Re: [Call for Testers] Ncrack RDP module

[Thomas Buchanan <tbuchanan () thecompassgrp net>]

ithilgore wrote:
> On 08/23/10 21:19, ithilgore wrote:
>  >
>  > OK I checked this against both Windows Vista Business SP 2 and Windows 7
>  > Professional and whenever I already have an active remote desktop session
>  > OR I am locally logged in and I start off a new remote desktop session
>  > giving the right credentials, then the previous session immediately shuts
>  > down and I can log in normally with the new one. I am *not* presented 
> with
>  > a screen in which I get to choose whether or not I want to forcibly
>  > disconnect the currently active session.
>  >
>  > You said that you tried this in Windows 7 Ultimate (which I unfortunately
>  > can't test right now), so it might be that this screen pertains only to
>  > that Windows version.
>
> I just set up a clean installation of Windows 7 Ultimate and I also came
> across the same behaviour as the other Windows versions: a new successful
> remote desktop session immediately kills and replaces the currently active
> session. So I assume that there was some other non-default configuration
> taking place in your box. I would appreciate it if you would let me know
> what that is.
>
>  >
>  > I might be able to get another unique fingerprint to detect that special
>  > case, but first tell me if there were some other special 
> configurations in
>  > relation to the remote desktop server in your Windows 7 Ultimate box. 
> This
>  > might be a local group policy configuration perhaps. Was it a new and 
> clean
>  > Windows installation? If it was, then we can be almost certain that it is
>  > the *Ultimate* version that does this kind of thing and not some other
>  > configuration option.
>  >
>
> Thanks,
> ithilgore

Thanks for looking at this some more.  I can't recall doing any special 
configuration for Remote Desktop on this system, but it's been my 
primary desktop for over a year now, so something may have gotten 
changed along the way that I've forgotten now.  Also, I think I 
installed this system from a Microsoft public release candidate of 
Windows 7, and then just updated from there, so it may have different 
default settings than the final release.

One page I found online mentioned that enabling Fast User Switching may 
have an impact on this behavior, do you know if your system has that 
option?  Mine appears to have it enabled, although I can't find a 
graphical way to toggle the setting.  Apparently the Registry key 
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ 
Policies \ System \ HideFastUserSwitching may have some effect on it [1].

I'd be happy to send you a screenshot of the message that appears when I 
connect, as well as network packet captures if it helps.

Thanks,

Thomas


1. 
http://social.answers.microsoft.com/Forums/en-US/w7security/thread/643ea7cd-d98a-42be-b8d4-ba37801a9ea8
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/