CEH

132 Chapter 6 ■ Enumeration of Services

Network Any user accessing the system through a network has the Network identity,

which allows only remote users to access a resource.

Restricted Users and computers with restricted capabilities have the restricted identity. On

a member server or workstation, a local user who is a member of the Users group (rather

than the Power Users group) has this identity.

Self Refers to the object and allows the object to modify itself.

Service Any service accessing the system has the Service identity, which grants access to

processes being run by Windows 2000, and later, services.

System The Windows 2000, and later, operating system has the System identity, which is

used when the operating system needs to perform a system-level function.

Terminal Server User Allows Terminal Server users to access Terminal Server applications

and to perform other necessary tasks with Terminal Services.

Security Identifiers

A very important idea for you to grasp is that of the security identifier (SID). Each user

account in Windows has a SID, which is a combination of characters that looks like the

following:

S-1-5-32-1045337234-12924708993-5683276719-19000

Even though you use a username to access the system, Windows identifies each user,

group, or object by the SID. For example, Windows uses the SID to look up a user account

and see whether a password matches. Also, SIDs are used in every situation in which

permissions need to be checked—for example, when a user attempts to access a folder or

shared resource.

Services and Ports of Interest

When moving into the enumeration phase, you should know those ports and services that

are commonly used and what type of information they can offer to you as an attacker. You

should expect during your scanning phase to uncover a number of ports. Here are a few

that you should make sure you pay close attention to:

TCP 53 This port is used for DNS Zone transfers, the mechanism through which the

DNS system keeps servers up to date with the latest zone data.

TCP 135 This port is used during communications between client-server applications,

such as allowing Microsoft Outlook to communicate with Microsoft Exchange.

TCP 137 This port associated with NetBIOS Name Service (NBNS) is a mechanism

designed to provide name resolution services involving the NetBIOS protocol. The service

allows NetBIOS to associate names and IP addresses of individuals systems and services. It

is important to note that this service is a natural and easy target for many attackers.