i use metasploit for pentesting windows 2003 sp2 server but when windows firewall is on i am not able to perform pentest successfully is there any way to disable firewall remotly?

  • Remotely? As in, Group Policy? If so, yes, there is. – Alex Holst Feb 4 '11 at 22:36
  • Wouldn't that, umm, negate the purpose of the pentest? – Steve Feb 5 '11 at 0:46
  • 1
    Can you give a bit more context to your question - as per the faq. What type of security test are you carrying out? For most forms of test, the fact the firewall stopped you is a successful outcome... – Rory Alsop Feb 5 '11 at 0:47

If you have to disable the firewall in order to run a particular exploit then that test demonstrates the firewall is working effectively as a mitigating control. Which is generally the aim of a 'pen test'

Once you disable the firewall, many exploits are likely to work (I'm thinking zero days as well as all services with unpatched vulnerabilities) so it doesn't really add value.

Metasploit is a useful tool for automating simple or tedious exploits, but if you are at the point of needing to disable the firewall in order to run it, you are probably barking up the wrong tree.

|improve this answer|||||
  • I'd love a clearer question. But why are folks arguing against testing various aspects of defense in depth here? a) there may be an unknown vulnerability in the firewall; b) there may be situations in which it disabling the firewall is indicated; c) it may be a matter of testing things that work differently depending on which network they come in over; etc. It can certainly be appropriate to be able to test the underlying services, which shouldn't have vulnerabilities in them.... – nealmcb Feb 5 '11 at 6:08
  • @nealmcb - the problem here is that this is a remote pen test of a windows server, according to the OP. I can think of very few instances where I would be happy with taking on the liability for a client disabling a firewall so I could test past it. What happens if they get really hacked while it is down? In every single test I have carried out over the last 10 years where I had to start from the point of an attacker who has bypassed the firewall I would sit in the datacentre and connect directly to a DMZ or internal network. – Rory Alsop Feb 5 '11 at 10:51
  • 1
    I admit I'm being a bit generous here with a confusing question. Perhaps this is a test of a test system rather than a true live "penetration test" of a valuable system. At any rate, this seems more like an admin question (for sourceforge?) than a security question. – nealmcb Feb 5 '11 at 16:37

I had a pentest, where I was able to get in using one exploit, but needed the firewall to be disabled for some other access. I found these 2 links to be extremely helpful towards disabling the firewall from a command line remotely:

For XP & Windows 2003: Netsh firewall set opmode disable

For Windows 7 and 2008: netsh advfirewall set currentprofile state off

For both of these, you will need Administrator access. If you're trying to disable the firewall before gaining any sort of access, you're pretty much out of luck.

|improve this answer|||||
  • with active directory GPO we can run script on start up in scope (OU) we want? to disable firewall and setup any another 3rd-party firewall? which firewall you suggest? – saber tabatabaee yazdi Nov 29 '12 at 8:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.