Re: [Call for Testers] Ncrack RDP module

[ithilgore <ithilgore.ryu.l () gmail com>]

On 08/24/10 21:38, Thomas Buchanan wrote:
> ithilgore wrote:
> > On 08/23/10 21:19, ithilgore wrote:
> >  >
> >  > OK I checked this against both Windows Vista Business SP 2 and Windows 7
> >  > Professional and whenever I already have an active remote desktop session
> >  > OR I am locally logged in and I start off a new remote desktop session
> >  > giving the right credentials, then the previous session immediately shuts
> >  > down and I can log in normally with the new one. I am *not* presented
> > with
> >  > a screen in which I get to choose whether or not I want to forcibly
> >  > disconnect the currently active session.
> >  >
> >  > You said that you tried this in Windows 7 Ultimate (which I unfortunately
> >  > can't test right now), so it might be that this screen pertains only to
> >  > that Windows version.
> >
> > I just set up a clean installation of Windows 7 Ultimate and I also came
> > across the same behaviour as the other Windows versions: a new successful
> > remote desktop session immediately kills and replaces the currently active
> > session. So I assume that there was some other non-default configuration
> > taking place in your box. I would appreciate it if you would let me know
> > what that is.
> >
> >  >
> >  > I might be able to get another unique fingerprint to detect that special
> >  > case, but first tell me if there were some other special
> > configurations in
> >  > relation to the remote desktop server in your Windows 7 Ultimate box.
> > This
> >  > might be a local group policy configuration perhaps. Was it a new and
> > clean
> >  > Windows installation? If it was, then we can be almost certain that it is
> >  > the *Ultimate* version that does this kind of thing and not some other
> >  > configuration option.
> >  >
> >
> > Thanks,
> > ithilgore
>
> Thanks for looking at this some more.  I can't recall doing any special
> configuration for Remote Desktop on this system, but it's been my primary
> desktop for over a year now, so something may have gotten changed along the
> way that I've forgotten now.  Also, I think I installed this system from a
> Microsoft public release candidate of Windows 7, and then just updated from
> there, so it may have different default settings than the final release.

This is important info there. Probably this behaviour stopped occurring in
the final Windows 7 releases. Has anyone else seen this in any *final
release* Windows 7 system?

> One page I found online mentioned that enabling Fast User Switching may
> have an impact on this behavior, do you know if your system has that
> option?  Mine appears to have it enabled, although I can't find a graphical
> way to toggle the setting.  Apparently the Registry key HKEY_LOCAL_MACHINE
> \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Policies \ System \
> HideFastUserSwitching may have some effect on it [1].

I checked my Windows 7 Ultimate system and there is no such registry key in
there, so Fast User Switching must be on (it is on by default and this is a
clean installation). I also created a second test account in case that
affected things but still nothing changed.

> I'd be happy to send you a screenshot of the message that appears when I
> connect, as well as network packet captures if it helps.

Yes, please do send me a screenshot and the network packet captures.

> Thanks,
>
> Thomas
>
>
> 1.
> http://social.answers.microsoft.com/Forums/en-US/w7security/thread/643ea7cd-d98a-42be-b8d4-ba37801a9ea8


-- 
http://sock-raw.org
http://twitter.com/ithilgore
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/