Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

Here is my situation:
I already compromised the webserver. I want to attack the database server which has a IP of 192.168.100.2 which is a network that cannot be reach from outside. Through pivoting, I'm able to reach the database server. 192.168.100.2 have 135,139,445,3306 port open and is very likely to be running on windows xp sp3.

Some ways i tried:

  1. Tried this exploit "ms08_067_netapi". However, it stop at “attempting to trigger vulnerability”. Could it be antivirus, firewall that is causing the problem?
  2. Tried attacking smb client by using the list of username,password i dump from the webserver. No account seems to work.

Is there any other way I can attack on? Btw I'm doing all this over the internet, not locally.

share|improve this question
1.) If you're dealing with a separate web & database servers, it's very unlikely that the latter is running XP SP3. (Much more likely to be running a current version of Server 2003, if your OS fingerprinting is leaning towards XP.) 2.) Why are you trying to exploit a vulnerability that was patched almost four years ago? – Iszi Sep 14 '12 at 17:52
Closed as too localised/not a real question - the specifics of your circumstance are very localised, and not likely to help any future visitors. Your best bet is to see whether @Iszi's guess at OS is right - remote attacks have so many aspects that can block an attack that you just need to work through them all from most to least likely... – Rory Alsop♦ Sep 14 '12 at 18:05
Don't try out exploits you are reading about in a book on a real server. That is a quick route to jail. – ekaj Sep 16 '12 at 5:33

closed as too localized by Iszi, Rory Alsop♦ Sep 14 '12 at 18:04

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, see the FAQ.

Browse other questions tagged or ask your own question.