About a year ago my Windows server 2008 R2 server was hacked. I had RDP open to the world, I know, not a good idea. Being that it was a year ago I don't have any of the logs, but I was thinking about something today.
How did they get the username?
It wasn't the administrator account, however, the administrator was active and being used, that is the only way I knew they were on there. Also, there was no password policy setup. This server is really not for anything important. I use it more as a playground.
For about 12 hours an IP out of Poland was brute forcing my server. Looking at the audit logs post incident I noticed about 12k, maybe more, attempts to get the right username and password.
I noticed they started with what looked like an educated guess of usernames, common names mostly, then somehow they got the right username they started with password guessing.
I watched this happen for two reasons really:
- To see if they could get in.
- To see what they were after.
Once they were in I used VNC to look at the desktop to see what they were doing. They were basically looking through everything, but since the user had very minimal privileges they could not get too much.
Yes, I gave the user RDP access but not much else.
When I tested this just now and put the right username/wrong password vs wrong username/wrong password I didn't see anything to indicate the username was right or wrong.
How did they know that they had found the right username? What software or program might they have been using?