List of open ports :
Information found on port ftp (21/tcp)
bonsai microsoft ftp service (version 4.0).
500 'get / http/1.0':
command not understood
Information found on port ftp (21/tcp)
The FTP service allows anonymous logins. If you do not
want to share
data with anyone you do not know, then you should deactivate
the anonymous
account, since it can only cause troubles.
Under most Unix system, doing :
echo ftp >> /etc/ftpusers
will correct this.
Risk factor :
Low
CVE :
CAN-1999-0497
Information found on port smtp (25/tcp)
bonsai.fr.nessus.org ESMTP CommuniGate Pro 3.1.
214-Commands
Supported:214-HELO EHLO AUTH HELP QUIT MAIL NOOP RSET RCPT DATA ETRN VRFY
STARTTLS
214-Copyright (c) 1995-1998, Stalker Software,
Inc.
214-To report problems, send mail to
<support@stalker.com>
214-
214 End Of Help
Information found on port smtp (25/tcp)
The remote STMP server seems to allow remote users to
send mail
anonymously by providing a too long argument
to the HELO command (more than
1024 chars).
This problem may allow bad guys to send hate
mail, or
threatening mail using your server
and keep their anonymity.
Risk
factor : Low.
Solution : If you are using sendmail, upgrade
to
version 8.9.x. If you do not run sendmail, contact
your vendor.
CVE :
CAN-1999-0098
Information found on port smtp (25/tcp)
The remote SMTP server allows the relaying. This means that
it allows
spammers to use your mail server to send their mails to
the world, thus
wasting your network bandwidth.
Risk factor :
Low/Medium
Solution : configure your SMTP server so that it can't be
used as a relay
any more.
CVE :
CAN-1999-0512
Vulnerability found on port www (80/tcp)
Vulnerability found on port www (80/tcp)
Vulnerability found on port www (80/tcp)
Vulnerability found on port www (80/tcp)
Vulnerability found on port www (80/tcp)
Vulnerability found on port www (80/tcp)
Vulnerability found on port www (80/tcp)
Vulnerability found on port www (80/tcp)
Vulnerability found on port www (80/tcp)
Information found on port www (80/tcp)
Microsoft-IIS/4.0
Information found on port www (80/tcp)
The remote web server appears to be running with
Frontpage
extensions.
You should double check the configuration since
a lot
of security problems have been found with
FrontPage when the configuration
file is
not well set up.
Risk factor : High if your configuration
file is
not well set up
CVE :
CVE-1999-0386
Information found on port pop-3 (110/tcp)
CommuniGate Pro POP3 Server 3.1 ready
<3.958234756@bonsai.fr.nessus.org>
Vulnerability found on port netbios-ssn (139/tcp)
Vulnerability found on port netbios-ssn (139/tcp)
Vulnerability found on port netbios-ssn (139/tcp)
Information found on port netbios-ssn (139/tcp)
The remote registry can be accessed remotely
using the login /
password combination used
for the SMB tests.
Having the registry
accessible to the world is
not a good thing as it gives extra knowledge
to
a hacker.
Solution : filter incoming traffic to this port or
set
tight login restrictions.
Risk factor : Low
Information found on port netbios-ssn (139/tcp)
The domain SID can be obtained remotely. Its value is :
INTRANET :
5-21-20333150-368275040-1648912389
An attacker can use it to obtain the
list of the users of the domain
Solution : filter the ports 137 to
139
Risk factor : Low
Information found on port netbios-ssn (139/tcp)
The domain SID could be used to enumerate the names of the users
in the
domain.
(we only enumerated users name whose ID is between 1000 and
1050
for performance reasons)
This gives extra knowledge to a cracker,
which
is not a good thing :
- Administrator account name :
Administrator (id 500)
- Guest account name : guest (id 501)
- BONSAI$
(id 1000)
- IUSR_BONSAI (id 1001)
- Renaud (id 1002)
- thibault (id
1003)
- MTS Trusted Impersonators (id 1005)
- IWAM_BONSAI (id 1006)
-
Cert Requesters (id 1007)
- Cert Server Admins (id 1008)
- PROFWINDOWS$
(id 1009)
Risk factor : Medium
Solution : filter incoming
connections to port 139
Information found on port netbios-ssn (139/tcp)
Here is the browse list of the remote host :
BONSAI -
PROF23567
- Samba Server
This is potentially dangerous as this may help the
attack
of a potential hacker by giving him extra targets to check
for
Solution : filter incoming traffic to this port
Risk factor :
Low
Information found on port netbios-ssn (139/tcp)
Here is the list of the SMB shares of this host :
NETLOGON - Logon
server share
A - disquette
C -
IPC$ - Remote IPC
IAS1$ -
src$ -
This is potentially dangerous as this may help the
attack
of a potential hacker.
Solution : filter incoming traffic to
this port
Risk factor : Medium
Information found on port unknown (554/tcp)
a web server is running on this port
Information found on port unknown (5228/tcp)
a web server is running on this port
Information found on port unknown (7070/tcp)
a web server is running on this port
Information found on port unknown (8010/tcp)
a web server is running on this port
Information found on port unknown (8010/tcp)
CommuniGatePro/3.1
Information found on port webcache (8080/tcp)
a web server is running on this port
Information found on port unknown (8100/tcp)
a web server is running on this port
Information found on port unknown (8100/tcp)
CommuniGatePro/3.1
Information found on port unknown (8570/tcp)
a web server is running on this port
Information found on port unknown (8570/tcp)
Microsoft-IIS/4.0
Information found on port general/tcp
Nmap found that this host is running Microsoft NT 4.0 Server SP5 + 2047
Hotfixes
Information found on port general/tcp
If numbers are close together, or rise by the same number all the
time,
it means that the amount of traffic can be predicted by
monitoring
changes in the idetification numbers (since these aren't
randomized
enough).
This may help attackers with several other
attacks, such as Session
Hijacking or with Session Spoofing, where in those
cases the attacker
needs to predict certain charactistics of the attacked
computer (such
as traffic size).
The IP Identification numbers
retrieved and their relative size were:
ID: 50191
ID: 50447 relative
size: 256
ID: 50703 relative size: 256
ID: 50959 relative size:
256
ID: 51215 relative size: 256
ID: 51471 relative size: 256
ID:
51727 relative size: 256
ID: 51983 relative size: 256
ID: 52239 relative
size: 256
ID: 52495 relative size: 256
Information found on port general/udp
For your information, here is the traceroute to 192.168.1.8 :
192.168.1.8
Information found on port netbios-ns (137/udp)
. The following 11 NetBIOS names have been gathered :
BONSAI = This is
the computer name registered for workstation services by a WINS
client.
BONSAI
INTRANET = Workgroup / Domain name
INTRANET
INTRANET
BONSAI = Computer name that is registered for the messenger
service on a computer that is a WINS client.
INTRANET
INTRANET
__MSBROWSE__
INet~Services
IS~BONSAI = This is the computer name
registered for workstation services by a WINS client.
. The remote host has
the following MAC address on its adapter :
0x00 0x80 0xad 0x90 0x23 0x14
If you do not want to allow everyone to find the NetBios name
of
your computer, you should filter incoming traffic to this port.
Risk
factor : Medium