Penetration Testing: Re: pcanywhere passwd capture

[cdowns <cdowns () skillsoft com>]

well as of yesterday i could easily kill the connections, i tried character
injections like " auth " and i heard the admin in the other cube say "allen did
you do that ?" so i didnt get to see what happened and i would likt to see that
for myself. they are running symetric encryption level so i was trying to see
if i could capture it.

hmmmm must be a way. could lets say do a man in the middle attack and ngrep the
connetion ? i already tried stack trace with MITM and no luck......

take care
-D

Andrew van der Stock wrote:

> If they are using "no encryption", you should be able to sniff it. If they
> are using a less than perfect configuration, which allows you pull down the
> encryption level, and you have a tool like hunt to help inject a correctly
> formatted response packet, and you're quicker than the respondant, and the
> TCP iss sequences are predictable, you should be able to similarly encourage
> "no encryption", but I doubt it's worth the effort.
>
> pcAnywhere prior to release 8 has a lot of issues. pcAnywhere 8 and 9 can
> still be killed off if you don't patch them properly. pcAnywhere 10 is
> pretty new and I have not had a chance to really play with it yet, but the
> options for secure operation are really good from the doco I've read.
>
> Andrew
>
> -----Original Message-----
> From: cdowns () securityfocus com [mailto:cdowns () securityfocus com]On
> Behalf Of cdowns
> Sent: Thursday, 21 June 2001 00:57
> To: pen-test () securityfocus com
> Subject: pcanywhere passwd capture
>
> is it possible to capture pcanywhere encryped passswd's during a MITM
> attack ? ive been trying several ways this morning with no success so im
> assuming im doing something wrong.
>
> thanks
> -D
--
------------------------------
    Christopher M Downs
Network Security Administrator
   Skillsoft Corporation
    cdowns () skillsoft com
"Micro$oft typed backwards
      spells "c:\duh /?"
------------------------------