Home page logo
/

pen-test logo Penetration Testing mailing list archives

Re: Hacking Lotus Domino 5.0.5
From: Josh Daymont <joshd () midgard net>
Date: Wed, 17 Oct 2001 19:19:22 -0700 (PDT)


Renato,

You should probably call Application Security Inc. (ASI).  They are close
to releasing a beta-test version of a Lotus Domino Scanning/PenTesting
application that should provide all the functionality that you'll need.
This includes an account password brute forcing capability, backdoor
detection functionality and much more.  ASI can be reached at (212)
490-6022 and or http://www.appsecinc.com/.

In case your engagement ends before ASI releases, here are a few things
you may want to try.  This isn't an exhuastive list of things to do and is
just intended as a starter:

With the names.nsf database you should be able to brute force some of the
Domino accounts.  Currently the only source for software like this that I
know of is ASI.

once you have brute forced some accounts...

First, can you gain access to an account that is permitted to use
webadmin.nsf?  This database will allow you to do some interesting stuff,
including the ability to edit text files on the local filesystem.  Just
access the database, click on the "Configuration" option, then the
"System Files" option, and then enter a file name, such as
"c:\winnt\win.ini."

Also, do you have access to the events database?  If so you can create a
dummy monitor which will execute a system command when it triggers.  Just
open up the events database and look under "Monitors."

Check out the unrestrited agent list in names.nsf.  If you can access an
account in this list and can either create databases and or have designer
level access to an existing database then you are homefree.  That assumes
that you either know LotusScript or Java.

Check the decsadmin.nsf database.  This database will list any RDBMS
databases that Domino is accessing.  Application Security Inc. (ASI) is
currently beta-testing an RDBMS PenTesting product for Oracle and other
databases that should allow you to gain access to just about any RDBMS by
providing just an IP address and or network block.

-Josh Daymont
joshd () midgard net

On Mon, 15 Oct 2001 renato.ettisberger () ch pwcglobal com wrote:

Hi

I'm doing a pen test for a client. They have many systems in the dmz,
including some nt/win2k boxes running IIS. Unfortunately, all IIS are
patched :-(. But I found a vulnerable Domino 5.0.5 Server. I was able to
download some nice files like names.nsf, the sam-file in winnt/repair and a
admin.nsf with all user names and passwords. I think, that's a finding :-),
but I want more.
Is there a way to get a shell? I'm able to create files on the server or at
least I can fill out a question form. Can I use this to create a file or
execute a command (I don't think so, but maybe...)? Or does anybody know
some other stuff, that I can do?

As you can see, I'm not a pro in Lotus Domino.

Thanks for your help

regards
Renato
----------------------------------------------------------------
The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential and/or privileged
material.  Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited.   If you received
this in error, please contact the sender and delete the material from any
computer.


----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/






----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault