Weak NT pass isn't really a software exploit, it's a user exploits. It exploits users that use weak passwords. As far as I know, the only way to secure yourself against the "weak NT pass" attack is to use a strong password.

just disable the "server" service

hm can you tell me what consequenses there are when disabeling the "server" service?
what could it be used for?

and i am still wondering what service / share or something dameware uses to connect to hosts. (and then i want to close that entry point)

i think dameware uses port 139 to enter thru admin$ shares...
thus if you have the username and password you will be able to access that share..

the thing is some isps block 139 whereas some do not
port 139 is netbios(network basic input output system)

so if you use a firewall and block this then you won't be attacked..unless you have a crap firewall



l8r.

There's a Dameware Mini Remote Control service, why don't disable it?

@blasta: nonsens!


i am quite sure dameware uses ipc$ share to connect. but i have problems to delete that share. net share ipc$ /delete even doesn't work on my system (access denied).
i thought this key:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"RestrictAnonymous"=dword:00000001
disables the ipc$ share but this seems to be wrong.

Try using psexec or another prog except dameware mrc to connect.

lol BlaStA, yeah, disable Dameware Mini Remote Control service. Hey... tell me one thing - how do you want to disable it if it's not installed yet? I really wonder how you'll do that.
Dameware may install this service AFTER it connects succesfully to target machine.

Hmm... this method with using psexec is even more interesting. So you're saying that if i want to prevent my comp from Dameware access i need to use psexec. Yeah right and what will i execute with psexec? =k3Rn= wants to prevet access by Dameware to his comp.


=k3Rn=, i'm using one additional registry key you didn't mentioned here (with the rest of course).

BlaStA (Se)...
Then try your DameWare on new machine. And what have you got (I assume you knew admin l/p)? Tada - it will ask you about installing this service first. This service allows DameWare to do some remote administration thingy. BTW there's one more service that may be installed by DameWare (depends how do you want to use dameware)

Of course disabling will help AFTER DameWare was installed. But it will help you only until another DameWare Access try. =k3Rn= wants to prevent his machine to be accessed by DameWare. BlaSta, assume that the machine we want to protect against DW is clean from it, then how do you want to protect it? By disabling nonexisted service?

Here's a little info about both services
Dameware Mini Remote Control Service - DWRCS.EXE - this one comes when you want remote desktop
Dameware NT Utilities Service - DNTUS26.EXE - and this one is installed after first use of remote command.
They're using Admin$ share when trying to install.

thx for your reply shadowwalker - intresting!

u may think deleting the shares is the best way to secure, but shares are created by sysop probably becuase he needs them. if he notices his shares down, he will prbably just recreate them, and if he notices them disabled more than once, he may get suspicous of a hacker

i only remove the admin shares
c$
admin$
ipc$

they are not needed

weak pw is very relative though.. because the longer the hacker scanns the weaker your pw gets

but using a long pw with 10 or more characters would protect you kinda well..

removing the shares also helps but don't forget that the shares are added again on every reboot.. you would have to create a batch that runs on every sys boot


greetz

Hmmm, securing against a weak password attack......Unless anybody starts brute forcing you, as long as you don't use a weak password (6 char. with numbers/letters usually works well enough) Most people only really go for the easy kills anyway.

let's think of a password with the combination of letters and numbers.
eg. t3st(4u&7ry.

i think this will be safe else you can use a firewall to block port 139.

If you don't need NetBIOS on, apart from using a GOOD password, you could chuck all this in a batfile and run it:

net share /delete C$ /y
net share /delete D$ /y
net share /delete E$ /y
net share /delete F$ /y
net share /delete IPC$ /y
net share /delete ADMIN$ /y
net stop "Remote Registry Service"
net stop "Computer Browser"
net stop "Server" >> server.txt
net stop "REMOTE PROCEDURE CALL"
net stop "REMOTE PROCEDURE CALL SERVICE"
net stop "Remote Access Connection Manager"
net stop "telnet"
net stop "messenger"
net stop "netbios"
net stop "Net Logon"
net stop "TCP/IP NetBIOS Helper Service"

Shares can be added remotely using rmtshare.exe from microsoft

Yeah you could just get rid of the admin hidden shares but the only thing is that once you restart they get shared agian. That creates sorta a hassle if you know what i mean

i don't know if i'm right but as far as i know dameware is at least able to recreate the default admin shares , so i'm a bit sceptic about that shares deleting thing ...

greetz

very long passwds means lot better chances of you not getting hacked

windows stores both the lm and ntlm hashes, because lm hashes are less secure you can turn them off if your not worried about compatability with older windows versions

go here:
Control Panel ->Administrative Tool -> Local Security Settings
->Local Policies -> Security Options
and change the values in "Network Security: do not store lan manager hash....." and "Network Security: lan manager authentication level

BTW northernsky

Heres some information for you regarding passwords, you may find of assistance.

CISSP Security Management and Practices

My pref. is passwords that are 8 characters in length which contain Upper Case - Lower Case - Special Characters - and numbers.

Sorry, but I wanted to get back to the Dameware part of this thread.

I found this post from a Google search looking for a way to prevent Dameware from being installed by unauthorized users.

Setting restrict anonymous higher than 1 and disabling the administrative shares wasn't a great solution. This is what I ended up doing after getting nowhere with Dameware support.

I created a file in the %SystemRoot%\System32 folder called DWRCS.exe. Then I explicitly denied access to that file for everyone except the Domain Admins. Testing this on various W2K servers in our organization proved that no one but Domain Admins can install Dameware Mini Remote on our servers.

I hope that was clear enough, being my first post here.

Regards.

you could also disable auto share:

Hi guys, here comes my 2 cents.

As well as using capital letters and numbers in yer password you could try using a non-standard ascii character (smething i read). Basically pick a number between 155 and 210 (rough guess on the numbers, but any number between that range will give you the non-standard character) hold down ALT key and type yer number in, try it in a word processor or notepad. This number and ALT will produce ONE character. simply insert this somewhere in yer password. So you get this "password(ALT-179)". Apparently i can't spell to save my life, but these charaters are said to beat most password cracking software (LC3).

I hope that was helpful, (can i have my two cents back now?)

i believe the above batch script should do the job, also @ the begining add "@echo off" so that there will be no output 4 selected action:D also u can add the string to run the batch script in registry... HKLM\Software\Microsoft\Windows\CurrVers\Run, and add the the path of ur batch script....hf