i gain access to my friend's machine ( he allowed that )
using NetBios ( the good old way, (nbtstat, net view, net use)
well i wanted to ask if i have exec rights to exec a progy on his machine and how?
thanx

You can use this tool called psexec.exe

I love psexec myself, but from time to time it doesnt work. A slower alterantive is to install VNC remotley. There are alot of tutorials on the web for how to do this. I'll include one here:

How to install VNC on a remote PC
VNC is a free utility to remotely control another PC, see http://www.realvnc.com for details.
This article assumes that the remote PC is running Windows NT4, 2000, 2003, or XP Pro (XP Home does not have an IPC$ share as far as I know).
Section I: Install VNC locally, configure the service, and set the password.
Note: The batch file below was for older versions. It doesn't really matter how VNC gets installed on the local PC, just make sure that a password is set and that it is able to take incoming connections.

The following batch file automates this process. Start it in the same directory where VNC's setup.exe is located.
Echo Install VNC
Setup.exe
Echo.
pause
Echo Installing VNC service
"C:\Program Files\ORL\VNC\WinVNC.exe" -install
Echo.
pause
Echo Starting VNC service
net start "VNC Server"
Echo.
Echo You will be prompted to set a VNC password
Echo.
Echo When you hit enter, VNC installation will be complete
pause
--------------------------------------------------------------------------------

Section II: Install VNC on the remote PC *without* Resource Kit Utilities
You may need one publicly available utility: psshutdown.exe from http://www.sysinternals.com/ntw2k/freeware/psshutdown.shtml
Note: \\RemotePC mentioned below can be either the remote PC's name or IP address.

Login to the remote PC's IPC$ share with an administrator account.
If you don't include the password in plain text, you will be prompted to supply the password (which will not be displayed as plain text).
NET USE \\RemotePC\IPC$ /user:administrator password


Copy your local VNC files to the remote PC.
xcopy "C:\Program Files\ORL\VNC\*.*" "\\RemotePC\c$\Program Files\ORL\VNC\*.*" /r/i/c/h/k/e


Use Regedit to export the VNC registry entries on your PC.
regedit /e "C:\vncdmp.reg" "HKEY_LOCAL_MACHINE\Software\ORL"
regedit /e "C:\vncdmp2.reg" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winvnc"


Copy vncdmp.reg and vncdmp2.reg to the remote PC (manually consolidate to a single entry if you want).
Copy C:\vncdmp*.reg \\RemotePC\c$\*.*.


Get the time on the remote PC
NET TIME \\RemotePC


Use the local AT command to have the Task Scheduler service on the remote PC execute commands. This service should be started by default, but you can confirm by running AT \\RemotePC.
AT \\RemotePC hh:mm regedit /s C:\vncdmp.reg
AT \\RemotePC hh:mm regedit /s C:\vncdmp2.reg
AT \\RemotePC hh:mm "c:\program files\orl\vnc\winvnc.exe" -service

Notes:
1) Make sure to schedule the AT commands to run after the time that net time returned.
2) Use the /s switch with regedit.
3) To confirm that entries correctly executed, run AT \\RemotePC after the scheduled time has passed.


Now all you need to do is reboot the remote PC.
You can try to shutdown the PC using Compmgmt.msc (assuming you make a remote connection) and the Advanced tab under properties. See http://www.jsiinc.com/sube/tip2200/rh2207.htm for details.
If the above doesn't work, try psshutdown.exe.
psshutdown.exe \\RemotePC -f -r -t 20 -m "*WARNING* This PC will force reboot in 20 seconds"

When the PC has booted back up, you should be able to connect using VNC. Please note that I have only tried this once from a Windows 2000 PC to a Windows XP Pro PC. Also, I tried connecting to the remote PC with regedit and importing the appropriate settings, but was unable to do it. Since you have to use the AT command anyway to install the VNC service, I think the above method is good enough for now.

If you have any suggestions or comments, please send them to webmaster@tburke.net

--------------------------------------------------------------------------------

Section III: Install VNC on the remote PC with Resource Kit Utilities
You will need 4 resource kit utilities: regdmp, regini, netsvc, and shutdown
Login with an administrator account to the remote PC's IPC$ share.
If you don't include the password in plain text, you will be prompted to supply the password (which will not be displayed as plain text).
NET USE \\RemotePC\IPC$ /user:administrator password


Copy your local files to the remote PC
xcopy "C:\Program Files\ORL\VNC\*.*" "\\RemotePC\c$\Program Files\ORL\VNC\*.*" /r/i/c/h/k/e


Use regdmp to export the VNC registry entries on your PC into a format useable by regini
regdmp "HKEY_LOCAL_MACHINE\SOFTWARE\ORL" >c:\vncdmp.txt
regdmp "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winvnc" >>c:\vncdmp.txt


Use regini to import the entries from step 3 into the remote PC.
REGINI -m \\RemotePC C:\vncdmp.txt


Start the schedule service on the remote PC (the service may already be started)
NETSVC \\RemotePC schedule /start


Get the time on the remote PC
NET TIME \\RemotePC


Use the At command to schedule VNC to start (schedule it to run after the time that net time returned).
AT \\RemotePC hh:mm "c:\program files\orl\vnc\winvnc.exe" -service


Use the shutdown command to reboot the remote PC
SHUTDOWN \\RemotePC /R /C /T:5
When the PC has booted back up, you should be able to connect using VNC. http://www.win2000mag.com/Articles/Index.cfm?ArticleID=16162 served as the inspiration for this. The above method differs in that you are using regdmp to create the regini entries yourself. The VNC defaults set on your PC will be used on the remote PC, including your VNC password.


--------------------------------------------------------------------------------
07/29/03: Added Section II and corrected quote placement for "c:\program files\orl\vnc\winvnc.exe" -service

Hope that helps.

V.

It's been a while but after alot of trial and error i think i used this command

copy C:\windows\system32\lsadump2.exe(this is the name of the file)(space here i think) \\ipaddress\C$\winnt\system32

you need to to get a remote shell back.Search the forum i think there are various threads about it.

But i think that is not TheAngel's prob ..
he wants to gain a shell via netbios ...

he created a share and can copy files etc. but can't execute ...

i think you can only use psexec.exe if you got the admin pw and username ...


so long

but if you got the admin username/pw and psexec does not work, you could try xcmd ( http://www.codeguru.com/network/xCmd.html )
it is sometimes better than psexec imo

1) You could also try rcmd.exe, from the NTRK.


2) IMHO, you don't need to reboot the machine for VNC to work (or start as a service). There's a nice guide at http://guh.nu which explains this.

I recently preformed a pentest, and used this method to remotely install vnc, and it worked perfectly. The only drawback, is that if you make the slightest mistake with installing vnc, the user logged in the console gets a nasry error message...to it *does* need to be a surgical job.

ntcmd.exe can also do the job

ftp://www.vvsoft.net/ftp.vvsoft.net/hacke....html/ntcmd.zip

you can find some help about it on google

cya