The following plugin IDs have problems associated with them. Select the ID to review more detail.
Plugin id#![]() | # of issues![]() | Plugin name![]() | Severity![]() |
---|---|---|---|
10264 | 1 | SNMP Agent Default Community Names | High Severity problem(s) found |
41028 | 1 | SNMP Agent Default Community Name (public) | High Severity problem(s) found |
12218 | 1 | mDNS Detection | Medium Severity problem(s) found |
10736 | 7 | DCE Services Enumeration | Low Severity problem(s) found |
22964 | 2 | Service Detection | Low Severity problem(s) found |
11011 | 2 | Microsoft Windows SMB Service Detection | Low Severity problem(s) found |
10150 | 1 | Windows NetBIOS / SMB Remote Host Information Disclosure | Low Severity problem(s) found |
40448 | 1 | SNMP Supported Protocols Detection | Low Severity problem(s) found |
10551 | 1 | SNMP Request Network Interfaces Enumeration | Low Severity problem(s) found |
10800 | 1 | SNMP Query System Information Disclosure | Low Severity problem(s) found |
34022 | 1 | SNMP Query Routing Information Disclosure | Low Severity problem(s) found |
35296 | 1 | SNMP Protocol Version Detection | Low Severity problem(s) found |
10860 | 1 | SMB Use Host SID to Enumerate Local Users | Low Severity problem(s) found |
11936 | 1 | OS Identification | Low Severity problem(s) found |
43815 | 1 | NetBIOS Multiple IP Address Enumeration | Low Severity problem(s) found |
14274 | 1 | Nessus SNMP Scanner | Low Severity problem(s) found |
19506 | 1 | Nessus Scan Information | Low Severity problem(s) found |
10395 | 1 | Microsoft Windows SMB Shares Enumeration | Low Severity problem(s) found |
10396 | 1 | Microsoft Windows SMB Shares Access | Low Severity problem(s) found |
10456 | 1 | Microsoft Windows SMB Service Enumeration | Low Severity problem(s) found |
44401 | 1 | Microsoft Windows SMB Service Config Enumeration | Low Severity problem(s) found |
26917 | 1 | Microsoft Windows SMB Registry : Nessus Cannot Access the Windows Registry | Low Severity problem(s) found |
10785 | 1 | Microsoft Windows SMB NativeLanManager Remote System Information Disclosure | Low Severity problem(s) found |
10859 | 1 | Microsoft Windows SMB LsaQueryInformationPolicy Function SID Enumeration | Low Severity problem(s) found |
10394 | 1 | Microsoft Windows SMB Log In Possible | Low Severity problem(s) found |
17651 | 1 | Microsoft Windows SMB : Obtains the Password Policy | Low Severity problem(s) found |
10915 | 1 | Microsoft Windows - Local Users Information : User has never logged on | Low Severity problem(s) found |
10916 | 1 | Microsoft Windows - Local Users Information : Passwords never expire | Low Severity problem(s) found |
10913 | 1 | Microsoft Windows - Local Users Information : Disabled accounts | Low Severity problem(s) found |
10902 | 1 | Microsoft Windows 'Administrators' Group User List | Low Severity problem(s) found |
46215 | 1 | Inconsistent Hostname and IP Address | Low Severity problem(s) found |
12053 | 1 | Host Fully Qualified Domain Name (FQDN) Resolution | Low Severity problem(s) found |
35716 | 1 | Ethernet Card Manufacturer Detection | Low Severity problem(s) found |
54615 | 1 | Device Type | Low Severity problem(s) found |
45590 | 1 | Common Platform Enumeration (CPE) | Low Severity problem(s) found |
Plugin ID: 10785
Microsoft Windows SMB NativeLanManager Remote System Information Disclosure
Synopsis
It is possible to obtain information about the remote operating
system.
List of Hosts
192.168.2.220
Plugin Output
The remote Operating System is : Windows Vista (TM) Home Premium 6002 Service Pack 2
The remote native lan manager is : Windows Vista (TM) Home Premium 6.0
The remote SMB Domain Name is : MIDNIGHTBLUE
Description
It is possible to get the remote operating system name and
version (Windows and/or Samba) by sending an authentication
request to port 139 or 445.
Solution
n/a
Risk Factor
None
Plugin ID: 17651
Microsoft Windows SMB : Obtains the Password Policy
Synopsis
It is possible to retrieve the remote host's password policy using the
supplied credentials.
List of Hosts
192.168.2.220
Plugin Output
The following password policy is defined on the remote host:
Minimum password len: 0
Password history len: 0
Maximum password age (d): 42
Password must meet complexity requirements: Disabled
Minimum password age (d): 0
Forced logoff time (s): Not set
Locked account time (s): 1800
Time between failed logon (s): 1800
Number of invalid logon before locked out (s): 0
Description
Using the supplied credentials it was possible to extract the
password policy for the remote Windows host. The password policy must
conform to the Informational System Policy.
Solution
n/a
Risk Factor
None
Plugin ID: 10396
Microsoft Windows SMB Shares Access
Synopsis
It is possible to access a network share.
List of Hosts
192.168.2.220
Plugin Output
The following shares can be accessed as katrina :
- ADMIN$ - (readable,writable)
+ Content of this share :
..
agrsmdel.exe
AppPatch
assembly
atiogl.xml
bfsvc.exe
Boot
bootstat.dat
Branding
csup.txt
Cursors
Debug
DIFxAPI.dll
DigitalLocker
Downloaded Installations
Downloaded Program Files
Driver Cache
ehome
en-US
epplauncher.mif
explorer.exe
Fonts
fveupdate.exe
Globalization
Help
HelpPane.exe
Hewlett-Packard
hh.exe
HideWin.exe
HomePremium.xml
hpoins18.dat
hpomdl18.dat
IE9_main.log
IME
inf
Installer
L2Schemas
LiveKernelReports
Logs
Media
mib.bin
Microsoft.NET
Minidump
ModemLogs
MSAgent
msdfmap.ini
msdownld.tmp
nap
NDSTray.INI
notepad.exe
nsreg.dat
ocsetup_cbs_install_NetFx3.dpx
ocsetup_cbs_install_NetFx3.perf
ocsetup_install_NetFx3.etl
Offline Web Pages
Options
Panther
PCHEALTH
Performance
PFRO.log
PLA
PolicyDefinitions
Prefetch
PreOOBE.CMD
Provisioning
PUNAELC.CMD
regedit.exe
RegisteredPackages
Registration
rescache
Resources
ROnce.exe
RtHDVCpl.exe
RtlExUpd.dll
RtlUpd.exe
SchCache
schemas
security
ServiceProfiles
servicing
Setup
setupact.log
setuperr.log
ShellNew
SkyTel.exe
SoftwareDistribution
- C$ - (readable,writable)
+ Content of this share :
.rnd
autoexec.bat
Boot
bootmgr
BOOTSECT.BAK
Config.Msi
config.sys
DOCS
Documents and Settings
hiberfil.sys
Memeo
MSOCache
pagefile.sys
PerfLogs
Program Files
ProgramData
safgv170
System Volume Information
Toshiba
Users
Windows
WORKSSETUP
- D$ - (readable,writable)
+ Content of this share :
75c18b5d15b9804c2e2c06e215ba
CD Drive - Shortcut.lnk
Katrina Contacts
Katrina Desktop
Katrina Documents
Katrina Downloads
Katrina Favorites
Katrina Links
Katrina Music
Katrina Pictures
Katrina Saved Games
Katrina Searches
Katrina Videos
System Volume Information
- Katrina Pictures - (readable,writable)
+ Content of this share :
..
.picasa.ini
2008-02-03 December 2007 To o
2008-02-03 Washington DC
2008-02-28 Engagment Flowers
2008-03-02 Wedding Dresses
2008-03-18 Wedding Dresses 2
2008-07-14 Camera
2008-07-14 Summer 2008
2008-08-20 Summer 2008
2008-10-04 Tonio Camers
2009-03-24 Winter 2008-2009
2009-04-13 Spring 2009 Aida Visit
2009-06-14 Camera May June 2009
2009-07-29 Students 09 colonialbeach
2009-08-11 Mexico Trip 2009
2009-10-03 Camera Sept 2009
2009-10-03 Virginia Beach 2009
2009-10-31 Fall 2009
2009-12-21 fall 2009
2010 - September
2010 Cancun
2010-02-09 Christmas Winter 2009 2010
2010-03-14 Feb March 2010
2010-04-04 Spring Break 2010
2010-04-04 Spring Break 2010 2
2010-10-15 MarySmithLow
2010-10-15 Sylvester
2010-12-11 2010 Droid
2010-12-11 2010 Fall
2011 Angel Visit DC
2011 Cross country trip
2011 Family Pics
2011 Idaho Yellowstone
2011 Spring DC
2011 Summer Utah
2011 Tonio Birthday
2011 Winter DC
2011-03-31 K Uriarte Transcript p1
2011-03-31 K Uriarte Transcript p2
2011-Natl Cathedral Embassies
2x multiplication.jpg
Description
The remote has one or more Windows shares that can be accessed through
the network with the given credentials.
Depending on the share rights, it may allow an attacker to read /
write confidential data.
Solution
To restrict access under Windows, open Explorer, do a right click
on each share, go to the 'sharing' tab, and click on 'permissions'.
Risk Factor
None
Plugin ID: 10551
SNMP Request Network Interfaces Enumeration
Synopsis
The list of network interfaces cards of the remote host can be obtained via
SNMP.
List of Hosts
192.168.2.220
Plugin Output
Interface 1 information :
ifIndex : 1
ifDescr : Software Loopback Interface 1
Description
It is possible to obtain the list of the network interfaces installed
on the remote host by sending SNMP requests with the OID 1.3.6.1.2.1.2.1.0
An attacker may use this information to gain more knowledge about
the target host.
Solution
Disable the SNMP service on the remote host if you do not use it,
or filter incoming UDP packets going to this port.
Risk Factor
None
Plugin ID: 41028
SNMP Agent Default Community Name (public)
Synopsis
The community name of the remote SNMP server can be guessed.
List of Hosts
192.168.2.220
Plugin Output
The remote SNMP server replies to the following default community
string :
public
Description
It is possible to obtain the default community name of the remote
SNMP server.
An attacker may use this information to gain more knowledge about the
remote host, or to change the configuration of the remote system (if
the default community allow such modifications).
Solution
Disable the SNMP service on the remote host if you do not use it,
filter incoming UDP packets going to this port, or change the default
community string.
Risk Factor
High/ CVSS Base Score: 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS Temporal Score: 7.1(CVSS2#E:F/RL:U/RC:ND)
CVE
CVE-1999-0517
Bugtraq ID
2112
Other references
OSVDB:209
Plugin ID: 10264
SNMP Agent Default Community Names
Synopsis
The community names of the remote SNMP server can be guessed.
List of Hosts
192.168.2.220
Plugin Output
The remote SNMP server replies to the following default community
strings :
- private
- public
Description
It is possible to obtain the default community names of the remote
SNMP server.
An attacker may use this information to gain more knowledge about the
remote host or to change the configuration of the remote system (if
the default community allow such modifications).
Solution
Disable the SNMP service on the remote host if you do not use it,
filter incoming UDP packets going to this port, or change the default
community string.
Risk Factor
High/ CVSS Base Score: 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS Temporal Score: 6.2(CVSS2#E:F/RL:OF/RC:C)
CVE
CVE-1999-0186
CVE-1999-0254
CVE-1999-0472
CVE-1999-0516
CVE-1999-0517
CVE-1999-0792
CVE-2000-0147
CVE-2001-0380
CVE-2001-0514
CVE-2001-1210
CVE-2002-0109
CVE-2002-0478
CVE-2002-1229
CVE-2004-0311
CVE-2004-1474
CVE-2010-1574
Other references
OSVDB:209
OSVDB:3985
OSVDB:5770
OSVDB:8076
OSVDB:10206
OSVDB:11964
OSVDB:58147
OSVDB:66120
Plugin ID: 40448
SNMP Supported Protocols Detection
Synopsis
This plugin reports all the protocol versions successfully negotiated
with the remote SNMP agent.
List of Hosts
192.168.2.220
Plugin Output
This host supports SNMP version SNMPv1.
This host supports SNMP version SNMPv2c.
Description
Extend the SNMP settings data already gathered by testing for\
SNMP versions other than the highest negotiated.
Solution
n/a
Risk Factor
None
Plugin ID: 22964
Service Detection
Synopsis
The remote service could be identified.
List of Hosts
192.168.2.220
Plugin Output
A web server is running on this port.
Description
It was possible to identify the remote service by its banner or by looking
at the error message it sends when it receives an HTTP request.
Solution
n/a
Risk Factor
None
Plugin ID: 22964
Service Detection
Synopsis
The remote service could be identified.
List of Hosts
192.168.2.220
Plugin Output
A web server is running on this port.
Description
It was possible to identify the remote service by its banner or by looking
at the error message it sends when it receives an HTTP request.
Solution
n/a
Risk Factor
None
Plugin ID: 45590
Common Platform Enumeration (CPE)
Synopsis
It is possible to enumerate CPE names that matched on the remote
system.
List of Hosts
192.168.2.220
Plugin Output
The remote operating system matched the following CPE :
cpe:/o:microsoft:windows_vista:::home
Description
By using information obtained from a Nessus scan, this plugin reports
CPE (Common Platform Enumeration) matches for various hardware and
software products found on a host.
Note that if an official CPE is not available for the product, this
plugin computes the best possible CPE based on the information
available from the scan.
Solution
n/a
See also
http://cpe.mitre.org/
Risk Factor
None
Plugin ID: 12218
mDNS Detection
Synopsis
It is possible to obtain information about the remote host.
List of Hosts
192.168.2.220
Plugin Output
Nessus was able to extract the following information :
- mDNS hostname : MIDNIGHTBLUE.local.
Description
The remote service understands the Bonjour (also known as ZeroConf or
mDNS) protocol, which allows anyone to uncover information from the
remote host such as its operating system type and exact version, its
hostname, and the list of services it is running.
Solution
Filter incoming traffic to UDP port 5353 if desired.
Risk Factor
Medium/ CVSS Base Score: 5.0
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
Plugin ID: 35296
SNMP Protocol Version Detection
Synopsis
This plugin reports the protocol version negotiated with the remote
SNMP agent.
List of Hosts
192.168.2.220
Plugin Output
Nessus has negotiated SNMP communications at SNMPv2c.
Description
By sending an SNMP 'get-next-request', it is possible to determine the
protocol version of the remote SNMP agent.
Solution
Disable the SNMP service on the remote host if you do not use it, or
filter incoming UDP packets going to this port.
Risk Factor
None
Plugin ID: 10395
Microsoft Windows SMB Shares Enumeration
Synopsis
It is possible to enumerate remote network shares.
List of Hosts
192.168.2.220
Plugin Output
Here are the SMB shares available on the remote host when logged as katrina:
- ADMIN$
- C$
- D$
- IPC$
- Katrina Pictures
Description
By connecting to the remote host, Nessus was able to enumerate
the network share names.
Solution
N/A
Risk Factor
None
Plugin ID: 11936
OS Identification
Synopsis
It is possible to guess the remote operating system.
List of Hosts
192.168.2.220
Plugin Output
Remote operating system : Microsoft Windows Vista Home
Confidence Level : 99
Method : MSRPC
Not all fingerprints could give a match - please email the following to os-signatures@nessus.org :
HTTP:Server: Microsoft-HTTPAPI/2.0
SinFP:
P1:B11113:F0x12:W8192:O0204ffff:M1460:
P2:B11113:F0x12:W8192:O0204ffff0402080affffffff44454144:M1460:
P3:B00000:F0x00:W0:O0:M0
P4:4401_7_p=2869
SNMP:!:Windows MIDNIGHTBLUE 6.0.6002 S Home Edition
The remote host is running Microsoft Windows Vista Home
Description
Using a combination of remote probes, (TCP/IP, SMB, HTTP, NTP, SNMP, etc...)
it is possible to guess the name of the remote operating system in use, and
sometimes its version.
Solution
N/A
Risk Factor
None
Plugin ID: 10902
Microsoft Windows 'Administrators' Group User List
Synopsis
There is at least one user in the 'Administrators' group.
List of Hosts
192.168.2.220
Plugin Output
The following users are members of the 'Administrators' group :
- MIDNIGHTBLUE\Administrator (User)
- MIDNIGHTBLUE\Katrina (User)
Description
Using the supplied credentials, it is possible to extract the member
list of the 'Administrators' group. Members of this group have
complete access to the remote system.
Solution
Verify that each member of the group should have this type of access.
Risk Factor
None
Plugin ID: 10800
SNMP Query System Information Disclosure
Synopsis
The System Information of the remote host can be obtained via SNMP.
List of Hosts
192.168.2.220
Plugin Output
System information :
sysDescr : Windows MIDNIGHTBLUE 6.0.6002 S Home Edition
sysObjectID : 1.3.6.1.4.1.29485.1.1.2
sysUptime : 0d 4h 1m 16s
sysContact : unknown
sysName : MIDNIGHTBLUE
sysLocation : unknown
sysServices :
Description
It is possible to obtain the system information about the remote
host by sending SNMP requests with the OID 1.3.6.1.2.1.1.1.
An attacker may use this information to gain more knowledge about
the target host.
Solution
Disable the SNMP service on the remote host if you do not use it,
or filter incoming UDP packets going to this port.
Risk Factor
None
Plugin ID: 10150
Windows NetBIOS / SMB Remote Host Information Disclosure
Synopsis
It is possible to obtain the network name of the remote host.
List of Hosts
192.168.2.220
Plugin Output
The following 6 NetBIOS names have been gathered :
MIDNIGHTBLUE = Computer name
MSHOME = Workgroup / Domain name
MSHOME = Browser Service Elections
MIDNIGHTBLUE = File Server Service
MSHOME = Master Browser
__MSBROWSE__ = Master Browser
The remote host has the following MAC address on its adapter :
00:16:44:1a:de:b5
Description
The remote host listens on UDP port 137 or TCP port 445 and replies to
NetBIOS nbtscan or SMB requests.
Note that this plugin gathers information to be used in other plugins
but does not itself generate a report.
Solution
n/a
Risk Factor
None
Plugin ID: 10915
Microsoft Windows - Local Users Information : User has never logged on
Synopsis
At least one local user has never logged in to his / her account.
List of Hosts
192.168.2.220
Plugin Output
The following local user has never logged in :
- Guest
Note that, in addition to the Administrator and Guest accounts, Nessus
has only checked for local users with UIDs between 1000 and 1200.
To use a different range, edit the scan policy and change the 'Start
UID' and/or 'End UID' preferences for 'SMB use host SID to enumerate
local users' setting, and then re-run the scan.
Description
Using the supplied credentials, it is possible to list local users who
have never logged into their accounts.
Solution
Delete accounts that are not needed.
Risk Factor
None
Other references
OSVDB:754
Plugin ID: 10456
Microsoft Windows SMB Service Enumeration
Synopsis
It is possible to enumerate remote services.
List of Hosts
192.168.2.220
Plugin Output
Active Services :
Application Experience [ AeLookupSvc ]
Agere Modem Call Progress Audio [ AgereModemAudio ]
Apple Mobile Device [ Apple Mobile Device ]
Ati External Event Utility [ Ati External Event Utility ]
Windows Audio Endpoint Builder [ AudioEndpointBuilder ]
Windows Audio [ Audiosrv ]
Base Filtering Engine [ BFE ]
Background Intelligent Transfer Service [ BITS ]
Bonjour Service [ Bonjour Service ]
Computer Browser [ Browser ]
ConfigFree Service [ CFSvcs ]
Cryptographic Services [ CryptSvc ]
DCOM Server Process Launcher [ DcomLaunch ]
DHCP Client [ Dhcp ]
DNS Client [ Dnscache ]
Diagnostic Policy Service [ DPS ]
Extensible Authentication Protocol [ EapHost ]
ReadyBoost [ EMDMgmt ]
Windows Event Log [ Eventlog ]
COM+ Event System [ EventSystem ]
Function Discovery Provider Host [ fdPHost ]
Function Discovery Resource Publication [ FDResPub ]
Windows Font Cache Service [ FontCache ]
Windows Presentation Foundation Font Cache 3.0.0.0 [ FontCache3.0.0.0 ]
Group Policy Client [ gpsvc ]
LogMeIn Hamachi Tunneling Engine [ Hamachi2Svc ]
Human Interface Device Access [ hidserv ]
hpqcxs08 [ hpqcxs08 ]
HP CUE DeviceDiscovery Service [ hpqddsvc ]
IKE and AuthIP IPsec Keying Modules [ IKEEXT ]
IP Helper [ iphlpsvc ]
iPod Service [ iPod Service ]
CNG Key Isolation [ KeyIso ]
KtmRm for Distributed Transaction Coordinator [ KtmRm ]
Server [ LanmanServer ]
Workstation [ LanmanWorkstation ]
TCP/IP NetBIOS Helper [ lmhosts ]
LMIGuardianSvc [ LMIGuardianSvc ]
LogMeIn Maintenance Service [ LMIMaint ]
LogMeIn [ LogMeIn ]
Multimedia Class Scheduler [ MMCSS ]
Windows Firewall [ MpsSvc ]
Microsoft Antimalware Service [ MsMpSvc ]
Nero Update [ NAUpdate ]
Network Connections [ Netman ]
Network List Service [ netprofm ]
Microsoft Network Inspection [ NisSrv ]
Network Location Awareness [ NlaSvc ]
Network Store Interface Service [ nsi ]
Program Compatibility Assistant Service [ PcaSvc ]
pinger [ pinger ]
Plug and Play [ PlugPlay ]
IPsec Policy Agent [ PolicyAgent ]
User Profile Service [ ProfSvc ]
Remote Access Connection Manager [ RasMan ]
Remote Procedure Call (RPC) [ RpcSs ]
Security Accounts Manager [ SamSs ]
SBSD Security Center Service [ SBSDWSCService ]
Task Scheduler [ Schedule ]
Secondary Logon [ seclogon ]
System Event Notification Service [ SENS ]
Shell Hardware Detection [ ShellHWDetection ]
Software Licensing [ slsvc ]
Print Spooler [ Spooler ]
SSDP Discovery [ SSDPSRV ]
Secure Socket Tunneling Protocol Service [ SstpSvc ]
Windows Image Acquisition (WIA) [ stisvc ]
Microsoft Software Shadow Copy Provider [ swprv ]
Swupdtmr [ Swupdtmr ]
Superfetch [ SysMain ]
Tablet PC Input Service [ TabletInputService ]
Telephony [ TapiSrv ]
Terminal Services [ TermService ]
Themes [ Themes ]
TOSHIBA Navi Support Service [ TNaviSrv ]
TOSHIBA Optical Disc Drive Service [ TODDSrv ]
TOSHIBA Power Saver [ TosCoSrv ]
TOSHIBA Bluetooth Service [ TOSHIBA Bluetooth Service ]
Distributed Link Tracking Client [ TrkWks ]
Windows Modules Installer [ TrustedInstaller ]
Ulead Burning Helper [ UleadBurningHelper ]
UPnP Device Host [ upnphost ]
Desktop Window Manager Session Manager [ UxSms ]
Volume Shadow Copy [ VSS ]
Windows Time [ W32Time ]
Diagnostic System Host [ WdiSystemHost ]
WebClient [ WebClient ]
Windows Error Reporting Service [ WerSvc ]
WinHTTP Web Proxy Auto-Discovery Service [ WinHttpAutoProxySvc ]
Windows Management Instrumentation [ Winmgmt ]
WLAN AutoConfig [ Wlansvc ]
Windows Media Player Network Sharing Service [ WMPNetworkSvc ]
Portable Device Enumerator Service [ WPDBusEnum ]
Security Center [ wscsvc ]
Windows Search [ WSearch ]
Windows Update [ wuauserv ]
Windows Driver Foundation - User-mode Driver Framework [ wudfsvc ]
Inactive Services :
Application Layer Gateway Service [ ALG ]
Application Information [ Appinfo ]
Certificate Propagation [ CertPropSvc ]
Microsoft .NET Framework NGEN v2.0.50727_X86 [ clr_optimization_v2.0.50727_32 ]
Microsoft .NET Framework NGEN v4.0.30319_X86 [ clr_optimization_v4.0.30319_32 ]
COM+ System Application [ COMSysApp ]
DFS Replication [ DFSR ]
Wired AutoConfig [ dot3svc ]
Windows Media Center Receiver Service [ ehRecvr ]
Windows Media Center Scheduler Service [ ehSched ]
Windows Media Center Service Launcher [ ehstart ]
Google Desktop Manager 5.9.1005.12335 [ GoogleDesktopManager-051210-111108 ]
Google Updater Service [ gusvc ]
Health Key and Certificate Management [ hkmsvc ]
InstallDriver Table Manager [ IDriverT ]
Windows CardSpace [ idsvc ]
PnP-X IP Bus Enumerator [ IPBusEnum ]
Link-Layer Topology Discovery Mapper [ lltdsvc ]
Windows Media Center Extender Service [ Mcx2Svc ]
Distributed Transaction Coordinator [ MSDTC ]
Microsoft iSCSI Initiator Service [ MSiSCSI ]
Windows Installer [ msiserver ]
Network Access Protection Agent [ napagent ]
Net Driver HPZ12 [ Net Driver HPZ12 ]
Netlogon [ Netlogon ]
Net.Tcp Port Sharing Service [ NetTcpPortSharing ]
Microsoft Office Diagnostics Service [ odserv ]
Office Source Engine [ ose ]
Peer Networking Identity Manager [ p2pimsvc ]
Peer Networking Grouping [ p2psvc ]
Performance Logs & Alerts [ pla ]
Pml Driver HPZ12 [ Pml Driver HPZ12 ]
PNRP Machine Name Publication Service [ PNRPAutoReg ]
Peer Name Resolution Protocol [ PNRPsvc ]
Protected Storage [ ProtectedStorage ]
Quality Windows Audio Video Experience [ QWAVE ]
Remote Access Auto Connection Manager [ RasAuto ]
Routing and Remote Access [ RemoteAccess ]
Remote Registry [ RemoteRegistry ]
Remote Procedure Call (RPC) Locator [ RpcLocator ]
Smart Card [ SCardSvr ]
Smart Card Removal Policy [ SCPolicySvc ]
Windows Backup [ SDRSVC ]
Terminal Services Configuration [ SessionEnv ]
Internet Connection Sharing (ICS) [ SharedAccess ]
SL UI Notification Service [ SLUINotify ]
SNMP Trap [ SNMPTRAP ]
TPM Base Services [ TBS ]
Thread Ordering Server [ THREADORDER ]
Interactive Services Detection [ UI0Detect ]
Virtual Disk [ vds ]
Windows Connect Now - Config Registrar [ wcncsvc ]
Windows Color System [ WcsPlugInService ]
Diagnostic Service Host [ WdiServiceHost ]
Windows Event Collector [ Wecsvc ]
Problem Reports and Solutions Control Panel Support [ wercplsupport ]
Windows Defender [ WinDefend ]
Windows Remote Management (WS-Management) [ WinRM ]
WMI Performance Adapter [ wmiApSrv ]
Parental Controls [ WPCSvc ]
Windows Presentation Foundation Font Cache 4.0.0.0 [ WPFFontCache_v0400 ]
Description
This plugin implements the SvcOpenSCManager() and SvcEnumServices()
calls to obtain, using the SMB protocol, the list of active and
inactive services of the remote host.
An attacker may use this feature to gain better knowledge of the remote
host.
Solution
To prevent the listing of the services for being obtained, you should
either have tight login restrictions, so that only trusted users can
access your host, and/or you should filter incoming traffic to this port.
Risk Factor
Low/ CVSS Base Score: 2.6
(CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N)
Plugin ID: 35716
Ethernet Card Manufacturer Detection
Synopsis
The manufacturer can be deduced from the Ethernet OUI.
List of Hosts
192.168.2.220
Plugin Output
The following card manufacturers were identified :
00:16:44:1a:de:b5 : LITE-ON Technology Corp.
Description
Each ethernet MAC address starts with a 24-bit 'Organizationally
Unique Identifier'.
These OUI are registered by IEEE.
Solution
n/a
Risk Factor
None
Plugin ID: 10859
Microsoft Windows SMB LsaQueryInformationPolicy Function SID Enumeration
Synopsis
It is possible to obtain the host SID for the remote host.
List of Hosts
192.168.2.220
Plugin Output
The remote host SID value is :
1-5-21-125069192-3076196030-2827143986
The value of 'RestrictAnonymous' setting is : unknown
Description
By emulating the call to LsaQueryInformationPolicy(), it was possible
to obtain the host SID (Security Identifier).
The host SID can then be used to get the list of local users.
Solution
You can prevent anonymous lookups of the host SID by setting the
'RestrictAnonymous' registry setting to an appropriate value.
Refer to the 'See also' section for guidance.
Risk Factor
None
Plugin ID: 26917
Microsoft Windows SMB Registry : Nessus Cannot Access the Windows Registry
Synopsis
Nessus is not able to access the remote Windows Registry.
List of Hosts
192.168.2.220
Plugin Output
Could not connect to the registry because:
Could not connect to \winreg
Description
It was not possible to connect to PIPE\winreg on the remote host.
If you intend to use Nessus to perform registry-based checks, the
registry checks will not work because the 'Remote Registry Access'
service (winreg) has been disabled on the remote host or can not be
connected to with the supplied credentials.
Solution
n/a
Risk Factor
None
Plugin ID: 11011
Microsoft Windows SMB Service Detection
Synopsis
A file / print sharing service is listening on the remote host.
List of Hosts
192.168.2.220
Plugin Output
A CIFS server is running on this port.
Description
The remote service understands the CIFS (Common Internet File System)
or Server Message Block (SMB) protocol, used to provide shared access
to files, printers, etc between nodes on a network.
Solution
n/a
Risk Factor
None
Plugin ID: 11011
Microsoft Windows SMB Service Detection
Synopsis
A file / print sharing service is listening on the remote host.
List of Hosts
192.168.2.220
Plugin Output
An SMB server is running on this port.
Description
The remote service understands the CIFS (Common Internet File System)
or Server Message Block (SMB) protocol, used to provide shared access
to files, printers, etc between nodes on a network.
Solution
n/a
Risk Factor
None
Plugin ID: 10916
Microsoft Windows - Local Users Information : Passwords never expire
Synopsis
At least one local user has a password that never expires.
List of Hosts
192.168.2.220
Plugin Output
The following local users have passwords that never expire :
- Administrator
- Guest
- Katrina
Note that, in addition to the Administrator and Guest accounts, Nessus
has only checked for local users with UIDs between 1000 and 1200.
To use a different range, edit the scan policy and change the 'Start
UID' and/or 'End UID' preferences for this plugin, then re-run the
scan.
Description
Using the supplied credentials, it is possible to list local users
whose passwords never expire.
Solution
Allow / require users to change their passwords regularly.
Risk Factor
None
Other references
OSVDB:755
Plugin ID: 46215
Inconsistent Hostname and IP Address
Synopsis
The remote host's hostname is not consistent with DNS information.
List of Hosts
192.168.2.220
Plugin Output
The host name 'MIDNIGHTBLUE' resolves to 67.215.65.132, not to 192.168.2.220
Description
The name of this machine either does not resolve or resolves to a
different IP address.
This may come from a badly configured reverse DNS or from a host file
in use on the Nessus scanning host.
As a result, URLs in plugin output may not be directly usable in a web
browser and some web tests may be incomplete.
Solution
Fix the reverse DNS or host file.
Risk Factor
None
Plugin ID: 54615
Device Type
Synopsis
It is possible to guess the remote device type.
List of Hosts
192.168.2.220
Plugin Output
Remote device type : general-purpose
Confidence level : 99
Description
Based on the remote operating system, it is possible to determine
what the remote system type is (eg: a printer, router, general-purpose
computer, etc).
Solution
n/a
Risk Factor
None
Plugin ID: 12053
Host Fully Qualified Domain Name (FQDN) Resolution
Synopsis
It was possible to resolve the name of the remote host.
List of Hosts
192.168.2.220
Plugin Output
192.168.2.220 resolves as MIDNIGHTBLUE.
Description
Nessus was able to resolve the FQDN of the remote host.
Solution
n/a
Risk Factor
None
Plugin ID: 43815
NetBIOS Multiple IP Address Enumeration
Synopsis
The remote host is configured with multiple IP addresses.
List of Hosts
192.168.2.220
Plugin Output
The remote host appears to be using the following IP addresses :
- 5.118.62.187
- 192.168.2.220
Description
By sending a special NetBIOS query, Nessus was able to detect the use
of multiple IP addresses on the remote host. This indicates the host
may be running virtualization software, a VPN client, or has multiple
network interfaces.
Solution
n/a
Risk Factor
None
Plugin ID: 10736
DCE Services Enumeration
Synopsis
A DCE/RPC service is running on the remote host.
List of Hosts
192.168.2.220
Plugin Output
The following DCERPC services are available on TCP port 49187 :
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 367abb81-9844-35f1-ad32-98f038001003, version 2.0
Description : Unknown RPC service
Type : Remote RPC service
TCP Port : 49187
IP : 192.168.2.220
Description
By sending a Lookup request to the portmapper (TCP 135 or epmapper
PIPE) it was possible to enumerate the Distributed Computing Environment
(DCE) services running on the remote port.
Using this information it is possible to connect and bind to
each service by sending an RPC request to the remote port/pipe.
Solution
N/A
Risk Factor
None
Plugin ID: 10736
DCE Services Enumeration
Synopsis
A DCE/RPC service is running on the remote host.
List of Hosts
192.168.2.220
Plugin Output
The following DCERPC services are available on TCP port 49155 :
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 12345778-1234-abcd-ef00-0123456789ac, version 1.0
Description : Security Account Manager
Windows process : lsass.exe
Type : Remote RPC service
TCP Port : 49155
IP : 192.168.2.220
Description
By sending a Lookup request to the portmapper (TCP 135 or epmapper
PIPE) it was possible to enumerate the Distributed Computing Environment
(DCE) services running on the remote port.
Using this information it is possible to connect and bind to
each service by sending an RPC request to the remote port/pipe.
Solution
N/A
Risk Factor
None
Plugin ID: 10736
DCE Services Enumeration
Synopsis
A DCE/RPC service is running on the remote host.
List of Hosts
192.168.2.220
Plugin Output
The following DCERPC services are available on TCP port 49154 :
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 86d35949-83c9-4044-b424-db363231fd0c, version 1.0
Description : Unknown RPC service
Type : Remote RPC service
TCP Port : 49154
IP : 192.168.2.220
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : a398e520-d59a-4bdd-aa7a-3c1e0303a511, version 1.0
Description : Unknown RPC service
Annotation : IKE/Authip API
Type : Remote RPC service
TCP Port : 49154
IP : 192.168.2.220
Description
By sending a Lookup request to the portmapper (TCP 135 or epmapper
PIPE) it was possible to enumerate the Distributed Computing Environment
(DCE) services running on the remote port.
Using this information it is possible to connect and bind to
each service by sending an RPC request to the remote port/pipe.
Solution
N/A
Risk Factor
None
Plugin ID: 10736
DCE Services Enumeration
Synopsis
A DCE/RPC service is running on the remote host.
List of Hosts
192.168.2.220
Plugin Output
The following DCERPC services are available on TCP port 49153 :
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : f6beaff7-1e19-4fbb-9f8f-b89e2018337c, version 1.0
Description : Unknown RPC service
Annotation : Event log TCPIP
Type : Remote RPC service
TCP Port : 49153
IP : 192.168.2.220
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5, version 1.0
Description : DHCP Client Service
Windows process : svchost.exe
Annotation : DHCP Client LRPC Endpoint
Type : Remote RPC service
TCP Port : 49153
IP : 192.168.2.220
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6, version 1.0
Description : Unknown RPC service
Annotation : DHCPv6 Client LRPC Endpoint
Type : Remote RPC service
TCP Port : 49153
IP : 192.168.2.220
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 06bba54a-be05-49f9-b0a0-30f790261023, version 1.0
Description : Unknown RPC service
Annotation : Security Center
Type : Remote RPC service
TCP Port : 49153
IP : 192.168.2.220
Description
By sending a Lookup request to the portmapper (TCP 135 or epmapper
PIPE) it was possible to enumerate the Distributed Computing Environment
(DCE) services running on the remote port.
Using this information it is possible to connect and bind to
each service by sending an RPC request to the remote port/pipe.
Solution
N/A
Risk Factor
None
Plugin ID: 10736
DCE Services Enumeration
Synopsis
A DCE/RPC service is running on the remote host.
List of Hosts
192.168.2.220
Plugin Output
The following DCERPC services are available on TCP port 49152 :
Object UUID : 765294ba-60bc-48b8-92e9-89fd77769d91
UUID : d95afe70-a6d5-4259-822e-2c84da1ddb0d, version 1.0
Description : Unknown RPC service
Type : Remote RPC service
TCP Port : 49152
IP : 192.168.2.220
Description
By sending a Lookup request to the portmapper (TCP 135 or epmapper
PIPE) it was possible to enumerate the Distributed Computing Environment
(DCE) services running on the remote port.
Using this information it is possible to connect and bind to
each service by sending an RPC request to the remote port/pipe.
Solution
N/A
Risk Factor
None
Plugin ID: 10736
DCE Services Enumeration
Synopsis
A DCE/RPC service is running on the remote host.
List of Hosts
192.168.2.220
Plugin Output
The following DCERPC services are available remotely :
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 12345778-1234-abcd-ef00-0123456789ac, version 1.0
Description : Security Account Manager
Windows process : lsass.exe
Type : Remote RPC service
Named pipe : \PIPE\protected_storage
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 12345778-1234-abcd-ef00-0123456789ac, version 1.0
Description : Security Account Manager
Windows process : lsass.exe
Type : Remote RPC service
Named pipe : \pipe\lsass
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86, version 1.0
Description : Unknown RPC service
Annotation : KeyIso
Type : Remote RPC service
Named pipe : \PIPE\protected_storage
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 2f5f6521-cb55-1059-b446-00df0bce31db, version 1.0
Description : Unknown RPC service
Annotation : Unimodem LRPC Endpoint
Type : Remote RPC service
Named pipe : \pipe\keysvc
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 2f5f6521-cb55-1059-b446-00df0bce31db, version 1.0
Description : Unknown RPC service
Annotation : Unimodem LRPC Endpoint
Type : Remote RPC service
Named pipe : \pipe\tapsrv
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : b58aa02e-2884-4e97-8176-4ee06d794184, version 1.0
Description : Unknown RPC service
Type : Remote RPC service
Named pipe : \pipe\trkwks
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3473dd4d-2e88-4006-9cba-22570909dd10, version 5.0
Description : Unknown RPC service
Annotation : WinHttp Auto-Proxy Service
Type : Remote RPC service
Named pipe : \PIPE\DAV RPC SERVICE
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3473dd4d-2e88-4006-9cba-22570909dd10, version 5.0
Description : Unknown RPC service
Annotation : WinHttp Auto-Proxy Service
Type : Remote RPC service
Named pipe : \PIPE\wkssvc
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3473dd4d-2e88-4006-9cba-22570909dd10, version 5.0
Description : Unknown RPC service
Annotation : WinHttp Auto-Proxy Service
Type : Remote RPC service
Named pipe : \PIPE\W32TIME_ALT
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 4b112204-0e19-11d3-b42b-0000f81feb9f, version 1.0
Description : SSDP service
Windows process : unknow
Type : Remote RPC service
Named pipe : \PIPE\DAV RPC SERVICE
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 4b112204-0e19-11d3-b42b-0000f81feb9f, version 1.0
Description : SSDP service
Windows process : unknow
Type : Remote RPC service
Named pipe : \PIPE\wkssvc
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 4b112204-0e19-11d3-b42b-0000f81feb9f, version 1.0
Description : SSDP service
Windows process : unknow
Type : Remote RPC service
Named pipe : \PIPE\W32TIME_ALT
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 1ff70682-0a51-30e8-076d-740be8cee98b, version 1.0
Description : Scheduler Service
Windows process : svchost.exe
Type : Remote RPC service
Named pipe : \PIPE\atsvc
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 378e52b0-c0a9-11cf-822d-00aa0051e40f, version 1.0
Description : Scheduler Service
Windows process : svchost.exe
Type : Remote RPC service
Named pipe : \PIPE\atsvc
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 86d35949-83c9-4044-b424-db363231fd0c, version 1.0
Description : Unknown RPC service
Type : Remote RPC service
Named pipe : \PIPE\atsvc
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : a398e520-d59a-4bdd-aa7a-3c1e0303a511, version 1.0
Description : Unknown RPC service
Annotation : IKE/Authip API
Type : Remote RPC service
Named pipe : \PIPE\atsvc
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : a398e520-d59a-4bdd-aa7a-3c1e0303a511, version 1.0
Description : Unknown RPC service
Annotation : IKE/Authip API
Type : Remote RPC service
Named pipe : \PIPE\srvsvc
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : f6beaff7-1e19-4fbb-9f8f-b89e2018337c, version 1.0
Description : Unknown RPC service
Annotation : Event log TCPIP
Type : Remote RPC service
Named pipe : \pipe\eventlog
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5, version 1.0
Description : DHCP Client Service
Windows process : svchost.exe
Annotation : DHCP Client LRPC Endpoint
Type : Remote RPC service
Named pipe : \pipe\eventlog
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6, version 1.0
Description : Unknown RPC service
Annotation : DHCPv6 Client LRPC Endpoint
Type : Remote RPC service
Named pipe : \pipe\eventlog
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 06bba54a-be05-49f9-b0a0-30f790261023, version 1.0
Description : Unknown RPC service
Annotation : Security Center
Type : Remote RPC service
Named pipe : \pipe\eventlog
Netbios name : \\MIDNIGHTBLUE
Object UUID : b08669ee-8cb5-43a5-a017-84fe00000000
UUID : 76f226c3-ec14-4325-8a99-6a46348418af, version 1.0
Description : Unknown RPC service
Type : Remote RPC service
Named pipe : \PIPE\InitShutdown
Netbios name : \\MIDNIGHTBLUE
Object UUID : 765294ba-60bc-48b8-92e9-89fd77769d91
UUID : d95afe70-a6d5-4259-822e-2c84da1ddb0d, version 1.0
Description : Unknown RPC service
Type : Remote RPC service
Named pipe : \PIPE\InitShutdown
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00736665-0000-0000-0000-000000000000
UUID : c9ac6db5-82b7-4e55-ae8a-e464ed7b4277, version 1.0
Description : Unknown RPC service
Annotation : Impl friendly name
Type : Remote RPC service
Named pipe : \pipe\lsass
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00736665-0000-0000-0000-000000000000
UUID : c9ac6db5-82b7-4e55-ae8a-e464ed7b4277, version 1.0
Description : Unknown RPC service
Annotation : Impl friendly name
Type : Remote RPC service
Named pipe : \PIPE\protected_storage
Netbios name : \\MIDNIGHTBLUE
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86, version 1.0
Description : Unknown RPC service
Annotation : KeyIso
Type : Remote RPC service
Named pipe : \pipe\lsass
Netbios name : \\MIDNIGHTBLUE
Description
By sending a Lookup request to the portmapper (TCP 135 or epmapper
PIPE) it was possible to enumerate the Distributed Computing Environment
(DCE) services running on the remote port.
Using this information it is possible to connect and bind to
each service by sending an RPC request to the remote port/pipe.
Solution
N/A
Risk Factor
None
Plugin ID: 10736
DCE Services Enumeration
Synopsis
A DCE/RPC service is running on the remote host.
List of Hosts
192.168.2.220
Plugin Output
The following DCERPC services are available locally :
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 12345778-1234-abcd-ef00-0123456789ac, version 1.0
Description : Security Account Manager
Windows process : lsass.exe
Type : Local RPC service
Named pipe : samss lpc
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 12345778-1234-abcd-ef00-0123456789ac, version 1.0
Description : Security Account Manager
Windows process : lsass.exe
Type : Local RPC service
Named pipe : protected_storage
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 12345778-1234-abcd-ef00-0123456789ac, version 1.0
Description : Security Account Manager
Windows process : lsass.exe
Type : Local RPC service
Named pipe : securityevent
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 12345778-1234-abcd-ef00-0123456789ac, version 1.0
Description : Security Account Manager
Windows process : lsass.exe
Type : Local RPC service
Named pipe : audit
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 12345778-1234-abcd-ef00-0123456789ac, version 1.0
Description : Security Account Manager
Windows process : lsass.exe
Type : Local RPC service
Named pipe : LRPC-1603bf0e56693e998f
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86, version 1.0
Description : Unknown RPC service
Annotation : KeyIso
Type : Local RPC service
Named pipe : samss lpc
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 2f5f6521-cb55-1059-b446-00df0bce31db, version 1.0
Description : Unknown RPC service
Annotation : Unimodem LRPC Endpoint
Type : Local RPC service
Named pipe : DNSResolver
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 2f5f6521-cb55-1059-b446-00df0bce31db, version 1.0
Description : Unknown RPC service
Annotation : Unimodem LRPC Endpoint
Type : Local RPC service
Named pipe : keysvc
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 2f5f6521-cb55-1059-b446-00df0bce31db, version 1.0
Description : Unknown RPC service
Annotation : Unimodem LRPC Endpoint
Type : Local RPC service
Named pipe : keysvc2
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 2f5f6521-cb55-1059-b446-00df0bce31db, version 1.0
Description : Unknown RPC service
Annotation : Unimodem LRPC Endpoint
Type : Local RPC service
Named pipe : OLE58F662642A844CEABE92729C147E
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 2f5f6521-cb55-1059-b446-00df0bce31db, version 1.0
Description : Unknown RPC service
Annotation : Unimodem LRPC Endpoint
Type : Local RPC service
Named pipe : nlaplg
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 2f5f6521-cb55-1059-b446-00df0bce31db, version 1.0
Description : Unknown RPC service
Annotation : Unimodem LRPC Endpoint
Type : Local RPC service
Named pipe : nlaapi
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 2f5f6521-cb55-1059-b446-00df0bce31db, version 1.0
Description : Unknown RPC service
Annotation : Unimodem LRPC Endpoint
Type : Local RPC service
Named pipe : tapsrvlpc
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 2f5f6521-cb55-1059-b446-00df0bce31db, version 1.0
Description : Unknown RPC service
Annotation : Unimodem LRPC Endpoint
Type : Local RPC service
Named pipe : unimdmsvc
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 12345678-1234-abcd-ef00-0123456789ab, version 1.0
Description : IPsec Services (Windows XP & 2003)
Windows process : lsass.exe
Annotation : IPSec Policy agent endpoint
Type : Local RPC service
Named pipe : LRPC-4890ada4837818b453
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : dd490425-5325-4565-b774-7e27d6c09c24, version 1.0
Description : Unknown RPC service
Annotation : Base Firewall Engine API
Type : Local RPC service
Named pipe : LRPC-10b42dec5f403e6cb9
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 7f9d11bf-7fb9-436b-a812-b2d50c5d4c03, version 1.0
Description : Unknown RPC service
Annotation : Fw APIs
Type : Local RPC service
Named pipe : LRPC-10b42dec5f403e6cb9
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 2fb92682-6599-42dc-ae13-bd2ca89bd11c, version 1.0
Description : Unknown RPC service
Annotation : Fw APIs
Type : Local RPC service
Named pipe : LRPC-10b42dec5f403e6cb9
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 0b6edbfa-4a24-4fc6-8a23-942b1eca65d1, version 1.0
Description : Unknown RPC service
Annotation : Spooler function endpoint
Type : Local RPC service
Named pipe : spoolss
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : ae33069b-a2a8-46ee-a235-ddfd339be281, version 1.0
Description : Unknown RPC service
Annotation : Spooler base remote object endpoint
Type : Local RPC service
Named pipe : spoolss
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 4a452661-8290-4b36-8fbe-7f4093a94978, version 1.0
Description : Unknown RPC service
Annotation : Spooler function endpoint
Type : Local RPC service
Named pipe : spoolss
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 25952c5d-7976-4aa1-a3cb-c35f7ae79d1b, version 1.0
Description : Unknown RPC service
Annotation : Wireless Diagnostics
Type : Local RPC service
Named pipe : LRPC-63facae6b810944fac
Object UUID : 6e616c77-7673-0063-0000-000000000000
UUID : c9ac6db5-82b7-4e55-ae8a-e464ed7b4277, version 1.0
Description : Unknown RPC service
Annotation : Impl friendly name
Type : Local RPC service
Named pipe : LRPC-63facae6b810944fac
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 266f33b4-c7c1-4bd1-8f52-ddb8f2214ea9, version 1.0
Description : Unknown RPC service
Annotation : Wlan Service
Type : Local RPC service
Named pipe : LRPC-63facae6b810944fac
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 654976df-1498-4056-a15e-cb4e87584bd8, version 1.0
Description : Unknown RPC service
Type : Local RPC service
Named pipe : LRPC-63facae6b810944fac
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 0767a036-0d22-48aa-ba69-b619480f38cb, version 1.0
Description : Unknown RPC service
Annotation : PcaSvc
Type : Local RPC service
Named pipe : LRPC-63facae6b810944fac
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : b58aa02e-2884-4e97-8176-4ee06d794184, version 1.0
Description : Unknown RPC service
Type : Local RPC service
Named pipe : LRPC-63facae6b810944fac
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : b58aa02e-2884-4e97-8176-4ee06d794184, version 1.0
Description : Unknown RPC service
Type : Local RPC service
Named pipe : trkwks
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 7ea70bcf-48af-4f6a-8968-6a440754d5fa, version 1.0
Description : Unknown RPC service
Annotation : NSI server endpoint
Type : Local RPC service
Named pipe : OLE3B60305FDEC94562BCA826FF3EB6
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 7ea70bcf-48af-4f6a-8968-6a440754d5fa, version 1.0
Description : Unknown RPC service
Annotation : NSI server endpoint
Type : Local RPC service
Named pipe : LRPC-54c526d81c4b9c7f1f
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3473dd4d-2e88-4006-9cba-22570909dd10, version 5.0
Description : Unknown RPC service
Annotation : WinHttp Auto-Proxy Service
Type : Local RPC service
Named pipe : OLE3B60305FDEC94562BCA826FF3EB6
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3473dd4d-2e88-4006-9cba-22570909dd10, version 5.0
Description : Unknown RPC service
Annotation : WinHttp Auto-Proxy Service
Type : Local RPC service
Named pipe : LRPC-54c526d81c4b9c7f1f
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3473dd4d-2e88-4006-9cba-22570909dd10, version 5.0
Description : Unknown RPC service
Annotation : WinHttp Auto-Proxy Service
Type : Local RPC service
Named pipe : W32TIME_ALT
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 4b112204-0e19-11d3-b42b-0000f81feb9f, version 1.0
Description : SSDP service
Windows process : unknow
Type : Local RPC service
Named pipe : OLE3B60305FDEC94562BCA826FF3EB6
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 4b112204-0e19-11d3-b42b-0000f81feb9f, version 1.0
Description : SSDP service
Windows process : unknow
Type : Local RPC service
Named pipe : LRPC-54c526d81c4b9c7f1f
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 4b112204-0e19-11d3-b42b-0000f81feb9f, version 1.0
Description : SSDP service
Windows process : unknow
Type : Local RPC service
Named pipe : W32TIME_ALT
Object UUID : 6c637067-6569-746e-0000-000000000000
UUID : c9ac6db5-82b7-4e55-ae8a-e464ed7b4277, version 1.0
Description : Unknown RPC service
Annotation : Impl friendly name
Type : Local RPC service
Named pipe : LRPC-0dee62735e76cf2fd9
Object UUID : 24d1f7c7-76af-4f28-9ccd-7f6cb6468601
UUID : 2eb08e3e-639f-4fba-97b1-14f878961076, version 1.0
Description : Unknown RPC service
Type : Local RPC service
Named pipe : LRPC-0dee62735e76cf2fd9
Object UUID : 666f7270-6c69-7365-0000-000000000000
UUID : c9ac6db5-82b7-4e55-ae8a-e464ed7b4277, version 1.0
Description : Unknown RPC service
Annotation : Impl friendly name
Type : Local RPC service
Named pipe : IUserProfile2
Object UUID : 736e6573-0000-0000-0000-000000000000
UUID : c9ac6db5-82b7-4e55-ae8a-e464ed7b4277, version 1.0
Description : Unknown RPC service
Annotation : Impl friendly name
Type : Local RPC service
Named pipe : IUserProfile2
Object UUID : 736e6573-0000-0000-0000-000000000000
UUID : c9ac6db5-82b7-4e55-ae8a-e464ed7b4277, version 1.0
Description : Unknown RPC service
Annotation : Impl friendly name
Type : Local RPC service
Named pipe : senssvc
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53, version 1.0
Description : Scheduler Service
Windows process : svchost.exe
Type : Local RPC service
Named pipe : IUserProfile2
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53, version 1.0
Description : Scheduler Service
Windows process : svchost.exe
Type : Local RPC service
Named pipe : senssvc
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53, version 1.0
Description : Scheduler Service
Windows process : svchost.exe
Type : Local RPC service
Named pipe : OLEA70C2F92DCD64B408649054FD347
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 1ff70682-0a51-30e8-076d-740be8cee98b, version 1.0
Description : Scheduler Service
Windows process : svchost.exe
Type : Local RPC service
Named pipe : IUserProfile2
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 1ff70682-0a51-30e8-076d-740be8cee98b, version 1.0
Description : Scheduler Service
Windows process : svchost.exe
Type : Local RPC service
Named pipe : senssvc
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 1ff70682-0a51-30e8-076d-740be8cee98b, version 1.0
Description : Scheduler Service
Windows process : svchost.exe
Type : Local RPC service
Named pipe : OLEA70C2F92DCD64B408649054FD347
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 378e52b0-c0a9-11cf-822d-00aa0051e40f, version 1.0
Description : Scheduler Service
Windows process : svchost.exe
Type : Local RPC service
Named pipe : IUserProfile2
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 378e52b0-c0a9-11cf-822d-00aa0051e40f, version 1.0
Description : Scheduler Service
Windows process : svchost.exe
Type : Local RPC service
Named pipe : senssvc
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 378e52b0-c0a9-11cf-822d-00aa0051e40f, version 1.0
Description : Scheduler Service
Windows process : svchost.exe
Type : Local RPC service
Named pipe : OLEA70C2F92DCD64B408649054FD347
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 86d35949-83c9-4044-b424-db363231fd0c, version 1.0
Description : Unknown RPC service
Type : Local RPC service
Named pipe : IUserProfile2
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 86d35949-83c9-4044-b424-db363231fd0c, version 1.0
Description : Unknown RPC service
Type : Local RPC service
Named pipe : senssvc
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 86d35949-83c9-4044-b424-db363231fd0c, version 1.0
Description : Unknown RPC service
Type : Local RPC service
Named pipe : OLEA70C2F92DCD64B408649054FD347
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : a398e520-d59a-4bdd-aa7a-3c1e0303a511, version 1.0
Description : Unknown RPC service
Annotation : IKE/Authip API
Type : Local RPC service
Named pipe : IUserProfile2
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : a398e520-d59a-4bdd-aa7a-3c1e0303a511, version 1.0
Description : Unknown RPC service
Annotation : IKE/Authip API
Type : Local RPC service
Named pipe : senssvc
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : a398e520-d59a-4bdd-aa7a-3c1e0303a511, version 1.0
Description : Unknown RPC service
Annotation : IKE/Authip API
Type : Local RPC service
Named pipe : OLEA70C2F92DCD64B408649054FD347
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : f6beaff7-1e19-4fbb-9f8f-b89e2018337c, version 1.0
Description : Unknown RPC service
Annotation : Event log TCPIP
Type : Local RPC service
Named pipe : eventlog
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5, version 1.0
Description : DHCP Client Service
Windows process : svchost.exe
Annotation : DHCP Client LRPC Endpoint
Type : Local RPC service
Named pipe : eventlog
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5, version 1.0
Description : DHCP Client Service
Windows process : svchost.exe
Annotation : DHCP Client LRPC Endpoint
Type : Local RPC service
Named pipe : AudioClientRpc
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5, version 1.0
Description : DHCP Client Service
Windows process : svchost.exe
Annotation : DHCP Client LRPC Endpoint
Type : Local RPC service
Named pipe : Audiosrv
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5, version 1.0
Description : DHCP Client Service
Windows process : svchost.exe
Annotation : DHCP Client LRPC Endpoint
Type : Local RPC service
Named pipe : OLEDA240E4026F0404FA8ACCEF65260
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5, version 1.0
Description : DHCP Client Service
Windows process : svchost.exe
Annotation : DHCP Client LRPC Endpoint
Type : Local RPC service
Named pipe : dhcpcsvc
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6, version 1.0
Description : Unknown RPC service
Annotation : DHCPv6 Client LRPC Endpoint
Type : Local RPC service
Named pipe : eventlog
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6, version 1.0
Description : Unknown RPC service
Annotation : DHCPv6 Client LRPC Endpoint
Type : Local RPC service
Named pipe : AudioClientRpc
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6, version 1.0
Description : Unknown RPC service
Annotation : DHCPv6 Client LRPC Endpoint
Type : Local RPC service
Named pipe : Audiosrv
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6, version 1.0
Description : Unknown RPC service
Annotation : DHCPv6 Client LRPC Endpoint
Type : Local RPC service
Named pipe : OLEDA240E4026F0404FA8ACCEF65260
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6, version 1.0
Description : Unknown RPC service
Annotation : DHCPv6 Client LRPC Endpoint
Type : Local RPC service
Named pipe : dhcpcsvc
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6, version 1.0
Description : Unknown RPC service
Annotation : DHCPv6 Client LRPC Endpoint
Type : Local RPC service
Named pipe : dhcpcsvc6
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 06bba54a-be05-49f9-b0a0-30f790261023, version 1.0
Description : Unknown RPC service
Annotation : Security Center
Type : Local RPC service
Named pipe : eventlog
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 06bba54a-be05-49f9-b0a0-30f790261023, version 1.0
Description : Unknown RPC service
Annotation : Security Center
Type : Local RPC service
Named pipe : AudioClientRpc
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 06bba54a-be05-49f9-b0a0-30f790261023, version 1.0
Description : Unknown RPC service
Annotation : Security Center
Type : Local RPC service
Named pipe : Audiosrv
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 06bba54a-be05-49f9-b0a0-30f790261023, version 1.0
Description : Unknown RPC service
Annotation : Security Center
Type : Local RPC service
Named pipe : OLEDA240E4026F0404FA8ACCEF65260
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 06bba54a-be05-49f9-b0a0-30f790261023, version 1.0
Description : Unknown RPC service
Annotation : Security Center
Type : Local RPC service
Named pipe : dhcpcsvc
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : 06bba54a-be05-49f9-b0a0-30f790261023, version 1.0
Description : Unknown RPC service
Annotation : Security Center
Type : Local RPC service
Named pipe : dhcpcsvc6
Object UUID : b08669ee-8cb5-43a5-a017-84fe00000001
UUID : 76f226c3-ec14-4325-8a99-6a46348418af, version 1.0
Description : Unknown RPC service
Type : Local RPC service
Named pipe : WMsgKRpc010D281
Object UUID : 52ef130c-08fd-4388-86b3-6edf00000001
UUID : 12e65dd8-887f-41ef-91bf-8d816c42c2e7, version 1.0
Description : Unknown RPC service
Annotation : Secure Desktop LRPC interface
Type : Local RPC service
Named pipe : WMsgKRpc010D281
Object UUID : 6d726574-7273-0076-0000-000000000000
UUID : c9ac6db5-82b7-4e55-ae8a-e464ed7b4277, version 1.0
Description : Unknown RPC service
Annotation : Impl friendly name
Type : Local RPC service
Named pipe : LRPC-eca34f6da24597ec12
Object UUID : b08669ee-8cb5-43a5-a017-84fe00000000
UUID : 76f226c3-ec14-4325-8a99-6a46348418af, version 1.0
Description : Unknown RPC service
Type : Local RPC service
Named pipe : WMsgKRpc0103450
Object UUID : b08669ee-8cb5-43a5-a017-84fe00000000
UUID : 76f226c3-ec14-4325-8a99-6a46348418af, version 1.0
Description : Unknown RPC service
Type : Local RPC service
Named pipe : WindowsShutdown
Object UUID : 765294ba-60bc-48b8-92e9-89fd77769d91
UUID : d95afe70-a6d5-4259-822e-2c84da1ddb0d, version 1.0
Description : Unknown RPC service
Type : Local RPC service
Named pipe : WMsgKRpc0103450
Object UUID : 765294ba-60bc-48b8-92e9-89fd77769d91
UUID : d95afe70-a6d5-4259-822e-2c84da1ddb0d, version 1.0
Description : Unknown RPC service
Type : Local RPC service
Named pipe : WindowsShutdown
Object UUID : 00736665-0000-0000-0000-000000000000
UUID : c9ac6db5-82b7-4e55-ae8a-e464ed7b4277, version 1.0
Description : Unknown RPC service
Annotation : Impl friendly name
Type : Local RPC service
Named pipe : LRPC-1603bf0e56693e998f
Object UUID : 00736665-0000-0000-0000-000000000000
UUID : c9ac6db5-82b7-4e55-ae8a-e464ed7b4277, version 1.0
Description : Unknown RPC service
Annotation : Impl friendly name
Type : Local RPC service
Named pipe : audit
Object UUID : 00736665-0000-0000-0000-000000000000
UUID : c9ac6db5-82b7-4e55-ae8a-e464ed7b4277, version 1.0
Description : Unknown RPC service
Annotation : Impl friendly name
Type : Local RPC service
Named pipe : securityevent
Object UUID : 00736665-0000-0000-0000-000000000000
UUID : c9ac6db5-82b7-4e55-ae8a-e464ed7b4277, version 1.0
Description : Unknown RPC service
Annotation : Impl friendly name
Type : Local RPC service
Named pipe : protected_storage
Object UUID : 00736665-0000-0000-0000-000000000000
UUID : c9ac6db5-82b7-4e55-ae8a-e464ed7b4277, version 1.0
Description : Unknown RPC service
Annotation : Impl friendly name
Type : Local RPC service
Named pipe : samss lpc
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86, version 1.0
Description : Unknown RPC service
Annotation : KeyIso
Type : Local RPC service
Named pipe : LRPC-1603bf0e56693e998f
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86, version 1.0
Description : Unknown RPC service
Annotation : KeyIso
Type : Local RPC service
Named pipe : audit
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86, version 1.0
Description : Unknown RPC service
Annotation : KeyIso
Type : Local RPC service
Named pipe : securityevent
Object UUID : 00000000-0000-0000-0000-000000000000
UUID : b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86, version 1.0
Description : Unknown RPC service
Annotation : KeyIso
Type : Local RPC service
Named pipe : protected_storage
Description
By sending a Lookup request to the portmapper (TCP 135 or epmapper
PIPE) it was possible to enumerate the Distributed Computing Environment
(DCE) services running on the remote port.
Using this information it is possible to connect and bind to
each service by sending an RPC request to the remote port/pipe.
Solution
N/A
Risk Factor
None
Plugin ID: 19506
Nessus Scan Information
Synopsis
Information about the Nessus scan.
List of Hosts
192.168.2.220
Plugin Output
Information about this scan :
Nessus version : 4.4.1 (Build 15078)
Plugin feed version : 201112022238
Type of plugin feed : HomeFeed (Non-commercial use only)
Scanner IP : 192.168.2.223
Port scanner(s) : snmp_scanner
Port range : default
Thorough tests : no
Experimental tests : no
Paranoia level : 1
Report Verbosity : 1
Safe checks : yes
Optimize the test : yes
CGI scanning : disabled
Web application tests : disabled
Max hosts : 80
Max checks : 5
Recv timeout : 5
Backports : None
Scan Start Date : 2011/12/3 15:18
Scan duration : 321 sec
Description
This script displays, for each tested host, information about the scan itself:
- The version of the plugin set
- The type of plugin feed (HomeFeed or ProfessionalFeed)
- The version of the Nessus Engine
- The port scanner(s) used
- The port range scanned
- The date of the scan
- The duration of the scan
- The number of hosts scanned in parallel
- The number of checks done in parallel
Solution
n/a
Risk Factor
None
Plugin ID: 10394
Microsoft Windows SMB Log In Possible
Synopsis
It is possible to log into the remote host.
List of Hosts
192.168.2.220
Plugin Output
- NULL sessions are enabled on the remote host
- The SMB tests will be done as 'katrina'/'******'
Description
The remote host is running Microsoft Windows operating
system or Samba, a CIFS/SMB server for Unix. It was
possible to log into it using one of the following
accounts :
- NULL session
- Guest account
- Given Credentials
Solution
n/a
See also
http://support.microsoft.com/support/kb/articles/Q143/4/74.ASP
http://support.microsoft.com/support/kb/articles/Q246/2/61.ASP
Risk Factor
None
Plugin ID: 10913
Microsoft Windows - Local Users Information : Disabled accounts
Synopsis
At least one local user account has been disabled.
List of Hosts
192.168.2.220
Plugin Output
The following local user accounts have been disabled :
- Administrator
- Guest
Note that, in addition to the Administrator and Guest accounts, Nessus
has only checked for local users with UIDs between 1000 and 1200.
To use a different range, edit the scan policy and change the 'Start
UID' and/or 'End UID' preferences for 'SMB use host SID to enumerate
local users' setting, and then re-run the scan.
Description
Using the supplied credentials, it is possible to list local user
accounts that have been disabled.
Solution
Delete accounts that are no longer needed.
Risk Factor
None
Other references
OSVDB:752
Plugin ID: 10860
SMB Use Host SID to Enumerate Local Users
Synopsis
It is possible to enumerate local users.
List of Hosts
192.168.2.220
Plugin Output
- Administrator (id 500, Administrator account)
- Guest (id 501, Guest account)
- Katrina (id 1000)
Note that, in addition to the Administrator and Guest accounts, Nessus
has enumerated only those local users with IDs between 1000 and 1200.
To use a different range, edit the scan policy and change the 'Start
UID' and/or 'End UID' preferences for this plugin, then re-run the
scan.
Description
Using the host security identifier (SID), it is possible to enumerate local users
on the remote Windows system.
Solution
n/a
Risk Factor
None
Plugin ID: 14274
Nessus SNMP Scanner
Synopsis
List of Hosts
192.168.2.220
Plugin Output
Nessus snmp scanner was able to retrieve the open port list
with the community name: public
It found 11 open TCP ports and 15 open UDP ports
Description
Solution
Risk Factor
Plugin ID: 44401
Microsoft Windows SMB Service Config Enumeration
Synopsis
It is possible to enumerate configuration parameters of remote
services.
List of Hosts
192.168.2.220
Plugin Output
The following services are set to start automatically :
AeLookupSvc startup parameters :
Display name : Application Experience
Service name : AeLookupSvc
Log on as : localSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
AgereModemAudio startup parameters :
Display name : Agere Modem Call Progress Audio
Service name : AgereModemAudio
Log on as : LocalSystem
Executable path : C:\Windows\system32\agrsmsvc.exe
Apple Mobile Device startup parameters :
Display name : Apple Mobile Device
Service name : Apple Mobile Device
Log on as : LocalSystem
Executable path : "C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"
Dependencies : Tcpip/
Ati External Event Utility startup parameters :
Display name : Ati External Event Utility
Service name : Ati External Event Utility
Log on as : LocalSystem
Executable path : C:\Windows\system32\Ati2evxx.exe
AudioEndpointBuilder startup parameters :
Display name : Windows Audio Endpoint Builder
Service name : AudioEndpointBuilder
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : PlugPlay/
Audiosrv startup parameters :
Display name : Windows Audio
Service name : Audiosrv
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Dependencies : AudioEndpointBuilder/RpcSs/MMCSS/
BFE startup parameters :
Display name : Base Filtering Engine
Service name : BFE
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
Dependencies : RpcSs/
BITS startup parameters :
Display name : Background Intelligent Transfer Service
Service name : BITS
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs
Dependencies : RpcSs/EventSystem/
Bonjour Service startup parameters :
Display name : Bonjour Service
Service name : Bonjour Service
Log on as : LocalSystem
Executable path : "C:\Program Files\Bonjour\mDNSResponder.exe"
Dependencies : Tcpip/
Browser startup parameters :
Display name : Computer Browser
Service name : Browser
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs
Dependencies : LanmanWorkstation/LanmanServer/
CFSvcs startup parameters :
Display name : ConfigFree Service
Service name : CFSvcs
Log on as : LocalSystem
Executable path : C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
CryptSvc startup parameters :
Display name : Cryptographic Services
Service name : CryptSvc
Log on as : NT Authority\NetworkService
Executable path : C:\Windows\system32\svchost.exe -k NetworkService
Dependencies : RpcSs/
Dhcp startup parameters :
Display name : DHCP Client
Service name : Dhcp
Log on as : NT Authority\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
Dependencies : NSI/Tdx/Afd/
Dnscache startup parameters :
Display name : DNS Client
Service name : Dnscache
Log on as : NT AUTHORITY\NetworkService
Executable path : C:\Windows\system32\svchost.exe -k NetworkService
Dependencies : Tdx/
EMDMgmt startup parameters :
Display name : ReadyBoost
Service name : EMDMgmt
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : rpcss/ecache/slsvc/fileinfo/
EventSystem startup parameters :
Display name : COM+ Event System
Service name : EventSystem
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
Dependencies : rpcss/
Eventlog startup parameters :
Display name : Windows Event Log
Service name : Eventlog
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
FDResPub startup parameters :
Display name : Function Discovery Resource Publication
Service name : FDResPub
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
Dependencies : RpcSs/http/
FontCache startup parameters :
Display name : Windows Font Cache Service
Service name : FontCache
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
FontCache3.0.0.0 startup parameters :
Display name : Windows Presentation Foundation Font Cache 3.0.0.0
Service name : FontCache3.0.0.0
Log on as : NT Authority\LocalService
Executable path : C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
Hamachi2Svc startup parameters :
Display name : LogMeIn Hamachi Tunneling Engine
Service name : Hamachi2Svc
Log on as : LocalSystem
Executable path : "C:\Program Files\LogMeIn Hamachi\hamachi-2.exe" -s
IKEEXT startup parameters :
Display name : IKE and AuthIP IPsec Keying Modules
Service name : IKEEXT
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
Dependencies : BFE/
KtmRm startup parameters :
Display name : KtmRm for Distributed Transaction Coordinator
Service name : KtmRm
Log on as : NT AUTHORITY\NetworkService
Executable path : C:\Windows\System32\svchost.exe -k NetworkService
Dependencies : RPCSS/SamSS/
LMIGuardianSvc startup parameters :
Display name : LMIGuardianSvc
Service name : LMIGuardianSvc
Log on as : LocalSystem
Executable path : "C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe"
Dependencies : RPCSS/
LMIMaint startup parameters :
Display name : LogMeIn Maintenance Service
Service name : LMIMaint
Log on as : LocalSystem
Executable path : "C:\Program Files\LogMeIn\x86\RaMaint.exe"
LanmanServer startup parameters :
Display name : Server
Service name : LanmanServer
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
Dependencies : SamSS/Srv/
LanmanWorkstation startup parameters :
Display name : Workstation
Service name : LanmanWorkstation
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalService
Dependencies : Bowser/MRxSmb10/MRxSmb20/NSI/
LogMeIn startup parameters :
Display name : LogMeIn
Service name : LogMeIn
Log on as : LocalSystem
Executable path : "C:\Program Files\LogMeIn\x86\LogMeIn.exe"
Dependencies : Tcpip/RPCSS/
MMCSS startup parameters :
Display name : Multimedia Class Scheduler
Service name : MMCSS
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
MpsSvc startup parameters :
Display name : Windows Firewall
Service name : MpsSvc
Log on as : NT Authority\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
Dependencies : mpsdrv/bfe/
MsMpSvc startup parameters :
Display name : Microsoft Antimalware Service
Service name : MsMpSvc
Log on as : LocalSystem
Executable path : "C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe"
Dependencies : RpcSs/
NAUpdate startup parameters :
Display name : Nero Update
Service name : NAUpdate
Log on as : LocalSystem
Executable path : "C:\Program Files\Nero\Update\NASvc.exe"
Dependencies : RPCSS/
Net Driver HPZ12 startup parameters :
Display name : Net Driver HPZ12
Service name : Net Driver HPZ12
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k HPZ12
NlaSvc startup parameters :
Display name : Network Location Awareness
Service name : NlaSvc
Log on as : NT AUTHORITY\NetworkService
Executable path : C:\Windows\System32\svchost.exe -k NetworkService
Dependencies : NSI/RpcSs/TcpIp/
PcaSvc startup parameters :
Display name : Program Compatibility Assistant Service
Service name : PcaSvc
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : RpcSs/
PlugPlay startup parameters :
Display name : Plug and Play
Service name : PlugPlay
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k DcomLaunch
Pml Driver HPZ12 startup parameters :
Display name : Pml Driver HPZ12
Service name : Pml Driver HPZ12
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k HPZ12
PolicyAgent startup parameters :
Display name : IPsec Policy Agent
Service name : PolicyAgent
Log on as : NT Authority\NetworkService
Executable path : C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
Dependencies : Tcpip/bfe/
ProfSvc startup parameters :
Display name : User Profile Service
Service name : ProfSvc
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
Dependencies : RpcSs/
SBSDWSCService startup parameters :
Display name : SBSD Security Center Service
Service name : SBSDWSCService
Log on as : LocalSystem
Executable path : C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
Dependencies : wscsvc/
SENS startup parameters :
Display name : System Event Notification Service
Service name : SENS
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
Dependencies : EventSystem/
SamSs startup parameters :
Display name : Security Accounts Manager
Service name : SamSs
Log on as : LocalSystem
Executable path : C:\Windows\system32\lsass.exe
Dependencies : RPCSS/
ShellHWDetection startup parameters :
Display name : Shell Hardware Detection
Service name : ShellHWDetection
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs
Dependencies : RpcSs/
Spooler startup parameters :
Display name : Print Spooler
Service name : Spooler
Log on as : LocalSystem
Executable path : C:\Windows\System32\spoolsv.exe
Dependencies : RPCSS/http/
Swupdtmr startup parameters :
Display name : Swupdtmr
Service name : Swupdtmr
Log on as : LocalSystem
Executable path : c:\Toshiba\IVP\swupdate\swupdtmr.exe
SysMain startup parameters :
Display name : Superfetch
Service name : SysMain
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : rpcss/fileinfo/
TBS startup parameters :
Display name : TPM Base Services
Service name : TBS
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalService
TNaviSrv startup parameters :
Display name : TOSHIBA Navi Support Service
Service name : TNaviSrv
Log on as : LocalSystem
Executable path : C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
TODDSrv startup parameters :
Display name : TOSHIBA Optical Disc Drive Service
Service name : TODDSrv
Log on as : LocalSystem
Executable path : C:\Windows\system32\TODDSrv.exe
TOSHIBA Bluetooth Service startup parameters :
Display name : TOSHIBA Bluetooth Service
Service name : TOSHIBA Bluetooth Service
Log on as : LocalSystem
Executable path : C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
Dependencies : RPCSS/
TabletInputService startup parameters :
Display name : Tablet PC Input Service
Service name : TabletInputService
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : PlugPlay/RpcSs/
TermService startup parameters :
Display name : Terminal Services
Service name : TermService
Log on as : NT Authority\NetworkService
Executable path : C:\Windows\System32\svchost.exe -k NetworkService
Dependencies : RPCSS/TermDD/
Themes startup parameters :
Display name : Themes
Service name : Themes
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs
TosCoSrv startup parameters :
Display name : TOSHIBA Power Saver
Service name : TosCoSrv
Log on as : LocalSystem
Executable path : "C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe"
Dependencies : RPCSS/
TrkWks startup parameters :
Display name : Distributed Link Tracking Client
Service name : TrkWks
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : RpcSs/
UleadBurningHelper startup parameters :
Display name : Ulead Burning Helper
Service name : UleadBurningHelper
Log on as : LocalSystem
Executable path : C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
UxSms startup parameters :
Display name : Desktop Window Manager Session Manager
Service name : UxSms
Log on as : localSystem
Executable path : C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
W32Time startup parameters :
Display name : Windows Time
Service name : W32Time
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
WPDBusEnum startup parameters :
Display name : Portable Device Enumerator Service
Service name : WPDBusEnum
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : RpcSs/
WSearch startup parameters :
Display name : Windows Search
Service name : WSearch
Log on as : LocalSystem
Executable path : C:\Windows\system32\SearchIndexer.exe /Embedding
Dependencies : RPCSS/
WebClient startup parameters :
Display name : WebClient
Service name : WebClient
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
Dependencies : MRxDAV/
WerSvc startup parameters :
Display name : Windows Error Reporting Service
Service name : WerSvc
Log on as : localSystem
Executable path : C:\Windows\System32\svchost.exe -k WerSvcGroup
WinDefend startup parameters :
Display name : Windows Defender
Service name : WinDefend
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k secsvcs
Dependencies : RpcSs/
Winmgmt startup parameters :
Display name : Windows Management Instrumentation
Service name : Winmgmt
Log on as : localSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
Dependencies : RPCSS/
Wlansvc startup parameters :
Display name : WLAN AutoConfig
Service name : Wlansvc
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : nativewifip/RpcSs/Ndisuio/Eaphost/
clr_optimization_v4.0.30319_32 startup parameters :
Display name : Microsoft .NET Framework NGEN v4.0.30319_X86
Service name : clr_optimization_v4.0.30319_32
Log on as : LocalSystem
Executable path : C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
ehstart startup parameters :
Display name : Windows Media Center Service Launcher
Service name : ehstart
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
Dependencies : RPCSS/
hidserv startup parameters :
Display name : Human Interface Device Access
Service name : hidserv
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
hpqddsvc startup parameters :
Display name : HP CUE DeviceDiscovery Service
Service name : hpqddsvc
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k hpdevmgmt
Dependencies : RPCSS/
iphlpsvc startup parameters :
Display name : IP Helper
Service name : iphlpsvc
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k NetSvcs
Dependencies : RpcSS/Tdx/winmgmt/tcpip/nsi/
lmhosts startup parameters :
Display name : TCP/IP NetBIOS Helper
Service name : lmhosts
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
Dependencies : NetBT/Afd/
netprofm startup parameters :
Display name : Network List Service
Service name : netprofm
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalService
Dependencies : RpcSs/nlasvc/
nsi startup parameters :
Display name : Network Store Interface Service
Service name : nsi
Log on as : NT Authority\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
Dependencies : nsiproxy/
pinger startup parameters :
Display name : pinger
Service name : pinger
Log on as : LocalSystem
Executable path : C:\Toshiba\IVP\ISM\pinger.exe
seclogon startup parameters :
Display name : Secondary Logon
Service name : seclogon
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
slsvc startup parameters :
Display name : Software Licensing
Service name : slsvc
Log on as : NT AUTHORITY\NetworkService
Executable path : C:\Windows\system32\SLsvc.exe
Dependencies : RpcSs/
stisvc startup parameters :
Display name : Windows Image Acquisition (WIA)
Service name : stisvc
Log on as : NT Authority\LocalService
Executable path : C:\Windows\system32\svchost.exe -k imgsvc
Dependencies : RpcSs/ShellHWDetection/
wscsvc startup parameters :
Display name : Security Center
Service name : wscsvc
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Dependencies : RpcSs/WinMgmt/
wuauserv startup parameters :
Display name : Windows Update
Service name : wuauserv
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
Dependencies : rpcss/
wudfsvc startup parameters :
Display name : Windows Driver Foundation - User-mode Driver Framework
Service name : wudfsvc
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : PlugPlay/
The following services must be started manually :
ALG startup parameters :
Display name : Application Layer Gateway Service
Service name : ALG
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\alg.exe
Appinfo startup parameters :
Display name : Application Information
Service name : Appinfo
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
Dependencies : RpcSs/ProfSvc/
COMSysApp startup parameters :
Display name : COM+ System Application
Service name : COMSysApp
Log on as : LocalSystem
Executable path : C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
Dependencies : RpcSs/EventSystem/SENS/
DFSR startup parameters :
Display name : DFS Replication
Service name : DFSR
Log on as : LocalSystem
Executable path : C:\Windows\system32\DFSR.exe
Dependencies : RpcSs/EventSystem/
EapHost startup parameters :
Display name : Extensible Authentication Protocol
Service name : EapHost
Log on as : localSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs
Dependencies : RPCSS/KeyIso/
GoogleDesktopManager-051210-111108 startup parameters :
Display name : Google Desktop Manager 5.9.1005.12335
Service name : GoogleDesktopManager-051210-111108
Log on as : LocalSystem
Executable path : "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe"
Dependencies : RPCSS/
IDriverT startup parameters :
Display name : InstallDriver Table Manager
Service name : IDriverT
Log on as : LocalSystem
Executable path : "C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe"
IPBusEnum startup parameters :
Display name : PnP-X IP Bus Enumerator
Service name : IPBusEnum
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : RpcSs/fdPHost/
KeyIso startup parameters :
Display name : CNG Key Isolation
Service name : KeyIso
Log on as : LocalSystem
Executable path : C:\Windows\system32\lsass.exe
Dependencies : RpcSs/
MSiSCSI startup parameters :
Display name : Microsoft iSCSI Initiator Service
Service name : MSiSCSI
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
Netlogon startup parameters :
Display name : Netlogon
Service name : Netlogon
Log on as : LocalSystem
Executable path : C:\Windows\system32\lsass.exe
Dependencies : LanmanWorkstation/
Netman startup parameters :
Display name : Network Connections
Service name : Netman
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : RpcSs/nsi/
NisSrv startup parameters :
Display name : Microsoft Network Inspection
Service name : NisSrv
Log on as : NT AUTHORITY\LocalService
Executable path : "C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe"
Dependencies : NisDrv/
PNRPAutoReg startup parameters :
Display name : PNRP Machine Name Publication Service
Service name : PNRPAutoReg
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Dependencies : pnrpsvc/
PNRPsvc startup parameters :
Display name : Peer Name Resolution Protocol
Service name : PNRPsvc
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Dependencies : p2pimsvc/
ProtectedStorage startup parameters :
Display name : Protected Storage
Service name : ProtectedStorage
Log on as : LocalSystem
Executable path : C:\Windows\system32\lsass.exe
Dependencies : RpcSs/
QWAVE startup parameters :
Display name : Quality Windows Audio Video Experience
Service name : QWAVE
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
Dependencies : rpcss/psched/QWAVEdrv/LLTDIO/
RasAuto startup parameters :
Display name : Remote Access Auto Connection Manager
Service name : RasAuto
Log on as : localSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
Dependencies : RasMan/Tapisrv/
RasMan startup parameters :
Display name : Remote Access Connection Manager
Service name : RasMan
Log on as : localSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
Dependencies : Tapisrv/SstpSvc/
RemoteRegistry startup parameters :
Display name : Remote Registry
Service name : RemoteRegistry
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k regsvc
Dependencies : RPCSS/
RpcLocator startup parameters :
Display name : Remote Procedure Call (RPC) Locator
Service name : RpcLocator
Log on as : NT AUTHORITY\NetworkService
Executable path : C:\Windows\system32\locator.exe
SDRSVC startup parameters :
Display name : Windows Backup
Service name : SDRSVC
Log on as : localSystem
Executable path : C:\Windows\system32\svchost.exe -k SDRSVC
Dependencies : RPCSS/
SLUINotify startup parameters :
Display name : SL UI Notification Service
Service name : SLUINotify
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
Dependencies : SLSvc/netprofm/EventSystem/
SNMPTRAP startup parameters :
Display name : SNMP Trap
Service name : SNMPTRAP
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\snmptrap.exe
SSDPSRV startup parameters :
Display name : SSDP Discovery
Service name : SSDPSRV
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
Dependencies : HTTP/
SessionEnv startup parameters :
Display name : Terminal Services Configuration
Service name : SessionEnv
Log on as : localSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs
Dependencies : RPCSS/LanmanWorkstation/
SstpSvc startup parameters :
Display name : Secure Socket Tunneling Protocol Service
Service name : SstpSvc
Log on as : NT Authority\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
THREADORDER startup parameters :
Display name : Thread Ordering Server
Service name : THREADORDER
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
TapiSrv startup parameters :
Display name : Telephony
Service name : TapiSrv
Log on as : NT AUTHORITY\NetworkService
Executable path : C:\Windows\System32\svchost.exe -k NetworkService
Dependencies : PlugPlay/RpcSs/
UI0Detect startup parameters :
Display name : Interactive Services Detection
Service name : UI0Detect
Log on as : LocalSystem
Executable path : C:\Windows\system32\UI0Detect.exe
VSS startup parameters :
Display name : Volume Shadow Copy
Service name : VSS
Log on as : LocalSystem
Executable path : C:\Windows\system32\vssvc.exe
Dependencies : RPCSS/
WMPNetworkSvc startup parameters :
Display name : Windows Media Player Network Sharing Service
Service name : WMPNetworkSvc
Log on as : NT AUTHORITY\NetworkService
Executable path : "C:\Program Files\Windows Media Player\wmpnetwk.exe"
Dependencies : UPnPHost/http/
WPCSvc startup parameters :
Display name : Parental Controls
Service name : WPCSvc
Log on as : NT Authority\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
Dependencies : RpcSs/
WPFFontCache_v0400 startup parameters :
Display name : Windows Presentation Foundation Font Cache 4.0.0.0
Service name : WPFFontCache_v0400
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
WcsPlugInService startup parameters :
Display name : Windows Color System
Service name : WcsPlugInService
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k wcssvc
Dependencies : RpcSs/
Wecsvc startup parameters :
Display name : Windows Event Collector
Service name : Wecsvc
Log on as : NT AUTHORITY\NetworkService
Executable path : C:\Windows\system32\svchost.exe -k NetworkService
Dependencies : HTTP/Eventlog/
WinHttpAutoProxySvc startup parameters :
Display name : WinHTTP Web Proxy Auto-Discovery Service
Service name : WinHttpAutoProxySvc
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
Dependencies : Dhcp/
WinRM startup parameters :
Display name : Windows Remote Management (WS-Management)
Service name : WinRM
Log on as : NT AUTHORITY\NetworkService
Executable path : C:\Windows\System32\svchost.exe -k NetworkService
Dependencies : RPCSS/HTTP/
dot3svc startup parameters :
Display name : Wired AutoConfig
Service name : dot3svc
Log on as : localSystem
Executable path : C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
Dependencies : RpcSs/Ndisuio/Eaphost/
ehRecvr startup parameters :
Display name : Windows Media Center Receiver Service
Service name : ehRecvr
Log on as : NT AUTHORITY\networkService
Executable path : C:\Windows\ehome\ehRecvr.exe
Dependencies : RPCSS/
ehSched startup parameters :
Display name : Windows Media Center Scheduler Service
Service name : ehSched
Log on as : NT AUTHORITY\networkService
Executable path : C:\Windows\ehome\ehsched.exe
Dependencies : RPCSS/
fdPHost startup parameters :
Display name : Function Discovery Provider Host
Service name : fdPHost
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
Dependencies : RpcSs/http/
gusvc startup parameters :
Display name : Google Updater Service
Service name : gusvc
Log on as : LocalSystem
Executable path : "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
Dependencies : RPCSS/
hkmsvc startup parameters :
Display name : Health Key and Certificate Management
Service name : hkmsvc
Log on as : localSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs
Dependencies : RpcSs/
hpqcxs08 startup parameters :
Display name : hpqcxs08
Service name : hpqcxs08
Log on as : LocalSystem
Executable path : C:\Windows\system32\svchost.exe -k hpdevmgmt
Dependencies : RPCSS/
iPod Service startup parameters :
Display name : iPod Service
Service name : iPod Service
Log on as : LocalSystem
Executable path : "C:\Program Files\iPod\bin\iPodService.exe"
Dependencies : RpcSs/
lltdsvc startup parameters :
Display name : Link-Layer Topology Discovery Mapper
Service name : lltdsvc
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalService
Dependencies : rpcss/lltdio/
msiserver startup parameters :
Display name : Windows Installer
Service name : msiserver
Log on as : LocalSystem
Executable path : C:\Windows\system32\msiexec /V
Dependencies : rpcss/
napagent startup parameters :
Display name : Network Access Protection Agent
Service name : napagent
Log on as : NT AUTHORITY\NetworkService
Executable path : C:\Windows\System32\svchost.exe -k NetworkService
Dependencies : RpcSs/
odserv startup parameters :
Display name : Microsoft Office Diagnostics Service
Service name : odserv
Log on as : LocalSystem
Executable path : "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE"
ose startup parameters :
Display name : Office Source Engine
Service name : ose
Log on as : LocalSystem
Executable path : "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
p2pimsvc startup parameters :
Display name : Peer Networking Identity Manager
Service name : p2pimsvc
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
p2psvc startup parameters :
Display name : Peer Networking Grouping
Service name : p2psvc
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
Dependencies : p2pimsvc/PNRPSvc/
pla startup parameters :
Display name : Performance Logs & Alerts
Service name : pla
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
Dependencies : RPCSS/
swprv startup parameters :
Display name : Microsoft Software Shadow Copy Provider
Service name : swprv
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k swprv
Dependencies : RPCSS/
upnphost startup parameters :
Display name : UPnP Device Host
Service name : upnphost
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
Dependencies : SSDPSRV/HTTP/
vds startup parameters :
Display name : Virtual Disk
Service name : vds
Log on as : LocalSystem
Executable path : C:\Windows\System32\vds.exe
Dependencies : RpcSs/PlugPlay/
wcncsvc startup parameters :
Display name : Windows Connect Now - Config Registrar
Service name : wcncsvc
Log on as : NT AUTHORITY\LocalService
Executable path : C:\Windows\System32\svchost.exe -k LocalService
Dependencies : rpcss/
wercplsupport startup parameters :
Display name : Problem Reports and Solutions Control Panel Support
Service name : wercplsupport
Log on as : localSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs
wmiApSrv startup parameters :
Display name : WMI Performance Adapter
Service name : wmiApSrv
Log on as : localSystem
Executable path : C:\Windows\system32\wbem\WmiApSrv.exe
The following services are disabled :
Mcx2Svc startup parameters :
Display name : Windows Media Center Extender Service
Service name : Mcx2Svc
Log on as : NT Authority\LocalService
Executable path : C:\Windows\system32\svchost.exe -k LocalService
Dependencies : SSDPSRV/IPBusEnum/TermService/fdphost/
NetTcpPortSharing startup parameters :
Display name : Net.Tcp Port Sharing Service
Service name : NetTcpPortSharing
Log on as : NT AUTHORITY\LocalService
Executable path : "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe"
RemoteAccess startup parameters :
Display name : Routing and Remote Access
Service name : RemoteAccess
Log on as : localSystem
Executable path : C:\Windows\system32\svchost.exe -k netsvcs
Dependencies : RpcSS/RasMan/bfe/+NetBIOSGroup/
SharedAccess startup parameters :
Display name : Internet Connection Sharing (ICS)
Service name : SharedAccess
Log on as : LocalSystem
Executable path : C:\Windows\System32\svchost.exe -k netsvcs
Dependencies : Netman/WinMgmt/RasMan/BFE/
clr_optimization_v2.0.50727_32 startup parameters :
Display name : Microsoft .NET Framework NGEN v2.0.50727_X86
Service name : clr_optimization_v2.0.50727_32
Log on as : LocalSystem
Executable path : C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
Description
This plugin implements the QueryServiceConfig() calls to obtain,
using the SMB protocol, the launch parameters of each active service
on the remote host (executable path, log on type, etc).
Solution
Ensure that each service is configured properly.
Risk Factor
None
Plugin ID: 34022
SNMP Query Routing Information Disclosure
Synopsis
The list of IP routes on the remote host can be obtained via SNMP.
List of Hosts
192.168.2.220
Plugin Output
5.0.0.0/255.0.0.0
5.118.62.187/255.255.255.255
5.255.255.255/255.255.255.255
127.0.0.0/255.0.0.0
127.0.0.1/255.255.255.255
127.255.255.255/255.255.255.255
169.254.0.0/255.255.0.0
169.254.255.255/255.255.255.255
192.168.2.192/255.255.255.192
192.168.2.220/255.255.255.255
192.168.2.255/255.255.255.255
224.0.0.0/240.0.0.0
255.255.255.255/255.255.255.255
Description
It is possible to obtain the routing information on the remote host
by sending SNMP requests with the OID 1.3.6.1.2.1.4.21
An attacker may use this information to gain more knowledge about the
network topology.
Solution
Disable the SNMP service on the remote host if you do not use it, or
filter incoming UDP packets going to this port.
Risk Factor
None
192.168.2.220 | |
---|---|
Scan Time | |
Start time: | Sat Dec 03 15:18:46 2011 |
End time: | Sat Dec 03 15:24:08 2011 |
Number of vulnerabilities | |
High | 2 |
Medium | 1 |
Low | 40 |
Remote Host Information | |
Operating System: | Microsoft Windows Vista Home |
NetBIOS name: | MIDNIGHTBLUE |
DNS name: | MIDNIGHTBLUE |
IP address: | 192.168.2.220 |
MAC address: | 00:16:44:1a:de:b5 |