-: In this demonstration, I'm going to show you
how a null session is created.
But you may be wondering,
what exactly is a null session?
Well, a null session is a connection to the
Windows interprocess communications share
known as the IPC dollar sign.
This is an administrative share that you don't see
as a normal user, but it allows computers
across the network to send information that they know
about files, folders, users, groups, computers,
and servers to each other.
Now, as an attacker, if you're able to create
a null connection to a computer, you can use that
as part of your information gathering
and enumeration and be able to use all of that data
as part of your follow-on attack.
So, if a null connection can give you access to all
of this information, how easy is it to really
get a null connection set up?
Well, you can do it with one line of code
inside the command line
as I'm going to show you here
using my Windows 10 machine
over a local area network.
So, here I am at the command prompt.
To do a null connection, all you have to use
is the net use command.
Net space use and then the IP address
that you want to connect to.
In my case, that's 10.0.2.15
and then slash ipc$
to connect to that administrative share,
the inner process communication.
Now, from there, you're going to use a space, two quotes,
which is going to say that you have no password,
the slash u for the user and then two more quotes,
which says you have no user.
It's a blank user and a blank password.
If you hit enter, now that you have this connection,
you can start gathering information, such as the users
and the groups, the files, the shares, the local resources,
all of that using other tools that a penetration tester
or hacker might use.
So, now that you've seen how easy it is to create
a null connection, you may be wondering,
what can I do to stop this from being used against me?
Well, for one, on your local machine, if you block
port 445 and 139, this is going to block smb,
your file sharing, as well as port 139 net bios
and both of these ports are used heavily to
get information from your machine and do things
like enumeration such as when you're
using the null session.
So, this will be your first step in blocking someone
from getting there.
The second thing you can do, is you can install
an IPS at your boundary.
This will prevent anyone from outside your network
trying to make a null connection into any of your machines.
Both of these are good steps in limiting the ability
of an attacker to be able to gather information
about you and your network.