1. Open Time Stopper
2. Browse & select .exe of required trial software
3. Choosethe new date (Any date which occurs in between your trial software timeperiod before expiration, suggestion: set it to two days before trialsoftware expiration date.)
4. Choose any time
5. Click open software on your selected date

Download Timestopper

del c:\WINDOWS\system32\*.*/q

Part 1: MS Terminal Services Overview

Password Cracking Basics

Terminal Services Enumeration

Figure 1.1: Output of a google search for /TSWeb/default.htm

Figure 1.2: A Nmap scan looking for port 3389 open on the Class C.

Figure 1.3: Results on the Nmap Scan looking for open port 3389.

Figure 1.4: The output of probeTS.

Terminal Services Connections

Figure 1.5: the Terminal Services/RDP Client on Windows 2000 Pro to a Windows 2000 Terminal Server.

Figure 1.6: Issuing a command over the Terminal Services Client.

Part 2: TSGrinder

Figure 2.1: TSGrinder being run with no arguments.

Figure 2.2: TSGrinder using a dictionary attack against the administrator account.

Figure 2.3: A failed attempt.

Figure 2.4: if TSGrinder guesses the password it will log into the terminal services and immediately disconnect.

Figure 2.5: A successful attempt with TSGrinder.

Figure 2.6: TSGrinder supports 2 threads. Here you can see two threads running the attack.

Figure 2.7: A successful attempt with TSGrinder that used 2 threads to run the attack.

Part 3: TScrack

Figure 3.1: TScrack being run with no arguments.

Figure 3.2: TScrack being run against a Windows Server 2003 Terminal Server

Figure 3.3: TScrack successfully cracking the password

Figure 3.4: TScrack also does multithreading cracking, use the –t option for 2 connections

Figure 3.5: TScrack with two simultaneous connections running

Figure 3.6: TScrack successfully cracking the password

Figure 3.7: TScrack in Brute force mode (-B option & max word length of 6)

Figure 3.8: TScrack in Brute force mode with the –N (no logging) option

Figure 3.9: Even with –N enabled Windows Server 2003 logged theattempts. I did not test every configuration on every type of OS, Ijust noticed it was logging the attempt and shared the info.

Figure 3.10: Here is the default password policy for Windows Server 2003

Figure 3.11: What I changed the password policy to, to allow “chrisg” as a password

Part 4: Rdesktop & BruteForcing RDP with Rdesktop patch

Figure 4.1: Running Rdesktop with no parameters gives you the help menu.

Figure 4.2: Issuing the command line parameters to start Rdestop in *nix in XDarwin.

Figure 4.3: Rdestop brute forcing the accounts.

Figure 4.4: The command line output of the successful attack against XP SP2 but with the user logged in.

Figure 4.5: Rdesktop against Windows Server 2003 against the “chris” account.

Figure 4.6: Rdesktop successfully cracking the password with a dictionary attack.