<?xml version="1.0"?>
<?xml:stylesheet type="text/xsl" href="templates//nsaudit.xslt"?>
<Nsauditor version="1.0.25.0" vendor="Nsasoft LLC." url="http://www.nsauditor.com" mail="support@nsauditor.com" created="01/22/2005 20:08:59" comments="Nsauditor Database File">
<Hosts Profile="Default Audit Profile" StartIp="192.168.0.2" EndIp="192.168.0.2" HostCount="1" TcpPortsCount="76" UdpPortsCount="19" RiskHigh="3" RiskMedium="11" RiskLow="9">
<Host Ip="192.168.0.2" State="Y" OS="Windows 2000 SP4, " FirewallRules="ICMP Timestamp Reply Blocked," Dns="camelot" MacAddress="00:80:48:2A:82:FD" MacVendor="COMPEX INCORPORATED" RiskHigh="3" RiskMedium="11" RiskLow="9" Country="" Class="">
<Tcp>
<Port num="21" name="ftp" desc="file">
<FtpAudit banner="220 camelot Microsoft FTP Service (Version 5.0).  ">
<Vuln type="Warning" risk="Low" name="Ftp server is running" bugtraq="" solution="" comment="220 camelot Microsoft FTP Service (Version 5.0).  "/>
<Vuln type="Vulnerability" risk="Low" name="This FTP service allows anonymous logins." bugtraq="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0497" solution="Deactivate the anonymous account if you do not want to share data with anyone you do not know." comment=""/>
<Vuln type="Warning" risk="Low" name="Remote Directory Information" bugtraq="" solution="" comment="/"/>
<Vuln type="Warning" risk="Low" name="Remote Directory Information" bugtraq="" solution="" comment="/public/"/>
<Vuln type="Informational" risk="Low" name="SITE command Response" bugtraq="" solution="" comment="214-The following SITE  commands are recognized(* ==&gt;&apos;s unimplemented).     CKM           DIRSTYLE      HELP          STATS      214  HELP command successful.  "/>
<Vuln type="Informational" risk="Low" name="STAT command Response" bugtraq="" solution="" comment="211-camelot Microsoft Windows NT FTP Server status:       Version 5.0       Connected to Diana       Logged in as nsauditor@nsauditor.com       TYPE: ASCII, FORM: Nonprint; STRUcture: File; transfer MODE: STREAM       No data connection  " Banner="220 camelot Microsoft FTP Service (Version 5.0).  "/>
</FtpAudit>
</Port>
<Port num="80" name="http" desc="hypertext transfer protocol, world wide web http">
<HttpAudit>
<Vuln type="Vulnerability" risk="Low" name="Netscape PageServices" url="/?PageServices" bugtraq="" comment="List page directory" data="&lt;!--     WARNING!     Please do not alter this file. It may be replaced if you upgrade your web server        If you want to use it as a template, we recommend renaming it, and modifying the new file.     Thanks.  --&gt;      &lt;HTML&gt;    &lt;HEAD&gt;  &lt;META HTTP-EQUIV=&quot;Content-Type&quot; Content=&quot;text-html; charset=Windows-1252&quot;&gt;         &lt;title id=titletext&gt;Under Construction&lt;/title&gt;  &lt;/HEAD&gt;   &lt;body bgcolor=white&gt;   &lt;TABLE&gt;   &lt;TR&gt;   &lt;td id=&quot;tableProps&quot; width=70 valign=top align=center&gt;   &lt;IMG id=&quot;pagerrorImg&quot; SRC=&quot;pagerror.gif&quot; width=36 height=48&gt;     &lt;TD id=&quot;tablePropsWidth&quot; width=400&gt;      &lt;h1 id=errortype style=&quot;font:14pt/16pt verdana; color:#4e4e4e&quot;&gt;   &lt;id id=&quot;Comment1&quot;&gt;&lt;!--Problem--&gt;&lt;/id&gt;&lt;id id=&quot;errorText&quot;&gt;Under Construction&lt;/id&gt;&lt;/h1&gt;   &lt;id id=&quot;Comment2&quot;&gt;&lt;!--Probable causes:&lt;--&gt;&lt;/id&gt;&lt;id id=&quot;errordesc&quot;&gt;&lt;font style=&quot;font:9pt/12pt verdana; color:black&quot;&gt;   The site you were trying to reach does not currently have a default page. It may be in the process of being upgraded.   &lt;/id&gt;   &lt;br&gt;&lt;br&gt;      &lt;hr size=1 color=&quot;blue&quot;&gt;      &lt;br&gt;   &lt;ID  id=term1&gt;   Please try this site again later. If you still experience the problem, try contacting the Web site administrator.   &lt;/ID&gt;   &lt;P&gt;      &lt;/ul&gt;   &lt;BR&gt;   &lt;/TD&gt;   &lt;/TR&gt;   &lt;/TABLE&gt;   &lt;/BODY&gt;      &lt;/HTML&gt;                      "/>
<Vuln type="Vulnerability" risk="Medium" name="Frontpage check (1)" url="/_vti_inf.html" bugtraq="" comment="Frontpage extensions are installed on this computer" data="&lt;html&gt;    &lt;head&gt;  &lt;meta http-equiv=&quot;Content-Type&quot;  content=&quot;text/html; charset=iso-8859-1&quot;&gt;  &lt;title&gt; FrontPage Configuration Information &lt;/title&gt;  &lt;/head&gt;    &lt;body&gt;  &lt;!-- _vti_inf.html version 0.100&gt;  &lt;!--    This file contains important information used by the FrontPage client   (the FrontPage Explorer and FrontPage Editor) to communicate with the   FrontPage server extensions installed on this web server.     The values below are automatically set by FrontPage at installation.  Normally, you do not need to modify these values, but in case   you do, the parameters are as follows:     &apos;FPShtmlScriptUrl&apos;, &apos;FPAuthorScriptUrl&apos;, and &apos;FPAdminScriptUrl&apos; specify   the relative urls for the scripts that FrontPage uses for remote   authoring.  These values should not be changed.     &apos;FPVersion&apos; identifies the version of the FrontPage Server Extensions   installed, and should not be changed.  --&gt;&lt;!-- FrontPage Configuration Information      FPVersion=&quot;4.0.2.3406&quot;      FPShtmlScriptUrl=&quot;_vti_bin/shtml.dll/_vti_rpc&quot;      FPAuthorScriptUrl=&quot;_vti_bin/_vti_aut/author.dll&quot;      FPAdminScriptUrl=&quot;_vti_bin/_vti_adm/admin.dll&quot;  --&gt;  &lt;p&gt;&lt;!--webbot bot=&quot;PurpleText&quot;  preview=&quot;This page is placed into the root directory of your FrontPage web when FrontPage is installed.  It contains information used by the FrontPage client to communicate with the FrontPage server extensions installed on this web server.  You should not delete this file.&quot;  --&gt;&lt;/p&gt;    &lt;h1&gt;FrontPage Configuration Information &lt;/h1&gt;    &lt;p&gt;In the HTML comments, this page contains configuration  information that the FrontPage Explorer and FrontPage Editor need to  communicate with the FrontPage server extensions installed on  this web server. Do not delete this page.&lt;/p&gt;  &lt;/body&gt;  &lt;/html&gt;  "/>
<Vuln type="Vulnerability" risk="Medium" name="Frontpage check (2)" url="_vti_bin/shtml.exe" bugtraq="http://www.securityfocus.com/bid/1608" comment="Some versions of Frontpage are vulnerable to denial of service attacks" data=""/>
<Vuln type="Vulnerability" risk="Medium" name="Frontpage check (3)" url="_vti_bin/shtml.dll" bugtraq="http://www.securityfocus.com/bid/1608" comment="Some versions of Frontpage are vulnerable to denial of service attacks" data=""/>
<Vuln type="Vulnerability" risk="Medium" name="Frontpage check (12)" url="_vti_bin/shtml.dll/nosuch.htm" bugtraq="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0413" comment="Frontpage Server Extensions in IIS 4.0 and 5.0 allows remote attackers to determine the physical path of HTML, HTM, ASP, and SHTML files" data=""/>
<Vuln type="Vulnerability" risk="Medium" name="Frontpage check (13)" url="_vti_bin/shtml.dll/demon.html" bugtraq="http://www.securityfocus.com/bid/1608" comment="Frontpage Server Extensions in IIS 4.0 and 5.0 allows remote attackers to determine the physical path of of HTML, HTM, ASP, and SHTML files" data=""/>
<Vuln type="Vulnerability" risk="Medium" name="Frontpage check (14)" url="_vti_bin/shtml.dll/_vti_rpc" bugtraq="http://www.securityfocus.com/bid/1608" comment="Some versions of Frontpage are vulnerable to denial of service attacks" data=""/>
<Vuln type="Vulnerability" risk="Medium" name="Frontpage check (15)" url="_vti_bin/shtml.dll/&lt;SCRIPT&gt;alert(document.domain)&lt;/SCRIPT&gt;" bugtraq="http://www.securityfocus.com/bid/1608" comment="Some versions of Frontpage are vulnerable to execute Java Scripts" data=""/>
<Vuln type="Vulnerability" risk="Medium" name="Frontpage check (16)" url="_vti_bin/shtml.dll/&lt;SCRIPT&gt;alert(document.domain)&lt;/SCRIPT&gt;.shtml" bugtraq="http://www.securityfocus.com/bid/1608" comment="Some versions of Frontpage are vulnerable to execute Java Scripts" data=""/>
<Vuln type="Vulnerability" risk="Medium" name="Frontpage check (17)" url="_vti_bin/shtml.dll/&lt;SCRIPT&gt;alert(document.cookie)&lt;/SCRIPT&gt;" bugtraq="http://www.securityfocus.com/bid/1608" comment="Some versions of Frontpage are vulnerable to execute Java Scripts" data=""/>
<Vuln type="Vulnerability" risk="High" name="This computer seems to be infected with Nimda" url="//" bugtraq="http://www.cert.org/advisories/CA-2001-26.html" comment="This system seems to be compromised" data="&lt;!--     WARNING!     Please do not alter this file. It may be replaced if you upgrade your web server        If you want to use it as a template, we recommend renaming it, and modifying the new file.     Thanks.  --&gt;      &lt;HTML&gt;    &lt;HEAD&gt;  &lt;META HTTP-EQUIV=&quot;Content-Type&quot; Content=&quot;text-html; charset=Windows-1252&quot;&gt;         &lt;title id=titletext&gt;Under Construction&lt;/title&gt;  &lt;/HEAD&gt;   &lt;body bgcolor=white&gt;   &lt;TABLE&gt;   &lt;TR&gt;   &lt;td id=&quot;tableProps&quot; width=70 valign=top align=center&gt;   &lt;IMG id=&quot;pagerrorImg&quot; SRC=&quot;pagerror.gif&quot; width=36 height=48&gt;     &lt;TD id=&quot;tablePropsWidth&quot; width=400&gt;      &lt;h1 id=errortype style=&quot;font:14pt/16pt verdana; color:#4e4e4e&quot;&gt;   &lt;id id=&quot;Comment1&quot;&gt;&lt;!--Problem--&gt;&lt;/id&gt;&lt;id id=&quot;errorText&quot;&gt;Under Construction&lt;/id&gt;&lt;/h1&gt;   &lt;id id=&quot;Comment2&quot;&gt;&lt;!--Probable causes:&lt;--&gt;&lt;/id&gt;&lt;id id=&quot;errordesc&quot;&gt;&lt;font style=&quot;font:9pt/12pt verdana; color:black&quot;&gt;   The site you were trying to reach does not currently have a default page. It may be in the process of being upgraded.   &lt;/id&gt;   &lt;br&gt;&lt;br&gt;      &lt;hr size=1 color=&quot;blue&quot;&gt;      &lt;br&gt;   &lt;ID  id=term1&gt;   Please try this site again later. If you still experience the problem, try contacting the Web site administrator.   &lt;/ID&gt;   &lt;P&gt;      &lt;/ul&gt;   &lt;BR&gt;   &lt;/TD&gt;   &lt;/TR&gt;   &lt;/TABLE&gt;   &lt;/BODY&gt;      &lt;/HTML&gt;                      "/>
<Vuln type="Vulnerability" risk="High" name="Possible RDS exploit (msadcs.dll) RFP9902" url="msadc/msadcs.dll" bugtraq="http://www.securityfocus.com/bid/529" comment="Run arbitrary commands (SYSTEM level privileges)" data=""/>
<Vuln type="Vulnerability" risk="Medium" name="Microsoft IIS CodeBrws.ASP Source Code Disclosure Vulnerability" url="iissamples/sdk/asp/docs/codebrws.asp" bugtraq="http://www.securityfocus.com/bid/4525" comment="Source code disclosure" data="&lt;HTML&gt;  &lt;HEAD&gt;  &lt;META NAME=&quot;DESCRIPTION&quot; CONTENT=&quot;ASP Source code browser&quot;&gt;  &lt;META NAME=&quot;GENERATOR&quot; CONTENT=&quot;Microsoft Visual InterDev 1.0&quot;&gt;  &lt;META HTTP-EQUIV=&quot;Content-Type&quot; CONTENT=&quot;text/html; charset=iso8859-1&quot;&gt;  &lt;/HEAD&gt;    &lt;BODY  BGCOLOR=#FFFFFF TOPMARGIN=0 LEFTMARGIN=0 ALINK=#23238E VLINK=#808080 LINK=#FFCC00&gt;  &lt;BASEFONT FACE=&quot;VERDANA, ARIAL, HELVETICA&quot; SIZE=2&gt;    &lt;!-- DISPLAY THE COLOR LEGEND --&gt;  &lt;TABLE BORDER=1&gt;   &lt;TR&gt;     &lt;TD WIDTH=&quot;25&quot; BGCOLOR=&quot;#FF0000&quot;&gt;&amp;nbsp;&amp;nbsp;&lt;/TD&gt;     &lt;TD&gt;&lt;FONT FACE=&quot;VERDANA, ARIAL, HELVETICA&quot; SIZE=&quot;2&quot;&gt;ASP Script&lt;/FONT&gt;&lt;/TD&gt;   &lt;/TR&gt;   &lt;TR&gt;     &lt;TD BGCOLOR=&quot;#0000FF&quot;&gt;&amp;nbsp;&amp;nbsp;&lt;/TD&gt;     &lt;TD&gt;&lt;FONT FACE=&quot;VERDANA, ARIAL, HELVETICA&quot; SIZE=&quot;2&quot;&gt;Comments&lt;/FONT&gt;&lt;/TD&gt;   &lt;/TR&gt;   &lt;TR&gt;     &lt;TD BGCOLOR=&quot;#000000&quot;&gt;&amp;nbsp;&amp;nbsp;&lt;/TD&gt;         &lt;TD&gt;&lt;FONT FACE=&quot;VERDANA, ARIAL, HELVETICA&quot; SIZE=&quot;2&quot;&gt;HTML and Text&lt;/FONT&gt;&lt;/TD&gt;        &lt;/TR&gt;  &lt;/TABLE&gt;    &lt;HR&gt;  &lt;FONT FACE=&quot;VERDANA, ARIAL, HELVETICA&quot; SIZE=&quot;2&quot;&gt;    &lt;H1&gt;View Active Server Page Source-- Access Denied&lt;/H1&gt;  &lt;/FONT&gt;  &lt;/BODY&gt;  &lt;/HTML&gt;    "/>
</HttpAudit>
</Port>
<Port num="110" name="pop3" desc="pop version 3, postoffice v.3, post office, post office protocol - version 3, post office protocol 3">
<Pop3Audit banner=""/>
</Port>
<Port num="135" name="epmap" desc="dce endpoint resolution, location service, ncs local location broker">
<MsRpcAudit Port="135" Interfaces="11">
<UUID_IFID ID="e1af8308-5d1f-11c9-91a4-08002b14a0fa v3.0">
<PipeIfid>
<Pipe>epmapper</Pipe>
<Description>RPC endpoint mapper</Description>
<Service>RpcSs</Service>
<OS>Windows NT 4.0, 2000, XP, 2003</OS>
</PipeIfid>
</UUID_IFID>
<UUID_IFID ID="0b0a6584-9e0f-11cf-a3cf-00805f68cb1b v1.1">
<PipeIfid>
<OS>Windows 2000, XP, 2003</OS>
</PipeIfid>
</UUID_IFID>
<UUID_IFID ID="975201b0-59ca-11d0-a8d5-00a0c90d8051 v1.0"/>
<UUID_IFID ID="e60c73e6-88f9-11cf-9af1-0020af6e72f4 v2.0"/>
<UUID_IFID ID="99fcfec4-5260-101b-bbcb-00aa0021347a v0.0"/>
<UUID_IFID ID="b9e79e60-3d52-11ce-aaa1-00006901293f v0.2"/>
<UUID_IFID ID="412f241e-c12a-11ce-abff-0020af6e7a17 v0.2"/>
<UUID_IFID ID="00000136-0000-0000-c000-000000000046 v0.0"/>
<UUID_IFID ID="c6f3ee72-ce7e-11d1-b71e-00c04fc3111a v1.0"/>
<UUID_IFID ID="4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 v0.0"/>
<UUID_IFID ID="000001a0-0000-0000-c000-000000000046 v0.0"/>
</MsRpcAudit>
</Port>
<Port num="139" name="netbios-ssn" desc="netbios session service">
<NetBiosAudit>
<NetMachineInfo Name="192.168.0.2" Type="NT WORKSTATION" Platform="500" Version="5.0" TypeID="69639" Comment=""/>
<DateTime Date="1/22/2005" Time="8:11:5 PM"/>
<SecurityPolicy>
<Policy Name="Minimum Password Length" Setting="0 characters"/>
<Policy Name="Maximum Password Age" Setting="42 days"/>
<Policy Name="Minimum Password Age" Setting="passwords may be changed immediately."/>
<Policy Name="Logoff Forced After" Setting="users are not forced to log off."/>
<Policy Name="Password Uniqueness Depth" Setting="no password history is kept."/>
<Policy Name="Lockout Duration" Setting="30 minutes."/>
<Policy Name="Lockout Reset Window" Setting="30 minutes."/>
<Policy Name="Lockout Threhshold" Setting="account lockout is turned off."/>
<Policy Name="This machine&apos;s logon role" Setting="primary domain controller."/>
<Policy Name="The name of the PDC is" Setting=""/>
<Policy Name="The name of the domain is" Setting="CAMELOT"/>
</SecurityPolicy>
<NetBiosNames MacAddress="00:80:48:2A:82:FD" MacProducer="COMPEX INCORPORATED">
<Vuln type="Vulnerability" risk="Medium" name="Using NetBIOS to retrieve information from a Windows host" bugtraq="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0621" solution="Block Udp 137 Port" comment="A remote attacker may use this to gain access to sensitive information such as computer name, workgroup/domain name, currently logged on user name."/>
<NetBiosName>
<Num>0</Num>
<Name>CAMELOT</Name>
<NameNum>00</NameNum>
<Group>UNIQUE</Group>
<Status>REGISTERED</Status>
<Description>Workstation Service</Description>
</NetBiosName>
<NetBiosName>
<Num>1</Num>
<Name>CAMELOT</Name>
<NameNum>20</NameNum>
<Group>UNIQUE</Group>
<Status>REGISTERED</Status>
<Description>File Server Service</Description>
</NetBiosName>
<NetBiosName>
<Num>2</Num>
<Name>NSAGROUP</Name>
<NameNum>00</NameNum>
<Group>GROUP</Group>
<Status>REGISTERED</Status>
<Description>Domain Name</Description>
</NetBiosName>
<NetBiosName>
<Num>3</Num>
<Name>NSAGROUP</Name>
<NameNum>1E</NameNum>
<Group>GROUP</Group>
<Status>REGISTERED</Status>
<Description>Potential Master Browser</Description>
</NetBiosName>
<NetBiosName>
<Num>4</Num>
<Name>CAMELOT</Name>
<NameNum>03</NameNum>
<Group>UNIQUE</Group>
<Status>REGISTERED</Status>
<Description>Messenger Service</Description>
</NetBiosName>
<NetBiosName>
<Num>5</Num>
<Name>INet~Services</Name>
<NameNum>1C</NameNum>
<Group>GROUP</Group>
<Status>REGISTERED</Status>
<Description>Internet Information Server</Description>
</NetBiosName>
<NetBiosName>
<Num>6</Num>
<Name>IS~CAMELOT</Name>
<NameNum>00</NameNum>
<Group>UNIQUE</Group>
<Status>REGISTERED</Status>
<Description>Internet Information Server</Description>
</NetBiosName>
<NetBiosName>
<Num>7</Num>
<Name>ADMINISTRATOR</Name>
<NameNum>03</NameNum>
<Group>UNIQUE</Group>
<Status>REGISTERED</Status>
<Description>Messenger Service</Description>
</NetBiosName>
</NetBiosNames>
<users>
<user name="Administrator" fullname="" desc="Built-in account for administering the computer/domain" id="500" enabled="1" sid="S-1-5-21-1078081533-854245398-1957994488-500" Type="User" Domain="CAMELOT">
<userflag>The logon script executed</userflag>
<userflag>Password does not expire</userflag>
</user>
<user name="Guest" fullname="" desc="Built-in account for guest access to the computer/domain" id="501" enabled="0" sid="S-1-5-21-1078081533-854245398-1957994488-501" Type="User" Domain="CAMELOT">
<userflag>The logon script executed</userflag>
<userflag>The user's account is disabled</userflag>
<userflag>No password is required</userflag>
<userflag>Password does not expire</userflag>
</user>
<user name="IUSR_CAMELOT" fullname="Internet Guest Account" desc="Built-in account for anonymous access to Internet Information Services" id="1001" enabled="1" sid="S-1-5-21-1078081533-854245398-1957994488-1001" Type="User" Domain="CAMELOT">
<userflag>The logon script executed</userflag>
<userflag>No password is required</userflag>
<userflag>Password does not expire</userflag>
</user>
<user name="IWAM_CAMELOT" fullname="Launch IIS Process Account" desc="Built-in account for Internet Information Services to start out of process applications" id="1002" enabled="1" sid="S-1-5-21-1078081533-854245398-1957994488-1002" Type="User" Domain="CAMELOT">
<userflag>The logon script executed</userflag>
<userflag>No password is required</userflag>
<userflag>Password does not expire</userflag>
</user>
<user name="LNSS_MONITOR_USR" fullname="GFI LNSS Monitor Account" desc="Built-in account for GFI LNSS Monitor" id="1003" enabled="1" sid="S-1-5-21-1078081533-854245398-1957994488-1003" Type="User" Domain="CAMELOT">
<userflag>The logon script executed</userflag>
<userflag>Password does not expire</userflag>
</user>
<user name="VUSR_CAMELOT" fullname="VSA Server Account" desc="Account for the Visual Studio Analyzer server components" id="1000" enabled="1" sid="S-1-5-21-1078081533-854245398-1957994488-1000" Type="User" Domain="CAMELOT">
<userflag>The logon script executed</userflag>
<userflag>No password is required</userflag>
<userflag>Password does not expire</userflag>
</user>
</users>
<userlogs>
<userlog name="Administrator" desc="Built-in account for administering the computer/domain" Privilege="Administrator">
<Logon_Server>\\*</Logon_Server>
<Max_Storage>UNLIMITED</Max_Storage>
<Password_Last_changed>16:17:04  06/06/2004</Password_Last_changed>
<Last_Login>Sat Jan 22 17:47:07 20 5
</Last_Login>
<Good_Logins>365</Good_Logins>
<Bad_Logins>3</Bad_Logins>
<User_Flags>
<Flag>UF_SCRIPT</Flag>
<Flag>UF_NORMAL_ACCOUNT</Flag>
<Flag>UF_DONT_EXPIRE_PASSWD</Flag>
</User_Flags>
</userlog>
<userlog name="Guest" desc="Built-in account for guest access to the computer/domain" Privilege="Guest">
<Logon_Server>\\*</Logon_Server>
<Max_Storage>UNLIMITED</Max_Storage>
<User_Flags>
<Flag>UF_SCRIPT</Flag>
<Flag>UF_ACCOUNTDISABLE</Flag>
<Flag>UF_PASSWD_NOTREQD</Flag>
<Flag>UF_PASSWD_CANT_CHANGE</Flag>
<Flag>UF_NORMAL_ACCOUNT</Flag>
<Flag>UF_DONT_EXPIRE_PASSWD</Flag>
</User_Flags>
</userlog>
<userlog name="IUSR_CAMELOT" fullname="Internet Guest Account" desc="Built-in account for anonymous access to Internet Information Services" Privilege="Guest">
<Logon_Server>\\*</Logon_Server>
<Max_Storage>UNLIMITED</Max_Storage>
<Password_Last_changed>20:55:10  06/25/2004</Password_Last_changed>
<Last_Login>Sat Jan 22 20:02:49 20 5
</Last_Login>
<User_Flags>
<Flag>UF_SCRIPT</Flag>
<Flag>UF_PASSWD_NOTREQD</Flag>
<Flag>UF_PASSWD_CANT_CHANGE</Flag>
<Flag>UF_NORMAL_ACCOUNT</Flag>
<Flag>UF_DONT_EXPIRE_PASSWD</Flag>
</User_Flags>
</userlog>
<userlog name="IWAM_CAMELOT" fullname="Launch IIS Process Account" desc="Built-in account for Internet Information Services to start out of process applications" Privilege="Guest">
<Logon_Server>\\*</Logon_Server>
<Max_Storage>UNLIMITED</Max_Storage>
<Password_Last_changed>20:54:38  06/25/2004</Password_Last_changed>
<Last_Login>Sat Jan 22 18:45:50 20 5
</Last_Login>
<Good_Logins>90</Good_Logins>
<User_Flags>
<Flag>UF_SCRIPT</Flag>
<Flag>UF_PASSWD_NOTREQD</Flag>
<Flag>UF_PASSWD_CANT_CHANGE</Flag>
<Flag>UF_NORMAL_ACCOUNT</Flag>
<Flag>UF_DONT_EXPIRE_PASSWD</Flag>
</User_Flags>
</userlog>
<userlog name="LNSS_MONITOR_USR" fullname="GFI LNSS Monitor Account" desc="Built-in account for GFI LNSS Monitor" Privilege="Administrator">
<Logon_Server>\\*</Logon_Server>
<Max_Storage>UNLIMITED</Max_Storage>
<Password_Last_changed>22:31:15  08/16/2004</Password_Last_changed>
<Last_Login>Mon Aug 16 22:32:10 20 4
</Last_Login>
<Good_Logins>2</Good_Logins>
<User_Flags>
<Flag>UF_SCRIPT</Flag>
<Flag>UF_PASSWD_CANT_CHANGE</Flag>
<Flag>UF_NORMAL_ACCOUNT</Flag>
<Flag>UF_DONT_EXPIRE_PASSWD</Flag>
</User_Flags>
</userlog>
<userlog name="VUSR_CAMELOT" fullname="VSA Server Account" desc="Account for the Visual Studio Analyzer server components" Privilege="Guest">
<Logon_Server>\\*</Logon_Server>
<Max_Storage>UNLIMITED</Max_Storage>
<Password_Last_changed>22:26:21  06/15/2004</Password_Last_changed>
<User_Flags>
<Flag>UF_SCRIPT</Flag>
<Flag>UF_PASSWD_NOTREQD</Flag>
<Flag>UF_NORMAL_ACCOUNT</Flag>
<Flag>UF_DONT_EXPIRE_PASSWD</Flag>
</User_Flags>
</userlog>
</userlogs>
<machines/>
<groups>
<group name="None" desc="Ordinary users" id="513">
<groupflag>SE_GROUP_MANDATORY</groupflag>
<groupflag>SE_GROUP_ENABLED</groupflag>
<groupflag>SE_GROUP_ENABLED_BY_DEFAULT</groupflag>
</group>
</groups>
<Shares>
<Share>
<NetName>\\192.168.0.2\games</NetName>
<Comment/>
<Type>Disk resources</Type>
<DisplayType>The object should be displayed as a share</DisplayType>
</Share>
</Shares>
<HideShares/>
<RemoteConnections/>
<Transports>
<Transport Device="\Device\NetBT_Tcpip_{C353A0F5-08C1-4DB9-A5C7-2242162A9FB9}" NetAddress="00:80:48:2A:82:FD" Producer="COMPEX INCORPORATED"/>
<Transport Device="\Device\NetBT_Tcpip_{C353A0F5-08C1-4DB9-A5C7-2242162A9FB9}" NetAddress="00:80:48:2A:82:FD" Producer="COMPEX INCORPORATED"/>
<Transport Device="\Device\NetbiosSmb" NetAddress="00:00:00:00:00:00" Producer="XEROX CORPORATION"/>
</Transports>
<RemoteProcEnum/>
<BrowserHelperObjects/>
<WeekPasswords>
<Vuln type="Vulnerability" risk="Low" name="It was possible to log into the remote host using a NULL session" bugtraq="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0504" solution="Prevent from connecting to IPC$" comment="The concept of a NULL session is to provide a null username and a null password, which grants the user the &apos;guest&apos; access"/>
</WeekPasswords>
</NetBiosAudit>
</Port>
<Port num="443" name="https" desc="secure http (ssl), http protocol over tls/ssl">
<HttpAudit/>
</Port>
<Port num="445" name="microsoft-ds" desc="microsoft-ds"/>
<Port num="1025" name="blackjack" desc="network blackjack">
<MsRpcAudit Port="1025" Interfaces="2">
<UUID_IFID ID="1ff70682-0a51-30e8-076d-740be8cee98b v1.0">
<PipeIfid>
<Pipe>atsvc</Pipe>
<Description>Scheduler service</Description>
<Service>mstask.exe</Service>
<OS>Windows NT 4.0, 2000, XP, 2003</OS>
</PipeIfid>
</UUID_IFID>
<UUID_IFID ID="378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0">
<PipeIfid>
<Pipe>atsvc</Pipe>
<Description>Scheduler service</Description>
<Service>mstask.exe</Service>
<OS>Windows NT 4.0, 2000, XP, 2003</OS>
</PipeIfid>
</UUID_IFID>
</MsRpcAudit>
</Port>
<Port num="1028" name="Unknown " desc="">
<MsRpcAudit Port="1028" Interfaces="12">
<UUID_IFID ID="00000134-0000-0000-c000-000000000046 v0.0"/>
<UUID_IFID ID="18f70770-8e64-11cf-9af1-0020af6e72f4 v0.0"/>
<UUID_IFID ID="00000131-0000-0000-c000-000000000046 v0.0"/>
<UUID_IFID ID="00000143-0000-0000-c000-000000000046 v0.0"/>
<UUID_IFID ID="00000132-0000-0000-c000-000000000046 v0.0"/>
<UUID_IFID ID="70b51430-b6ca-11d0-b9b9-00a0c922e750 v0.0"/>
<UUID_IFID ID="82ad4280-036b-11cf-972c-00aa006887b0 v2.0"/>
<UUID_IFID ID="98fe2c90-a542-11d0-a4ef-00a0c9062910 v1.0"/>
<UUID_IFID ID="888adddd-9993-11d0-a539-00a0c922e798 v0.0"/>
<UUID_IFID ID="00000001-0000-0000-c000-000000000046 v0.0"/>
<UUID_IFID ID="b196b284-bab4-101a-b69c-00aa00341d07 v0.0"/>
<UUID_IFID ID="b196b286-bab4-101a-b69c-00aa00341d07 v0.0"/>
</MsRpcAudit>
</Port>
<Port num="1433" name="ms-sql-s" desc="microsoft-sql-server">
<MsSqlAudit banner="Connected to SQL MASTER database...">
<Vuln type="Vulnerability" risk="High" name="Microsoft&apos;s SQL Server Blank Password" bugtraq="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-1209" solution="Disable this account, or set a password to it, it is suggested you filter incoming tcp traffic to this port." comment="Account &apos;sa&apos; has password &apos;&apos;,An attacker may use this flaw to execute commands against the remote host, as well as read your database content."/>
</MsSqlAudit>
</Port>
</Tcp>
<Udp>
<Port num="135" name="epmap" desc="dce endpoint resolution, location service"/>
<Port num="138" name="netbios-dgm" desc="netbios datagram service"/>
<Port num="161" name="snmp" desc="simple net mgmt proto, snmp">
<SnmpAudit Enterprise="Microsoft" Name="Windows NT" Type="Workstation">
<SnmpEntry Oid="1.3.6.1.2.1.1.1.0" Community="public" Type="Octet String" Value="Hardware: x86 Family 15 Model 0 Stepping 7 AT/AT COMPATIBLE - Software: Windows 2000 Version 5.0 (Build 2195 Uniprocessor Free)"/>
<SnmpEntry Oid="1.3.6.1.2.1.1.2.0" Community="public" Type="Object Identifier" Value="1.3.6.1.4.1.311.1.1.3.1.1"/>
<SnmpEntry Oid="1.3.6.1.2.1.1.3.0" Community="public" Type="Ticks" Value="2 h. 25 m. 10 s. ( 871019 ticks )"/>
<SnmpEntry Oid="1.3.6.1.2.1.1.4.0" Community="public" Type="Octet String" Value=""/>
<SnmpEntry Oid="1.3.6.1.2.1.1.5.0" Community="public" Type="Octet String" Value="CAMELOT"/>
<SnmpEntry Oid="1.3.6.1.2.1.1.6.0" Community="public" Type="Octet String" Value=""/>
<SnmpEntry Oid="1.3.6.1.2.1.1.7.0" Community="public" Type="Integer" Value="76"/>
</SnmpAudit>
</Port>
<Port num="445" name="microsoft-ds" desc="microsoft-ds"/>
<Port num="1434" name="ms-sql-m" desc="microsoft-sql-monitor">
<UdpMsSqlAudit>
<MsSqlServer name="CAMELOT">
<ServerName>CAMELOT</ServerName>
<InstanceName>MSSQLSERVER</InstanceName>
<IsClustered>No</IsClustered>
<Version>8.00.194</Version>
<tcp>1433</tcp>
<np>\\CAMELOT\pipe\sql\query</np>
</MsSqlServer>
<Vuln type="Vulnerability" risk="Low" name="Microsoft&apos;s SQL UDP Info Query" bugtraq="" solution="Filter incoming traffic to this port." comment="An attacker may use this to get information about the remote MS SQL database."/>
</UdpMsSqlAudit>
</Port>
</Udp>
</Host>
</Hosts>
</Nsauditor>
