Print Sharing

Exploiting File and Print Sharing, by:

Ghost_Rider (Ghost_Rider9@hotmail.com)

R a v e N (barakirs@netvision.net.il)

Date of Release: 2/4/2000

http://blacksun.box.sk

Thanks to Oggy, a totally kewl and helpful guy that helped us release this

tutorial faster.

-------------

Introduction

-------------

Remember that I won't go into much detail, because it could start getting

too complicated to explain to newbies. This is a newbies guide after all. If

you want more detailed information about file sharing search the web, or

read some good NT networks administration books.

Windows has an option called file and print sharing. You can use this

option in order to "share" drive and printers, which means giving access to

files and printers to other people - people on your own network, specific

IPs or even the whole world. When you turn this option on, you leave an open

port (port number 139) that accepts connections and understand the "NetBIOS

protocol", a set of commands (a "language") used to access remote file

and print sharing servers, so that other computers can access the files or

printers you decided to share.

Now sometimes in a small company LAN this could be extremely useful. For

example, instead of having a separate

printer for each computer, there's just

one central printer in a computer that allows file and print sharing. But if

you are using file sharing in your home computer (We've seen many people

that have this option turned on and don't even know what it means! Poor

souls) that is connected to the Internet, that could be quite dangerous because

anyone who knows your IP can access your files or printers you're sharing.

If you don't know if file sharing is active in your computer just go to the

control panel and select the Network icon. Now you should see a box where you

can see all the network software that you have installed, such as TCP/IP

(Transfer Control Protocol / Internet Protocol. This is the protocol that is

used to transfer data packets over the Internet. A protocol is like a human

language - if two computers understand it, they can communicate) and probably a

dial-up adapter (so you could transfer TCP/IP packets over a PPP connection.

PPP, or Point to Point Protocol is the protocol used in dial-up connections),

check if you have a line called File and Printer Sharing.

If you have this then you have sharing activated, to turn it off just uncheck

the "I want to be able to give others access to my files" and do the same to

the other. Let's return to the ports thing. Remember port 139? The File Sharing

Port is port 139 and it's called NetBIOS Session Service port. When you have

this option enabled you also have 2 other ports open but they use the UDP

protocol instead of the TCP protocol. These ports are 137 (Name Service) and

138 (Datagram Service). Now if you know anything about DoS attacks (known to

many as nukes) port 139 should sound familiar... There's a kind of DoS (stands

for Denial of Service) attack called the OOB nuke (OOB stands for Out Of Band)

or "winnuke" that sends an