
 /*-----------------------------------------------------------------------*/
 /*                       R I N G 0,    I S S U E   # 1                   */
 /*-----------------------------------------------------------------------*/

                            Netbios    ...

                                                             by Bethoven

      Contents:

    .
    Winapi vs  .
       (wnetenum*).
      .
     ,     .
     , nessus   .
     netbios  .
      .



      :

     Netbios             
           ,    
  .          win .   
,   netbios       . 
    raw  tcp (     http  ftp)  udp 
    20%   100  .  
    .   ,  
    netbios   
     tcp( netbios   ). 
    NBT (NetBIOS  TCP/IP).   
     ( (), ). 
          : 
   NT    .

      WINAPI VS  :

          windows  (winapi)      
,         .

       winapi:
               
-    ,    msdn  
 .

       winapi:
                   win  
    (  win9x      ,   
  win9x  winnt  )  
    ,        .
    ($ )

               winapi,   
     netbios .

         (wnetenum*):

               IP  ,     
 .

          ,    
WnetOpenEnum, WnetEnumResource, WNetCloseEnum

        Nw: TnetResource;

        nw.dwScope:=RESOURCE_GLOBALNET;
        nw.dwType:=RESOURCETYPE_DISK; //     .
        nw.dwUsage:=RESOURCEUSAGE_CONTAINER;
        nw.lpLocalName:=nil;
        nw.lpRemoteName:='\\IP';
        nw.lpProvider:=nil;
         enumerating
        Type
        pnetar=^netar;
        netar=array [0..64] of tnetresource;
        var
        Dwresult:integer;// 
        Henum:thandle;
        lpnrLocal:pnetar;
        dwNumEntries:cardinal;
        s:string;
        begin
          lpnrLocal:=@netrrr;//     .
          DwNumEntries:=64;//-     .
          dwResult:=WNetOpenEnum(
            RESOURCE_GLOBALNET,
            RESOURCETYPE_DISK,
            0,
            @nw,
            henum // 
            );
          if dwResult=no_error then
          begin

            repeat
            dwResult:=WNetEnumResource(
              hEnum,
              dwNumEntries,
              lpnrLocal,//    .
              dwBufferSize
              );

            if dwResult=no_error then
            begin
              for dwIndex:=0 to dwNumEntries-1 do
              begin
              s:= (lpnrlocal^)[dwindex].lpRemoteName;
              //    .
              end;
            end;
            //     .
            until dwResult=ERROR_NO_MORE_ITEMS;

          end;
          end;
          WNetCloseEnum(hEnum); //  .
        end;

        :

                        -:
WNetAddConnection2     winapi        
,    -  WnetAddConnection3      
     .    
    .   :

        nw.dwScope:=0
        nw.dwType:=RESOURCETYPE_DISK; //     .
        nw.dwUsage:=0
        nw.lpLocalName:=nil;
        //      ,   
        //  ,     .
        nw.lpRemoteName:='\\IP\resource'; //    ,
             wnetenum*
        nw.lpProvider:=nil;
        //      (username and pass)
        Err:=WNetAddConnection2(nw,pass,username,0);
        //          ,  
           .  //    
           .
        Err:=WNetAddConnection2(nw,nil,nil,0);

               
        msdn.   NT    
       1        
,        .

         ,       : 
    winapi          
\\ip\resource\file.ext

                
   .

       ,     :

         :    .    
      winapi    win(  
*nix    ;)  ).        (,
,  ,   )      
(UNC) 

      \\ip\resource\file.ext.      
      autoexec.bat  

      Copyfile('\\ip\c\autoexec.bat','c:\1.bat',0);

       , NESSUS   :

             
 www.nessus.org.

               plugins(nessus-plugins-1.0.7-1.i386.rpm),
     .    
,    ,      
   .

      smb_accessible_shares.nasl (   R  RW)
      smb_enum_shares.nasl (  )
      smb_login.nasl ( )
      smb_login_as_users.nasl
      netbios_name_get.nasl ( netbios  ,  
      Delphi  )
      smb_bruteforce_pass.nasl (    ;) 
        pqwak , 5-10   8  )

      ...     

                    IP .
    windows               
-nbtstat.

        :

         IP : [200.0.0.2]  : []
         NetBIOS-  
          
        ----------------------------------------------------
        LMTA <00> UNIQUE 
        WORKGROUP <00> GROUP 
        LMTA <20> UNIQUE 
          (MAC) = 02-00-4C-4F-4F-50

           ,     
   03          shared  files.(
         ENT3  Languard)   
         MAC         
  dialup   eth .

       NETBIOS  :

                          Delphi     
(netbios_name_get.nasl)      nessus.         
      ,     
.

      function getname(host:string;timeout:Integer;addstr:string):string;
      var
      err,soc,subloc,name_copy,loc,name_count,num_of_names,
      location,res,netbios_len,group_found:Integer;
      name,sendata,candidate,r,hole_data,hole_answer:string;
      buf:array [1..4096] of Char;
      hostname_found:boolean;
      sockset:TFDSet;
      timeval:ttimeval;
      begin

        Result:='';
        try
        logsys(addstr+'Trying get name for host '+host);
        NETBIOS_LEN := 50;
     //       ;)    ,  
 
     //    .
          sendata := raw_string([
          $01, $F8, $00, $10, $00,
          $01, $00, $00, $00, $00,
          $00, $00, $20, $43, $4B,
          $41, $41, $41, $41, $41,
          $41, $41, $41, $41, $41,
          $41, $41, $41, $41, $41,
          $41, $41, $41, $41, $41,
          $41, $41, $41, $41, $41,
          $41, $41, $41, $41, $41,
          $00, $00, $21, $00, $01
          ]);
        hostname_found := false;
        group_found := 0;
        candidate := '';
        Result:='';
        //   .
        soc := open_sock_udp(host,137);
        if soc=invalid_socket then
        begin
              logsys(addstr+'Cant get host name (error alloc sock) '+host);
              Exit;
        end;

        zeromemory(@buf,4096);
        sockset.fd_count:=1;
        sockset.fd_array[0]:=soc;
        timeval.tv_sec:=0;
        timeval.tv_usec:=timeout*1000;
                                 //timeout    
        err:=select(0,nil,@sockset,nil,@timeval);
                                 //  , 
        Udp  

        if err<>1 then
        begin
             closesocket(soc);
             if err=0 then logsys(addstr+'Cant get host name (timeout conn)
        '+host);
             if err=-1 then logsys(addstr+'Cant get host name (send error)
        '+host);
             Exit;
        end;

        send(soc, sendata[1], netbios_len,0);//  .
        zeromemory(@buf,4096);
        sockset.fd_count:=1;
        sockset.fd_array[0]:=soc;
        timeval.tv_sec:=0;
        timeval.tv_usec:=timeout*1000;
        err:=select(0,@sockset,nil,nil,@timeval);
                                        //    
        

        if err<>1 then
        begin
             closesocket(soc);
             if err=0 then logsys(addstr+'Cant get host name (timeout) '+host);
             if err=-1 then logsys(addstr+'Cant get host name (socket error)
        '+host);
             Exit;
        end;
        res := recv(soc,buf,4096,0);//  .
        err:=WSAGetLastError;
        if res<=0 then
        begin
             closesocket(soc);
             logsys(addstr+'Cant get host name (recv error '+IntToStr(err)+' )
        '+host);
             Exit;
        end;
        closesocket(soc);
        r:=string(buf);setlength(r,res);
      {   ,   nessus 
        .}
      {  ,   .
      decodedostowin  ,      dos
      .          
         -  .
      remsp     }

        if r<>'' then
        begin
        hole_answer := '';
        hole_data := r;
        location := 0;
        location := location + 56;
        num_of_names := ord(hole_data[location+1]);
        logsys(3,st_comp,addstr+'Found '+IntToStr(num_of_names)+' names on host
        '+host);
        location := location + 1;
        hostname_found:=False;
        for name_count:=0 to num_of_names-1 do
        begin
        name:='';
        for name_copy:=0 to 14 do
        begin
        loc := location+name_copy+name_count*18;
        end;
        loc := location+16+name_count*18;
        if(hole_data[loc+1] = raw_string([68])) then
        begin
        subloc := location+15+name_count*18;
        if(ord(hole_data[subloc+1])=32) then
        begin
        if(not hostname_found) then
        begin
        result:=remsp(Name);
        hostname_found := true;
        xlogsys(3,st_comp,addstr+'Name for host '+host + ' is '+
        Result+ ' (' +decodedostowin(result)+')');
        Exit;
        end;
        end
        else
        begin
        if(ord(hole_data[subloc+1])=0) then
        begin
        candidate := name;
        if(not ( name <> '~')) then
        begin
        if(not hostname_found) then
        begin
        Result:=remsp(Name);
        hostname_found := true;
        logsys(addstr+'Name for host '+host+' is '+result+'
        ('+decodedostowin(result)+')');
        Exit;
        end;
        end;
        end;
        end;
        end;
        if (hole_data[loc+1] = raw_string([4])) then
        begin
        subloc := location+15+name_count*18;
        if (hole_data[subloc+1] = raw_string([0])) then
        begin
        if( not hostname_found) then
        begin
        Result:=remsp(Name);
        hostname_found := true;
        logsys(addstr+'Name for host '+host+' is '+result+'
        ('+decodedostowin(result)+')');
        Exit;
        end;
        end;
        end;

        end;
        end;
        xlogsys(3,st_comp,addstr+'Cant get host name '+host);
        except

      end;

      //      .
      function raw_string(const a:array of byte):string;
      var
      i:Integer;
      ret:string;
      begin
      ret:='';
      for i:=0 to high(a) do
      begin
      ret:=ret+chr(a[i]);
      end;
      Result:=ret;
      end;

        :

         netbios      
  ,        MS 
            
   .

             .

      :

      MSDN
      http://msdn.microsoft.com
             winapi     
netbios.             CIFS (common
internet file system)

      Nessus project
      http://www.nessus.org
            *nix ,   
  netbios  .        , 
   .

      :
      Pandora ultimate scanner
      http://www.bethoven.f2s.com
      http://bethoven.pisem.net

                      
Pandora.        ,  
:

       ,  IP   Pandora
 .
          .
         pqwak.
          backdoors.
      remote administrative control.
      ,  .

      LANguard Network Scanner
      http://www.gfi.com/nsnetscan.shtml
               
  ,       .  
 ,      snmp walk.

      ENT (Essential NetTools)
      http://www.tamos.com
             .    
          netbios.      NAT
(network  auditing tool)   *nix ,   
   ,    .

      Contacts:
      mail:
      bethoven99@chat.ru
      bethoven99@mail.ru
      website:
      www.bethoven.f2s.com
      2001 (c) Bethoven

