---[  Phrack Magazine   Volume 8, Issue 52 January 26, 1998, article 10 of 20


-------------------------[  a Quick nT Interrogation Probe (QTIP)


--------[  twitch <twitch@aye.net>


----[  INTRODUCTION


    As you probably already know, certain LanMan derivatives (most notably
Windows NT) sport a stupid feature known as `null sessions`.  Null sessions
allow server connections to be established without the hassle and rigmarole of
username or password authentication.  This is reportedly to ease
administrative tasks (UserManager and ilk utilize them).  Also, such silliness
such as the RedButton bug have shown (although in poor form) that an 
interested/malicious third party can gleen quite a bit of info from `Press any
key to return to index`.  Once established, these connections default to having
permissions to display enumerated user and share lists, get information about 
particular users, wander the registry, etc.  QTIP takes advantage of this,
allowing the user to procure far too much information about the target
machine.  It employs no black magic or hidden technique to do this.  QTIP
works via straight API calls.

    As of service pack 3 for NT 4.0, it is possible for the `informed` system
administrator to block null sessions through the registry, effectively
nullifying any threat from QTIP.  I do not, however, believe that there is
such a patch for 3.5.1 machines.  Also, it has not been tested against SAMBA
servers, and as far as the author knows, SAMBA does not support something as
asinine as null sessions (anyone who knows any differently is invited to mail
corrections to the author, or directly to Phrack Magazine).

    To prevent these sorts of shenanigans from happening remotely across the
Internet, the concerned system administrator can block NBT traffic at the
gateway (this sort of traffic should not be allowed to/from the Internet as
standard fare).  If you are running NT 4.0, install the service packs, and set
the appropriate registry values to disable the attack.  Or use OpenBSD.


----[  THE CODE


    QTIP has a few options.  qtip -h supplies the following info:

usage qtip[asug<username>hv] <target>
        -s:             get share list
        -u:             get user list
        -g <username>:  get infos about <username>
        -d:             leave connection established on exit
        -a:             -s + -u
        -h, -?:         display this help
        -v:             be verbose (use twice to be garrulous)

    Seems rather self explanatory.  If the verbose flag is set, then -u
implies a recursive -g.  -d is handy if you plan to take a look at the
registry as well (there's gold in them thar hills).  Omission of all flags just
establishes a null session and exits.  <target> can be a fully-qualified
domain name, ip address, or UNC format.  The code compiles like a dream under
visual c 4.1.  There is no makefile included, just link the code against 
kernel32.lib, libc.lib and wsock32.lib.  This program is most useful wrapped 
in scripts with something like tping(ip sweeper), and maybe a few registry
inquisition perl scripts.  Feel free to redistribute, just give props where
props are due, and please let me know if you make any interesting changes.

<++> qtip/qtip.h
/*
 * qtip.h
 * 12/04/1997
 * twitch
 * twitch@aye.net
 *
 * a quick nt investigative probe. (mis)uses null sessions to collect
 * sundry information about a WindowsNT server.  distribute as you
 * please.  be alert, look alive, and act like you kow.
 *
 * '...i should dismiss him, in order to teach him that pleasure consists
 *     not in what i enjoy, but in having my own way.'
 *       -sk, either/or
 */

#include <stdio.h>
#include <windows.h>
#include <winsock.h>
#include "lm.h"

#define k16             16384
#define TARG_LEN        255
#define USER_LEN        22

void handle_error(DWORD);
void prepend_str(char *, char*);
int  open_session();
int  procure_userlist();
int  procure_sharelist();
void parse_cl(int, char **);
void usage(char *);
int powerup(int, char **);
void bail(const char *);
int  close_session();
void get_usr_info(wchar_t *);

/* couple o globals to make my life easier */
u_int           OPT_SHARES, OPT_USERS, OPT_GETUI;
u_int           OPT_NODEL,  VERB;
char            target[TARG_LEN];
WCHAR           utarg[TARG_LEN];
WCHAR           user[USER_LEN];
NETRESOURCE     nr;

<-->
<++> qtip/qtip.c

/*
 * qtip.c
 * 10/04/1997
 * twitch
 * twitch@aye.net
 *
 * a quick nt investigative probe
 * link against kernel32.lib, libc.lib and wsock32.lib.
 * qtip -h for usage.  distribute as you please.
 *
 */

#include "qtip.h"

int main(int argc, char *argv[])
{
   if( (powerup(argc, argv)) )
      return(1);

   if( (open_session()) != 0)
      return(1);

   if(OPT_SHARES)
      procure_sharelist();

   if(OPT_USERS)
      procure_userlist();

   if(OPT_GETUI)
      get_usr_info(utarg);

        close_session();
   return(0);
}

int open_session()
{
   DWORD                        r;

   nr.dwType    = RESOURCETYPE_ANY;
   nr.lpLocalName       = NULL;
   nr.lpProvider        = NULL;
   nr.lpRemoteName = target;

   if(VERB)
      printf("establishing null session with %s...\n", target);

   r = WNetAddConnection2(&nr, "", "", 0);
   if(r != NO_ERROR){
      handle_error(r);
      return -1;
   }

   if(VERB)
     printf("connection established\n");

   return 0;
}

/*
 * procure_userlist()
 *    just use the old lm NetUserEnum() because there isnt comparable
 *    functionality in the WNet sect.  i just wish the win32 api was
 *    more bloated and obtuse.
 */
int procure_userlist()
{
   NET_API_STATUS               nas;
   LPBYTE                               *buf = NULL;
   DWORD                                        entread, totent, rhand;
   DWORD                                        maxlen = 0xffffffff;
   USER_INFO_0                  *usrs;
   unsigned int    i;
   int                                  cc = 0;

   entread = totent = rhand = nas = 0;
   if( (buf = (LPBYTE*)malloc(k16)) == NULL)
                bail("malloc probs\n");

   if(VERB)
     wprintf(L"\ngetting userlist from %s...\n", utarg);

   nas = NetUserEnum(utarg, 0, 0, buf, maxlen, &entread, &totent, &rhand);
   if(nas != NERR_Success){
     fprintf(stderr, "couldnt enum users, ");
     handle_error(nas);
     goto cleanup;
   }

   cc = sizeof(USER_INFO_0) * entread;
   if( (usrs = (USER_INFO_0 *)malloc(cc)) == NULL){
     fprintf(stderr, "malloc probs\n");
     goto cleanup;
   }

   memcpy(usrs, *buf, cc);
   for(i = 0; i < entread; i++){
                wcscpy(user, usrs[i].usri0_name);
                wprintf(L"%s\n", user);
                if(VERB)
                        get_usr_info(utarg);
    }

cleanup:
   if(buf)
     free(buf);

   return 0;
}

/*
 * get_user_info()
 *    attempt to gather some interesting facts about
 *              a user
 */
void get_usr_info(LPWSTR utarg)
{
   NET_API_STATUS nas;
   USER_INFO_1          usrinfos;
   LPBYTE         *buf = NULL;

   if( !(buf = (LPBYTE *)malloc(sizeof(USER_INFO_1))) )
     bail("malloc probs\n");

   nas = NetUserGetInfo(utarg, user, 1, buf);

   if(nas){
     fwprintf(stderr, L"couldnt get user info for for %s, ", user);
     handle_error(nas);
   }
   else{
     memcpy(&usrinfos, *buf, sizeof(USER_INFO_1));

     /* most of these will never happen, but nothings lost trying */
     if( (UF_PASSWD_NOTREQD & usrinfos.usri1_flags) )
       printf("\t-password not required, how about that.\n");
     if( (UF_ACCOUNTDISABLE & usrinfos.usri1_flags) )
       printf("\t-account disabled\n");
     if( (UF_LOCKOUT & usrinfos.usri1_flags) )
       printf("\t-account locked out\n");
     if( (UF_DONT_EXPIRE_PASSWD & usrinfos.usri1_flags) )
       printf("\t-password doesnt expire\n");
     if( (UF_PASSWD_CANT_CHANGE & usrinfos.usri1_flags) )
       printf("\t-user cant change password\n");
     if( (UF_WORKSTATION_TRUST_ACCOUNT & usrinfos.usri1_flags) )
       printf("\t-account for some other box in this domain\n");
     if( (UF_SERVER_TRUST_ACCOUNT & usrinfos.usri1_flags) )
       printf("\t-account for what is prolly the BDC\n");
     if( (UF_INTERDOMAIN_TRUST_ACCOUNT & usrinfos.usri1_flags) )
       printf("\t-interdomain permit to trust account\n");
   }

   free(buf);
}

/*
 * procure_sharelist()
 *    strangely enough, this retrieves a sharelist from target
 */
int procure_sharelist()
{
   DWORD                        r;
   DWORD                        bufsize = 16384, cnt = 0xFFFFFFFF;
   HANDLE               enhan;
   void                 *buf;
   NETRESOURCE  *res;
   u_int                        i;

   if( (buf = malloc(bufsize)) == NULL){
      fprintf(stderr, "malloc probs, bailing\n");
      return -1;
   }

   nr.dwScope                   = RESOURCE_CONNECTED;
   nr.dwType                    = RESOURCETYPE_ANY;
   nr.dwDisplayType     = 0;
   nr.dwUsage                   = RESOURCEUSAGE_CONTAINER;
   nr.lpLocalName               = NULL;
   nr.lpRemoteName      = (LPTSTR)target;
   nr.lpComment    = NULL;
   nr.lpProvider                = NULL;

   r = WNetOpenEnum(RESOURCE_GLOBALNET, RESOURCETYPE_ANY,
                                                  RESOURCEUSAGE_CONNECTABLE, &nr
, &enhan);
   if(r != 0){
                free(buf);
                printf("open_enum failed, sorry- ");
                handle_error(r);
                return -1;
   }

   r = WNetEnumResource(enhan, &cnt, buf, &bufsize);
   if(r != 0){
      free(buf);
      printf("enum_res failed- ");
                handle_error(r);
                return -1;
   }

   res = (NETRESOURCE*)malloc(cnt * sizeof(NETRESOURCE));
   if(res == NULL){
      free(buf);
      printf("malloc probs, i wont be listing shares.\n");
                return -1;
   }
   memcpy(res, buf, (cnt * sizeof(NETRESOURCE)) );

   for(i = 0; i < cnt; i++){
      if(VERB)
                        printf("\nshare name:\t");

      printf("%s\n", res[i].lpRemoteName);
      if(VERB){
                        printf("share type:\t");
                        if(res[i].dwType = RESOURCETYPE_DISK)
                                printf("disk");
                        else
                                printf("printer");
                                printf("\ncomment:\t%s\n", res[i].lpComment);
                }
   }

   free(buf);
   free(res);
   return 0;
}

/*
 * close_session()
 *    clean up our mess
 */
int close_session()
{
   DWORD                r;

   WSACleanup();
   if(!OPT_NODEL)
      r = WNetCancelConnection2(target, 0, TRUE);

   if(r != 0){
      fprintf(stderr, "couldnt delete %s, returned %d\n", target, r);
      return -1;
   }
   else{
      if(VERB)
                        printf("connection to %s deleted\n", target);
   }

   return 0;
}

/*
 * handle_error()
 *    util function to deal with some errors.
 */
void handle_error(DWORD err)
{
   switch(err){
   case ERROR_ACCESS_DENIED:
                fprintf(stderr, "access is denied.\n");
                break;
   case ERROR_BAD_NET_NAME:
                fprintf(stderr, "bad net name.\n");
                break;
   case ERROR_EXTENDED_ERROR:
                fprintf(stderr, "an extended error occurred.\n");
                break;
   case ERROR_INVALID_PASSWORD:
                fprintf(stderr, "invalid password.\n");
                break;
   case ERROR_LOGON_FAILURE:
                fprintf(stderr, "bad username or password.\n");
                break;
   case NO_ERROR:
                fprintf(stderr, "it worked\n");
                break;
   case ERROR_BAD_NETPATH:
                fprintf(stderr, "network path not found.\n");
                break;
   default:
                fprintf(stderr, "a random error occurred (%d).\n", err);
        }
}

/*
 * prepend_str()
 *    util funk to prepend chars to a string
 */
void prepend_str(char *orgstr, char *addthis)
{
   orgstr = _strrev(orgstr);
   addthis = _strrev(addthis);
   strcat(orgstr, addthis);
   orgstr = _strrev(orgstr);
}
/*
 * parse_cl()
 *    try and make sense of the command line.  no, i dont have a win32 getopt.
 *    yes, i know i should
 */
void parse_cl(int argc, char **argv)
{
   int     i, cc;
   char    opt;
   DWORD                r;

   OPT_SHARES = OPT_USERS = VERB = 0;

   for(i = 1; i < (argc); i++){
      if( (*argv[i]) == '-'){
                        opt = *(argv[i]+1);
                        switch(opt){
                        case 'a':
                                OPT_SHARES = 1;
                                OPT_USERS  = 1;
                                break;
                        case 's':
                                OPT_SHARES = 1;
                        break;
                        case 'u':
                                OPT_USERS  = 1;
                        break;
                        case 'g':
                                OPT_GETUI  = 1;
                                if( (strlen(argv[i+1])) > USER_LEN)
                                        bail("username too long (must be < 21)");
                                ZeroMemory(user, USER_LEN);
                                cc = strlen(argv[++i]);
                                r = MultiByteToWideChar(CP_ACP, 0, argv[i], cc, user, (cc + 2));
                                break;
                        case 'd':
                                OPT_NODEL = 1;
                                break;
                        case 'v':
                                VERB++;
                                break;
                        default:
                                if( (opt != 'h') && (opt != '?') )
                                        fprintf(stderr, "unknown option '%c'\n", opt);
                                usage(argv[0]);
                                break;
                        }
                }
   }

        if( (OPT_SHARES) && (VERB) )
      printf("listing shares\n");
   if( (OPT_USERS) && (VERB) )
      printf("listing users\n");
   if( (OPT_GETUI) && (VERB) )
      wprintf(L"getting infos about user %s\n", user);
   if(VERB)
      printf("verbosity = %d\n", VERB);
}

/*
 * powerup()
 *    just init stuff and parse the command line
 */
int powerup(int argc, char **argv)
{
   struct hostent       *hent;
   u_long       addie;
   WORD         werd;
   WSADATA      data;
   char         buf[256];
   int          cc = 0, ucc = 0;

   if(argc < 3)
      usage(argv[0]);

   parse_cl(argc, argv);
   ZeroMemory(buf, 256);
   strcpy(buf, argv[argc - 1]);

/* if not unc format get the ip */
   if(buf[0] != '\\'){
      if(VERB > 1)
                        printf("target not in unc\n");

      werd = MAKEWORD(1, 1);
      if( (WSAStartup(werd, &data)) !=0 )
                        bail("couldnt init winsock\n");

      hent = (struct hostent *)malloc(sizeof(struct hostent));
      if(hent == NULL)
                        bail("malloc probs\n");

      if( (addie = inet_addr(buf)) == INADDR_NONE){
                        hent = gethostbyname(buf);
                        if(hent == NULL){
                                fprintf(stderr, "fatal: couldnt resolve %s.\n", buf);
                                return -1;
                        }
                        ZeroMemory(buf, 256);
                        strcpy(buf, inet_ntoa(*(struct in_addr *)*hent->h_addr_list));
      }
      prepend_str(buf, "\\\\");
   }
   else
      fprintf(stderr, "target already in unc\n");

   if( (strlen(buf) > (TARG_LEN - 1)) ){
      free(buf);
      bail("hostname too long (must be < 255 chars.)");
      return -1;
   }

   ZeroMemory(target, TARG_LEN);
   strcpy(target, buf);

   ZeroMemory(utarg, TARG_LEN);
   cc = strlen(target);
   ucc = MultiByteToWideChar(CP_ACP, MB_PRECOMPOSED, target, cc, utarg, cc);
   if(ucc < 1){
      bail("unicode conversion probs, sorry");
      return -1;
   }

   return 0;
}

void usage(char *prog)
{
   fprintf(stderr, "usage: %s [asug<username>hv] <target>\n", prog);
   fprintf(stderr, "\t-s:\t\tget share list\n");
   fprintf(stderr, "\t-u:\t\tget user list\n");
   fprintf(stderr, "\t-g: <username>\tget infos about just <username>\n");
   fprintf(stderr, "\t-d:\t\tleave connection established on exit\n");
   fprintf(stderr, "\t-a:\t\t-s + -u\n");
   fprintf(stderr, "\t-h, -?:\t\tdisplay this help\n");
   fprintf(stderr, "\t-v:\t\tbe verbose (use twice to be garrolous)\n");
   exit(0);
}

/*
 * bail()
 *    just whine and die
 */
void bail(const char *msg)
{
   fprintf(stderr, "fatal: %s\n", msg);
   close_session();
   exit(1);
}
<-->


----[  EOF