Title: Hacking Quiz 1

Author: Anonymous

1. What is this: "/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir"?

2. What characters are most common in hacking perl cgi's?

3. %63%61%6e %79%6f%75 %72%65%61%64 %74%68%69%73 ?

4. How do you get the version and type of a web server?

5. Why is the url "/123.htw" useful?

6. When is a single quote useful?

7a. You have found a hole in a windows nt/2000 system. It is an unpatched IIS4.0 and you want to transfer nc.exe to the server. There is only one small problem the admin has removed tftp.exe. How do you transfer nc.exe to the server?

7b. Now you want to use nc.exe to get a remote command prompt on the server. How do you start it?

7c. How can you use nc.exe to transfer files to the server?

8a. Someone is pinging your windows NT4.0 server on port 59. Why is this a problem?

8b. What do you do about it?

9. You have full access to the registry on a remote server. How can you use this to execute commands on the server?

10a. Where is the sam-file on windows 2000 systems?

10b. How do you create a new sam-file on a windows 2000 professional system?

10c. What can you tell me about the sam-file?

11. What is a null-session?

12a. You download a program, EAzyChat 2.3, and you install it. EAzyChat checks for new versions and auto updates. New versions are checked on www.eazychat.com/version.asp and updates are downloaded from www.eazychat.com/newsoft.exe.
Why is this a problem?

12b. Is it possible to exploit this and if so how would you do that?

13. What windows tools do you use?

14a. Name the programs which normaly start when you doubleclick the folowing files:

a. nice.jpg
b. cool.html
c. test.exe
d. info.txt
e. data.mdb
f. text.hta

14b. Rank the files on a scale from 1 to 6. 1 is the most dangerous, 6 is the least dangerous.

15a. Sally likes 225 but not 224; she likes 900 but not 800; she likes 144 but not 145. Which does she like:

a. 1500
b. 1600
c. 1700
d. 3141

15b. How did you come to this conclusion?

16. What kind of information do you get when you type "netstat -an" on a windows 2000 professional system with 256MB ram?