mi. Khi truy cp, cc bn ch s thytrn gc phi c biu tng RSS, hy click vo y ly link truy cp v add vo trinh duyt

hay chng trnh c tin ca mnh. V d RSS VIDEO, RSS EBOH, RSS TOOL. (DownloadFeedReader)
http://www.security365.vn/index.php?option=com_content&view=section&id=8&Itemid=112http://www.security365.vn/index.php?option=com_content&view=section&id=8&Itemid=112http://www.feedreader.com/releases/FeedReader314Setup.exehttp://www.feedreader.com/releases/FeedReader314Setup.exehttp://www.security365.vn/index.php?option=com_content&view=section&id=8&Itemid=112


25/28


26/28


27/28


28/28

tap chi security 365 so 7

Documents