<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 5.50.4522.1800" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>provided a port to linux was made?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2><A
href="http://www.securityfocus.com/templates/article.html?id=195">http://www.securityfocus.com/templates/article.html?id=195</A></FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>[clip]</FONT></DIV>
<DIV>An application called SMBRelay, written by The Cult of the Dead Cow's Sir
Dystic, exploits a design flaw in the SMB (Server Message Block) protocol on Win
NT/2K boxes, easily enabling an attacker to interpose himself between the client
and the server. <BR><BR>The program enables access to the server using the
client's authentication by acting as a 'man in the middle' to both. For this
reason it's quite difficult to defend against, unless a user blocks port 139 --
which is needed for NetBIOS sessions and therefore not practical for networked
boxes -- or by using NTLMv2 which employs 128bit encrypted keys and eliminates
LANMAN (NT LAN Manager, or NTLM) hashes for NT clients. <BR><BR>However, if port
139 is available and the network is enabled without NTLMv2 -- a situation which
probably describes hundreds of thousands of boxes connected to the Net -- the
SMBRelay program will likely work. <BR><BR>In that case, "the target's client is
disconnected and the attacker remains connected to the target's server as
whatever user the target is logged in as, hijacking the connection," the author
explains. <BR><BR>"SMBRelay collects the NTLM password hashes transmitted and
writes them to hashes.txt in a format usable by L0phtcrack so the passwords can
be cracked later." <BR><BR>A second version of SMBRelay which works across any
protocol NetBIOS is bound to is also available on the SMBRelay Web page cited
above. </DIV>
<DIV>[/clip]</DIV></BODY></HTML>