Re: WINS attack?

[BlueBoar () THIEVCO COM (Blue Boar)]

Bryce Walter wrote:
> Has anybody looked at the possibility of stealing WINS registrations?
>
> Spoof the name/service release of a server then register that name to your
> own IP.  I'm not sure right off what that would get you (besides a DoS), but
> it could be an interesting excercise.

It's better than a DoS.  You pretend to be a domain controller, and all
the machines will try to use you for authentication.  makes the sniffing
feature of L0phtcrack very useful in a switched or WAN environment.  Of
course, you'll be easy to track down if the admins have any clue.

Unless you point at your neighbor instead, on the same repeated segment.
Watch him get busted instead.

WINS will believe anyone.  I had an ISDN user set up his home machine
as a PDC once, for our main security domain.  When he dialed up and
registered with WINS, every machine tried to authenticate with him
across the ISDN line.  Joy.

The L0pht guys have been promising a tool along these lines as
part of a disservice pack for NT for a couple of years.  I don't
know if that's changed given what they're doing with products
as part of the @stake merger.  Comments, Mudge?

                                        BB