Questions attacking W7

[SephStorm]

Hello all,

I am getting back into my studies and I was hoping I can get a few questions answered here. I have a lab network here at home and I can pretty easily exploit W2k3 machines and some Windows Vista machines with Windows Firewall disabled.

So question 1, with WF enabled, whats the best way to perform port scanning? I've tried nmap with nearly all Windows compatible options that I know, but ICMP, TCP, UDP seem to be well filtered.

Q2: Assuming I've found a host, and know what ports are open and what service are running on those ports, I, plain and simple, have not been able to find exploits for W7. The MSFUpdate works fine, but i'm trying to attack services rather than web applications, and web exploits seem to be the only options available... I've done my research, and I know that there were some new W7 vulnerabilities discovered, and I hadn't patched the systems, so I know they are vulnerable. But even searching exploitdb, exploitsearch and Metasploit exploits, I dont think I found any 2011 exploits not tied to applications running on the victim machine.

Now I am fairly certain that this may be to keep script kiddies from getting the latest exploit code, but that really doesnt help me.

I think i'll limit my questions to those for the moment. Thanks for your help.

[stevo937]

Sounds like you need to research different port scanning techniques and better ways to find exploits. Try limiting your port scans to only a few different ports at the same time. Pick some popular ones. And as for finding exploits... there's no real quick and dirty way that's super effective. Just gotta look through all the major websites out there that list them.

As for unpatched Windows 7 machines, I don't believe there are any exploits out there that can cause remote code execution from outside the machine. The last one that I know of was MS07-something. Remote code executions under Windows 7 probably have to be executed from a booby trapped file.

[SephStorm]

Stevo,

Thanks for the advice. So you are suggesting that probing a single or a few ports rather than the traditional port scan would be more effective? Is Windows Firewall able to detect port scanning and lock down ports?