I got the question "Explain how one would typically detect systems vulnerable to “NULL Session” " ,but I do not know how to answer this question. Could you help me?

closed as unclear what you're asking by Eric G, Xander, John Deters, TildalWave, Steve Mar 25 '14 at 21:13

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Are you already familiar with what a NULL-session is? The definition might vary on context. Is there a special context for this question? – Philipp Mar 25 '14 at 16:11
  • @Philipp I'm pretty sure he's talking about accessing IPC$ – Adi Mar 25 '14 at 17:47
  • Yes, that is IPC – ponomy Mar 26 '14 at 13:29

As @Philipp noted, it's not exactly clear, but if you are talking about a windows authentication null session, there are a lot of resources out there. Basically, it means you get access to some system resources shared on the network without needing real credentials to authenticate (log on). This existing definition is pretty good:

A remote session is created when a user logs on to a computer remotely using a username and password that has access to system resources. This is accomplished through the Server Message Block (SMB) protocol and the Windows Server service. These connections are entirely legitimate when proper credentials are supplied.

A null session comes into play when a user makes a connection to a windows system with no username or password. This type of connection can not be made to any typical windows share, but it can be done to the Interprocess Communication (IPC) administrative share. The IPC share, as the name alludes to, is used by Windows processes (via the SYSTEM username) to communicate with other processes across the network. The IPC share is used exclusively by the SMB protocol.

Using the IPC share with no credentials is typically reserved for programs communicating with one another, but there is nothing to say that a user could not connect to a machine via the IPC connection instead. This would not allow for unrestricted access to the machine, but will allow for pretty extensive enumeration that could aide an attacker.

This site also explains how to test for this using net use command. There are also some purpose built tools for this you can find.

Not the answer you're looking for? Browse other questions tagged or ask your own question.