Telnet to Exchange tells too much info!! 1

[SmokinRR]

I've heard before that there is a way to modify how the Exchange 2000 server answers to a telnet connection on Port 25 so that it is not as blatantly obvious what mail software you are running making you a bit less vulnerable to hacking. Is this possible, and if so how would I go about doing this on my exchange 2000 server.

Thanks for the help in advance!

Jay

 

[SmokinRR]

Well, I found a way to edit this, using the metabase editor available in the Windows 2000 Server Resource Kit. It now does not give out the exchange version info.

Thanks anyway!

Jay

 

[quell]

I would like to try this myself. If you don't mind, please post the steps on how to do this

 

[SmokinRR]

quell,
First, you will need the metabase editor (metaedit.exe) from the Windows 2000 Server Resource Kit. If you don't have the resource kit, you will need to either buy the resource kit from Microsoft or you may get lucky and find a place to download it on the net. Next, after installing the metabase editor, use the following step by step I found. It is quite easy to do, it's like adding a string to the registry. Be very careful and read through the steps very carefully, you won't want to mess anything up in the metabase, it would be disastrous.

http://www.petri.co.il/change_the_smtp_banner.htm

If the link doesn't show, just cut and paste that url into a browser.

Hope this helps

Jay

 

[quell]

Thanks! I believe this will help sites like netcraft from displaying what os you have. Well hopefully. Thanks again.

I would rather have it and not need it, then need it and not have it.

 

[SmokinRR]

Unfortunately, it will not do that. It only masks what version of exchange you are using or mail server for that matter. netcraft will still show's my OS and IIS version correctly.

J

 

[quell]

SmokinRR: hmmm are you running IIS on port 80?

 

[SmokinRR]

Yes, I do have a corporate website on that server as well, and it is running on port 80.

J

 

[quell]

Simply out of curiosity, have you tried stopping IIS then using netcraft? Not that having netcraft identify your server is a big issue. There are many other progams out there that can do this. Just curious.

 

[SmokinRR]

I haven't tried that, however if I have time today I can give it a shot. You may be on to something, however I do need to run IIS, so if that's what it is, it's a necessary evil.

 

[quell]

hehe I here ya. When I ran our IIS server on port 80 I had around 4-5 bad attempts a day. I would look through the logs and see request for stuff like /%20/./../cmd.exe or something along those lines. After port scanning the IP's that made the request, I found out that they were zombie machines set to port scan a range of IP's for IIS exploits. And there is a ton of these pc's out there. Anyway after our upgrade I changed the port number and have not seen any attempts yet *knock on wood*