[翻译]WinXP中的空连接-阿里云开发者社区

[翻译]WinXP中的空连接

2017-11-23 1072

简介：

+关注继续查看

第一次翻译鸟文，不对的地方大家帮帮忙~~~

空连接*一直*都能够在NT4, Windows 2000, 和 Windows XP 的机器上实现。如果对方主机的相应服务是打开着的，并且没有关闭139或445端口，你便可以使用匿名进行连接，对方主机会对回复你说“Command completed successfully"（命令成功完成）。这些在NT4 到Win2K 到 XP 中都没有改变。

那什么被改变了呢？在成功建立空连接后，你能干什么呢？在NT4和Win2k的默认情况下，你可以枚举账户列表和共享文件信息。当在注册表中设置RestrictAnonymous=1 时，它能够帮你防止别人枚举你的相关信息（虽然不是完全的防止）。RestrictAnonymous=2 将会完全防止，只在Win2K中有效。

在WinXP中，注册表中的键值被重新定义了：

默认时，RestrictAnonymousSam=1 。这个将防治枚举账户信息。这个键值的定义说明是：“Do not allow anonymous enumeration of SAM accounts.”默认值是激活了这项功能（这意味着XP默认时不能通过空连接来枚举账户信息）。

默认时，RestrictAnonymous=0。这个将防治枚举SAM中的账户信息和共享信息。这个键值的定义说明是：“Do not allow anonymous enumeration of SAM accounts and shares”激活开关的键值应该是1。

RestrictAnonymous=2在XP上不再有效。

所以，在XP系统的默认设置情况下，你能够匿名连接并且枚举共享信息，但是不能枚举账户信息。

总而言之，想要完全的禁止匿名用户连接，应该关闭139和445端口（通过IPSec端口过滤或Internet防火墙），或者在网络的协议属性中不选择“在Microsoft网络中共享文件和打印”。

原文：

Null sessions can *always* be established to NT4, Windows 2000, and Windows
XP machines. If the machine's server service is enabled, and ports 139 or
445 are available, then you can do a net use with anonymous credentials,
and the system will respond with "Command completed successfully". This
has not changed from NT4 to Win2K to XP.

What has changed, however, is what you are able to do once you establish
the null session. In NT4 and Win2K, by default, you could enumerate
information about users and shares. Setting RestrictAnonymous=1 would help
prevent against this enumaration (though not fully). RestrictAnonymous=2
(Win2K only) would fully prevent this enumeration.

On Windows XP, there are new registry keys:

RestrictAnonymousSam=1 is a default setting. This prevents detailed
enumeration of user accounts. This setting correlates with the
SecurityPolicy setting "Do not allow anonymous enumeration of SAM
accounts" with a default setting 'Enabled" (meaning the default of XP will
prohibit anonymous enumeration (R.A.SAM=1).

RestrictAnonymous=0 is a default setting. This correlates with the
SecurityPolicy Setting "Do not allow anonymous enumeration of SAM accounts
and shares". Set this policy to 'Enabled' (RA=1) to prevent anonymous
enumeration of shares.

RestrictAnonymous=2 (on XP) is no longer a valid setting.

So, by default, on an XP system, you can anonymously connect and enumerate
shares by default, but you cannot enumerate detailed user information.

To disable anonymous connections altogether, block access to tcp139/445
(IPSec port filters or Internet Connection Firewall), or uncheck "File and
Print Sharing for Microsoft Networks" from the network interface in

question (via the properties tab of the network connection).

本文转自loveme2351CTO博客，原文链接：http://blog.51cto.com/loveme23/7696 ，如需转载请自行联系原作者