« first day (3599 days earlier)      last day (1271 days later) » 

John Zhau
John Zhau
7:20 AM
Is it normal to see a Microsoft server with some http ports (but no web) and ports 515 (LPD) & 631 (IPP)?
Seeing the printer ports, I'd assume it's a printer, but I'm not sure why printers would run on Windows and have a bunch of http ports open...
I'm not sure how common it is for servers/workstations to have ports 515 & 631 open though
 
 
5 hours later…
MechMK1
MechMK1
12:31 PM
@JohnZhau How would you know it's windows?
 
 
1 hour later…
MechMK1
MechMK1
1:47 PM
0
A: Attack against OTP Cipher

MechMK1How does a One-Time Pad work? Imagine you have a message M which is encrypted with a key K, which then results in a ciphertext C. Let us assume that the process through which the encryption occurs is an XOR, which I'll show by the ^ symbol. Furthermore, we assume M, K and C all have the same leng...

Heard y'all want to crack some OTP ciphers
Here are the rules quickly:

You intercepted three messages. You know they're all encrypted with the same key. You know all messages only contain either uppercase ASCII or spaces.
C1 = 553a9026b3b648376fc145f7e84761782152
C2 = 42339755cab04e3761ca24f9e63466712f44
C3 = 4826f938d2a63b596dcc45f8e8347778354e
 
John Zhau
John Zhau
@MechMK1 Ports & services for Windows (SMB, MSRPC, etc), Windows IIS default page on HTTP ports, multiple banners of Windows services, none typical of Linux
 
MechMK1
MechMK1
@JohnZhau And you want to know why the printer ports are open?
It could be a printer, it could also be a server which "acts" like a printer and distributes print jobs to other printers
 
John Zhau
John Zhau
2:03 PM
Actually I think it didn't have a ton of services but certainly weird
Well an acting-printer seems like a good reason
 
MechMK1
MechMK1
If you look at the description of CUPS, that's exactly what it does:
CUPS
CUPS (formerly an acronym for Common UNIX Printing System) is a modular printing system for Unix-like computer operating systems which allows a computer to act as a print server. A computer running CUPS is a host that can accept print jobs from client computers, process them, and send them to the appropriate printer. CUPS consists of a print spooler and scheduler, a filter system that converts the print data to a format that the printer will understand, and a backend system that sends this data to the print device. CUPS uses the Internet Printing Protocol (IPP) as the basis for managing print jobs...
> A computer running CUPS is a host that can accept print jobs from client computers, process them, and send them to the appropriate printer.
Now I'll be the first to admit that printers are fucking voodoo to me, but that at least would make sense in a corporate setting. Configure one print server on all workstations and then have IT configure all printers on the print server.
 
John Zhau
John Zhau
I'm totally new to this too. First time working with UDP scan & UDP services.
 
MechMK1
MechMK1
@JohnZhau The thing to know about UDP is that most UDP fingerprinting does not work nearly as accurately as TCP
I assume you know why programs use UDP instead of TCP?
 
John Zhau
John Zhau
yes
 
MechMK1
MechMK1
Alright
 
John Zhau
John Zhau
2:11 PM
speed > integrity
The uncertainties make scanning slower & less accurate
UDP is for when you just wanna yeet stuff over as fast as you can without caring about how the deliveries arrive
 
MechMK1
MechMK1
Exactly. And due to this, most UDP stuff uses custom protocols to be as fast as possible
 
John Zhau
John Zhau
It's like trying to hand out eggs by facing a pile of eggs & continously throwing them behind you without looking and hoping someone catches the eggs
It's fun trying to come up with UDP examples
 
MechMK1
MechMK1
If you encounter a UDP port, check if it's DNS and if not just let it be
 
John Zhau
John Zhau
Printers are known to be very insecure so I think they should be an easy way in with some common tools right?
 
MechMK1
MechMK1
Depends, I'm not really the internal security guy
 
John Zhau
John Zhau
2:20 PM
I'm learning both internal & external
I do a bit of everything so I never get bored with all the stuff I can switch to and try
 
Fire Quacker
Fire Quacker
2:56 PM
@MechMK1 K = 0172d97593ff1b17229865baad1432396617
@JohnZhau That's what I heard. Printers get overlooked, but network-wise have access to a lot (because everybody needs to print). So outdated firmware/default credentials + network access = great pivot point
 

« first day (3599 days earlier)      last day (1271 days later) »